Pour ceux qui auraient encore dans leurs logs apache des lignes comme celle-ci :
213.211.134.23 [date] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400
Ce script permet de lister dans un fichier texte les ip présentes dans les log apache et ayant envoyé des requêtes de scanne de vulnérabilités :
#!/bin/bash
#Block DFind
cd /home/user/scripts/
echo '' > w00t_report.txt
echo '' > w00t_ip.txt
echo '' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '- File : /var/log/error.log -' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '' >> w00t_report.txt
countwoot=0
countoff=0
for ip in `cat /var/log/apache2/error.log | grep w00tw00t | awk '{print $8}' | sed 's/]//g' | sort -t. -n -k1,1 -k2,2 -k3,3 -k4,4 -u` ; do
countoff=$[$countoff+1]
countwoot=$[$countwoot+1]
echo IP $countwoot : $ip >> w00t_report.txt
echo $ip >> w00t_ip.txt
done
echo $countwoot / $countoff >> w00t_report.txt
echo '' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '- File : /var/log/access.log -' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '' >> w00t_report.txt
countwoot=0
countoff=0
for ip in `cat /var/log/apache2/access.log | grep w00tw00t | awk '{print $1}' | sort -t. -n -k1,1 -k2,2 -k3,3 -k4,4 -u` ; do
countoff=$[$countoff+1]
countwoot=$[$countwoot+1]
echo IP $countwoot : $ip >> w00t_report.txt
echo $ip >> w00t_ip.txt
done
echo $countwoot / $countoff >> w00t_report.txt
echo '' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '- File : /var/log/other_vhosts_access.log -' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '' >> w00t_report.txt
countwoot=0
countoff=0
for ip in `cat /var/log/apache2/other_vhosts_access.log | grep w00tw00t | awk '{print $2}' | sort -t. -n -k1,1 -k2,2 -k3,3 -k4,4 -u` ; do
countoff=$[$countoff+1]
countwoot=$[$countwoot+1]
echo IP $countwoot : $ip >> w00t_report.txt
echo $ip >> w00t_ip.txt
done
echo $countwoot / $countoff >> w00t_report.txt
echo '' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '- w00T IP Summary for All Apache Log Files -' >> w00t_report.txt
echo '-------------------------------------------------' >> w00t_report.txt
echo '' >> w00t_report.txt
countwoot=0
countoff=0
for ip in `cat /home/user/scripts/w00t_ip.txt | awk '{print $1}' | sort -t. -n -k1,1 -k2,2 -k3,3 -k4,4 -u` ; do
countoff=$[$countoff+1]
countwoot=$[$countwoot+1]
echo IP $countwoot : $ip >> w00t_report.txt
echo $ip >> w00t_ip.txt
iptables -I INPUT -s $ip -j DROP
iptables -I OUTPUT -s $ip -j DROP
done
echo $countwoot / $countoff >> w00t_report.txt
cat w00t_report.txt
exit 0
