X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=libs%2Flib_detector.php;h=9ba34320582811687ea1474e0d863ed300440cae;hb=e5d8cdb8fcb063d776d830ed546e1bf130b22316;hp=60c9f85dab9ce250d33be2e3e77ad688abe4c10f;hpb=a6363a77b01403ce6073c12d294d7b9249c0f305;p=ctracker.git diff --git a/libs/lib_detector.php b/libs/lib_detector.php index 60c9f85..9ba3432 100644 --- a/libs/lib_detector.php +++ b/libs/lib_detector.php @@ -34,14 +34,14 @@ function initCrackerTrackerArrays () { } // Whitelist some absolute query strings (see below) - $GLOBALS['whitelist'] = array( + $GLOBALS['ctracker_whitelist'] = array( 'cmd=new', // LinPHA 'cmd=edit', // LinPHA 'cmd=lostpw' // LinPHA ); // Attacks we should detect and blok - $GLOBALS['wormprotector'] = array( + $GLOBALS['ctracker_wormprotector'] = array( 'chr(', 'chr=', 'chr%20', '%20chr', 'wget%20', '%20wget', 'wget(', 'cmd=', '%20cmd', 'cmd%20', 'rush=', '%20rush', 'rush%20', 'union%20', '%20union', 'union(', 'union=', 'echr(', '%20echr', 'echr%20', 'echr=', @@ -66,11 +66,12 @@ function initCrackerTrackerArrays () { 'select from', 'drop%20', '.system', 'getenv', 'http_', '_php', 'php_', 'phpinfo()', '\', 'sql=', 'div style=', 'overflow: auto', 'height: 1px', 'cc%20', 'admin_action=', 'path=', 'action=http', 'page=http', 'module=http', 'op=http', 'id=http', 'id%3Dhttp', 'action%3Dhttp', 'page%3Dhttp', - 'module%3Dhttp', 'op%3Dhttp', 'starhack', '../../', 'directory=http', 'dir=http', 'busca', 'uol.com' + 'module%3Dhttp', 'op%3Dhttp', 'starhack', '../../', 'directory=http', 'dir=http', 'busca', 'uol.com', + '=http://', '=https://','=ftp://','_SESSION' ); // Block these words found in POST requests - $GLOBALS['post_blacklist'] = array( + $GLOBALS['ctracker_post_blacklist'] = array( // These two lines are for detecting hidden link spam in wikis, forums, guestbooks, etc. 'div style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden', 'overflow: auto', 'height: 1px', 'display: hidden', @@ -78,28 +79,31 @@ function initCrackerTrackerArrays () { 'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy', 'busca' ); + + // Load email header + $GLOBALS['ctracker_header'] = crackerTrackerLoadEmailTemplate('header'); } // Checks for worms function isCrackerTrackerWormDetected () { // Check against the whole list - $GLOBALS['checkworm'] = str_replace($GLOBALS['wormprotector'], '*', $_SERVER['QUERY_STRING']); + $GLOBALS['ctracker_checkworm'] = str_replace($GLOBALS['ctracker_wormprotector'], '*', crackerTrackerQueryString()); // If it differs to original and the *whole* request string is not in whitelist // then blog the attempt - return ($GLOBALS['checkworm'] != $_SERVER['QUERY_STRING'] && (!in_array($_SERVER['QUERY_STRING'], $GLOBALS['whitelist']))); + return ($GLOBALS['ctracker_checkworm'] != crackerTrackerQueryString() && (!in_array(crackerTrackerQueryString(), $GLOBALS['ctracker_whitelist']))); } // Checks POST data function isCrackerTrackerPostAttackDetected () { // Implode recursive the whole $_POST array - $GLOBALS['post_track'] = implode_r('', $_POST); + $GLOBALS['ctracker_post_track'] = implode_r('', $_POST); // Check for suspicious POST data - $GLOBALS['check_post'] = str_replace($GLOBALS['post_blacklist'], '*', $GLOBALS['post_track']); + $GLOBALS['ctracker_check_post'] = str_replace($GLOBALS['ctracker_post_blacklist'], '*', $GLOBALS['ctracker_post_track']); // Is it detected? - return ((isCrackerTrackerWormDetected()) || ($GLOBALS['check_post'] != $GLOBALS['post_track'])); + return ((isCrackerTrackerWormDetected()) || ($GLOBALS['ctracker_check_post'] != $GLOBALS['ctracker_post_track'])); } // Prepares a mail and send it out @@ -107,13 +111,13 @@ function sendCrackerTrackerMail () { // Mail content $mail = "Attack detected: ----------------------------------------------------- -Remote-IP: ".$_SERVER['REMOTE_ADDR']." -User-Agent: ".$_SERVER['HTTP_USER_AGENT']." -Request-string: ".$_SERVER['QUERY_STRING']." -Filtered string: ".$GLOBALS['checkworm']." -Server: ".$_SERVER['SERVER_NAME']." -Script: ".$_SERVER['SCRIPT_NAME']." -Referrer: ".$_SERVER['HTTP_REFERRER']." +Remote-IP : ".determineCrackerTrackerRealRemoteAddress()." +User-Agent : ".crackerTrackerUserAgent()." +Request-string : ".crackerTrackerQueryString()." +Filtered string : ".$GLOBALS['ctracker_checkworm']." +Server : ".crackerTrackerServerName()." +Script : ".crackerTrackerScriptName()." +Referrer : ".crackerTrackerReferer()." ----------------------------------------------------- "; @@ -127,12 +131,28 @@ Referrer: ".$_SERVER['HTTP_REFERRER']." crackerTrackerDie(); } +// Sends the ticket emails out +function sendCrackerTrackerTicketMails () { + // Load user template + $mail = crackerTrackerLoadEmailTemplate('user_add_ticket', $GLOBALS['ctracker_last_ticket']); + + // Send email to the user + crackerTrackerSendMail($mail, $GLOBALS['ctracker_last_ticket']['ctracker_ticket_email'], getCrackerTrackerLocalized('user_add_ticket_subject')); + + // Load webmaster template + $mail = crackerTrackerLoadEmailTemplate('webmaster_add_ticket', $GLOBALS['ctracker_last_ticket'], getCrackerTrackerConfig('ctracker_language')); + + // Send email to the user + crackerTrackerSendMail($mail, null, getCrackerTrackerLocalized('webmaster_add_ticket_subject')); +} + // Sends a mail out -function crackerTrackerSendMail ($mail) { +function crackerTrackerSendMail ($mail, $recipient = null, $subject = null) { // Construct dummy array $rowData = array( - 'remote_addr' => $_SERVER['REMOTE_ADDR'], - 'check_worm' => $GLOBALS['checkworm'] + 'remote_addr' => determineCrackerTrackerRealRemoteAddress(), + 'check_worm' => $GLOBALS['ctracker_checkworm'], + 'server_name' => crackerTrackerServerName() ); // Only send email if not yet found @@ -140,10 +160,13 @@ function crackerTrackerSendMail ($mail) { // Send the email out only in non-debug mode if (isCrackerTrackerDebug()) { // Output message - print '
' . $mail . '
'; + print 'Recipient='.$recipient.'
Subject='.$subject.'
Text=
' . $mail . '
'; // All fine return true; + } elseif (!is_null($recipient)) { + // Recipient specified + return mail($recipient, $subject, $mail, $GLOBALS['ctracker_header']); } elseif (isset($GLOBALS['ctracker_email'])) { // Send it return mail($GLOBALS['ctracker_email'], 'CTracker: Attack detected!', $mail, $GLOBALS['ctracker_header']); @@ -159,13 +182,16 @@ function sendCrackerTrackerPostMail () { // Mail text $mail = "POST-Attack detected: ----------------------------------------------------- -Remote-IP: ".$_SERVER['REMOTE_ADDR']." -User-Agent: ".$_SERVER['HTTP_USER_AGENT']." -POST string: ".$GLOBALS['post_track']." -Filtered worm string: ".$GLOBALS['checkworm']." -Filtered POST string: ".$GLOBALS['check_post']." -Server: ".$_SERVER['SERVER_NAME']." -Script: ".$_SERVER['SCRIPT_NAME']." +Remote-IP : ".determineCrackerTrackerRealRemoteAddress()." +User-Agent : ".crackerTrackerUserAgent()." +Request-string : ".crackerTrackerQueryString()." +Filtered string : ".$GLOBALS['ctracker_checkworm']." +Server : ".crackerTrackerServerName()." +Script : ".crackerTrackerScriptName()." +Referrer : ".crackerTrackerReferer()." +----------------------------------------------------- +POST string : ".$GLOBALS['ctracker_post_track']." +Filtered POST string : ".$GLOBALS['ctracker_check_post']." ----------------------------------------------------- "; @@ -188,7 +214,15 @@ function crackerTrackerDie () { if (!isCrackerTrackerDebug()) sleep(mt_rand(10,30)); // Bye, bye... - die(); + if (isCrackerTrackerDebug()) { + // With debug backtrace + print '
';
+		debug_print_backtrace();
+		die('
'); + } else { + // Simple die() + die(); + } } // Logs the attack attempt @@ -196,22 +230,68 @@ function crackerTrackerLogAttack () { // Aquire database link aquireCrackerTrackerDatabaseLink(); + // By default no proxy is used + $proxyUsed = 'N'; + + // Did the attacker use a proxy? + if (isCrackerTrackerProxyUsed()) { + // Set it + $proxyUsed = 'Y'; + } // END - if // Prepare array for database insert $rowData = array( - 'remote_addr' => $_SERVER['REMOTE_ADDR'], - 'user_agent' => $_SERVER['HTTP_USER_AGENT'], - 'post_data' => $GLOBALS['post_track'], - 'check_worm' => $GLOBALS['checkworm'], - 'check_post' => $GLOBALS['check_post'], - 'server_name' => $_SERVER['SERVER_NAME'], - 'script_name' => $_SERVER['SCRIPT_NAME'], - 'referer' => $_SERVER['HTTP_REFERER'] + 'remote_addr' => determineCrackerTrackerRealRemoteAddress(), + 'user_agent' => crackerTrackerUserAgent(), + 'get_data' => crackerTrackerQueryString(), + 'post_data' => $GLOBALS['ctracker_post_track'], + 'check_worm' => $GLOBALS['ctracker_checkworm'], + 'check_post' => $GLOBALS['ctracker_check_post'], + 'server_name' => crackerTrackerServerName(), + 'script_name' => crackerTrackerScriptName(), + 'referer' => crackerTrackerReferer(), + 'proxy_used' => $proxyUsed ); // Insert the array in database crackerTrackerInsertArray($rowData); } +// Alerts the current user about malicious/suspicious traffic +function crackerTrackerAlertCurrentUser () { + // Is there some data? + if (isset($GLOBALS['ctracker_last_suspicious_entry'])) { + // Does the user have a ticket? + if (ifCrackerTrackerIpHasTicket()) { + // Should we continue? + if (isset($_POST['ctracker_continue'])) { + // Set cookie + sendCrackerTrackerCookie(); + + // And redirect to same URL + crackerTrackerRedirectSameUrl(); + } elseif (ifCrackerTrackerCookieIsSet()) { + // Return here to normal program + return; + } else { + // Load "Thank you" template + crackerTrackerLoadTemplate('add_ticket_thanks'); + } + } elseif ((isset($_POST['ctracker_add_ticket'])) && (!empty($_POST['name'])) && (!empty($_POST['email']))) { + // Add the ticket + addCrackerTrackerTicket($_POST); + + // Send the email out + sendCrackerTrackerTicketMails(); + } else { + // Display the form for new ticket + crackerTrackerLoadTemplate('add_ticket'); + } + } // END - if + + // And stop here + die(); +} + // [EOF] ?>