PHP3的NetBus木马检测程序--socket
Netbus detector
<?
function connectToPort ($host, $port) {
// This function is the interesting part of the script.
// It may be called from the "MAIN"
// part of the script further down.
// Not declared ill unless we find something
$status = 0;
print "Trying port $port at $host...";
// Open a socket to the user’s computer (or proxy; in
// this case, the result can’t be trusted)
$socket = fsockopen($host, $port, &$errno, &$errstr);
if ($socket) {
// A connection could be made. Poor user; this is probably
// Netbus answering...
print "Port $port connection established - BAD!p>";
$status = 1;
// Let’s see if it’s speaking
// To make sure that we will not be listening for ever
// in case of a silent (but open) port
set_socket_blocking($socket, 0);
$count = 0;
$portOutput = "";
// We will not keep trying for ever; let’s stop after
// 10000 glances
while ($count < 10000) {
if ($readString = fread($socket, 1)) {
// Convert <, >, " and & to HTML entities
$readString = htmlspecialchars($readString);
// Add the output to the sum of output
$portOutput .= $readString;
}
$count++;
}
// Enough of this. Close the connection.
fclose($socket);
if ($portOutput != "") {
print "Output:$portOutput
";
}
} else {
// In case we have good news:
print "Port $port connection refused - good";
}
// Return status for the port we just examined
return $status;
}
function printForm ($host, $uri) {
// Make sure the user knows what’s going on.
// This should not be dangerous in any way, but let’s ask anyway
print "
Permission to connect to ports 12345
and 12346 at host
$host granted: type=checkbox name=permission value="ok">
";
}
// **********
// MAIN
// **********
// Some definitions - the standard Netbus ports
$netBusPortA = 12345;
$netBusPortB = 12346;
// This may seem stupid; but if PHP is running in "safe mode",
// the SCRIPT_URI environment variable doesn’t seem to
// be readily available
$uri = "http://" . $SERVER_NAME . $REQUEST_URI;
// Standard CGI environment variable; we are not using CGI, but
// fortunately, the variable is still avaliable
$host = gethostbyaddr($REMOTE_ADDR);
// Requesting host innocent until otherwise proven
$netBusStatus = 0;
// Trying to make sure that the user actually wants me
// to scan his/her ports. - And trying to make sure that nobody is
// directly linking to the script.
if (!(($permission == "ok") &&
($REQUEST_METHOD == "POST") && ($HTTP_REFERER == $uri))) {
// Write the permission-asking form - i.e. call the
// previously defined "printForm" function
printForm($host, $uri);
} else {
// Paranoia checks OK. Let’s do it
print "
Processing host $host...
";
print " "; // Call script and add the status to the sum of status // codes. The function "connectToPort" is defined above $netBusStatus += connectToPort($host, $netBusPortA); print " ";
print " "; // Call the connect-function again for the other port $netBusStatus += connectToPort($host, $netBusPortB); print " ";
print " ";
// Summarize results
print "Conclusion";
if ($netBusStatus > 0) {
// Damn. The sum of status codes should be zero.
// User probably has Netbus installed.
print "
Connection to at least one Netbus port
succeeded. That’s a bad sign!p>
This means that you probably have Netbus installed
on your computer. See
ISS’
alert summary for removal instructions.
";
} else {
// It’s nice to bring good news
print "
No Netbus ports responded at host $host.
Congratulations - that’s a good> sign!
This may not be a definitive test, though:
- If Netbus is installed at non-standard ports or
- if you are sitting behind a firewall,
this utility will fail to detect Netbus.
You may try again.
";
}
}
?>
|