[gull] Shellshock et DDos irc bot perl...

[felix]

A toutes fins utiles, je poste ici, mon petit DDosIrcBotKiller.pl

On Mon, Oct 27, 2014 at 06:41:52PM +0100, felix wrote:

> Si ce sujet interesse, je peux organiser un petit workshop avec
> une présentation de ce script:
> 
>   DDoS Perl IrcBot v1.0 / 2012 by DDoS Security Team

---- DDosIrcBotKiller.pl ----
#!/usr/bin/perl

my @rps=("/usr/local/apache/bin/httpd -DSSL", "/usr/sbin/httpd -k start -DSSL",
   "/usr/sbin/httpd", "/usr/sbin/sshd -i","/usr/sbin/sshd","/usr/sbin/sshd -D",
   "/usr/sbin/apache2 -k start", "/sbin/syslogd", "/sbin/klogd -c 1 -x -x",
   "/usr/sbin/acpid", "/usr/sbin/cron");

opendir my $dh,"/proc";
map {
    open my $fh,"/proc/".$_."/cmdline";
    my $cmdline=<$fh>;
    close $fh;
    if (grep { $cmdline eq $_ } @rps) {
        printf "Sending SIGKILL to process %d\n", $_;
        kill 9, $_;
    }; }
grep { readlink("/proc/".$_."/exe") =~ m|/perl| }
grep { /^\d+$/ }
readdir $dh;
---- DDosIrcBotKiller.pl ----


-- 
 Félix Hauri  -  <felix at f-hauri.ch>  -  http://www.f-hauri.ch