CODE RED Hunter / Monitor

[ogge1]

I made a quite simple CODERED Hunter / Monitor package this week. It's actually a fully fledged APACHE/PHP/MYSQL server. With some modifications.

If anyone is intrested in checking it out please do. I need help with improving it.

I primary need help with a reliable CRON program that runs on booth Win9x/WinNT/WIN2k. Aswell as imrpovements of it in overall.

Please be my guest to take a look at it on

http://codehunt.sourceforde.net

/Fredrik

[brandonschnell]

take a look at:

http://www.schnell.to/

i've got a script on the first page to show me the current number of code red attempts. i thought it was pretty funny when i created it =).

[alcapone]

wait wait wait. code red is working only for iis servers, so why in the world would you even think of apache when writing smthg to monitor 'baby'?

cheers,
AlCapone

[brandonschnell]

so we can be smug when we point out to the admins of IIS that they're infected with the code red worm.

its mainly for use within companies to track down the offenders and yank their network connections. with this subtle hint the iis admins have the opportunity to reinstall everything (many companies require this after a known worm attacks a system and don't accept the NAV & patch fix).

[ogge1]

That was exactly my point actually :-)

My Employer is a Global company with apx 14K+ KNEWN IIS servers + some additional hidden variants. And all says itself that it's impossible to track everything and see that everyone has done theier job right. aswell there will also be idiots reinstalling the system and FORGETTING the patches.. and the ball is rolling again 🙂

My intention was to make a tool that at least could monitor the subnet of your own branch and aswell send feedback report to a corporate server.

Brandon: I'm not sure how you performed your CODERED logs searches. did you use Unix GREP or Regular expressions? (although my project was written with Windows users without nifty unix tools handy so i had to use REgular expressions)

For those of you that have ideas of improvements, please let me know :-) I'm eager to have them.

/Fredrik

[ogge1]

oops made a typo.. i ment 4k+ IIS servers :-)

Fredrik Elmqvist wrote:

That was exactly my point actually :-)

My Employer is a Global company with apx 14K+ KNEWN IIS servers + some additional hidden variants. And all says itself that it's impossible to track everything and see that everyone has done theier job right. aswell there will also be idiots reinstalling the system and FORGETTING the patches.. and the ball is rolling again 🙂

My intention was to make a tool that at least could monitor the subnet of your own branch and aswell send feedback report to a corporate server.

Brandon: I'm not sure how you performed your CODERED logs searches. did you use Unix GREP or Regular expressions? (although my project was written with Windows users without nifty unix tools handy so i had to use REgular expressions)

For those of you that have ideas of improvements, please let me know :-) I'm eager to have them.

/Fredrik

[brandonschnell]

i used a unix grep & "wc -l" to get the number of results that grep found.

[toma42]

Hey now,

How about putting the stuff in CVS so we can see the php code without downloading your .exe?

Thanks,
Tom

[ogge1]

🙂 Good idea.. I actually Stressed out V1.0 without thinging of that. Will do that during the day!

Thanks for the input

/Fredrik