From ba55c0675df20a89a452162216af4b6a8e06ce5c Mon Sep 17 00:00:00 2001 From: William Heimbigner Date: Tue, 25 Mar 2008 17:05:22 +0000 Subject: Added dnsbl analysis, better sql, better rules, fixed some commands --- config-default/channels.xml | 69 ++++++++++++++++++++++++++++++++------------- config-default/commands.xml | 18 ++++++++---- config-default/dnsbl.xml | 23 +++++++++++++++ config-default/users.xml | 49 +++++++++++++++++++------------- modules/classes.pl | 11 +++++++- modules/inspect.pl | 9 ++++-- modules/mysql.pl | 23 +++++++++++---- modules/xml.pl | 1 + 8 files changed, 151 insertions(+), 52 deletions(-) create mode 100644 config-default/dnsbl.xml diff --git a/config-default/channels.xml b/config-default/channels.xml index a91e4af..114c673 100644 --- a/config-default/channels.xml +++ b/config-default/channels.xml @@ -54,7 +54,9 @@ - + + + njan @@ -67,6 +69,7 @@ Cpudan80 AndrewB pinpoint + tomaw @@ -83,30 +86,35 @@ tomaw Dave2 ST47 - Dave2 tomaw njan - Dave2 AndrewB AndrewB denny - Dave2 + Gary + JonathanD + ZoFreX + DLange + vorian + PriceChild tomaw ompaul kloeri PhilKC - Dave2 + tomaw #freenode-adb - + - - + + + NeddySeagoon + @@ -127,12 +135,17 @@ - + + PriceChild + ST47 + tomaw + Mbimmler + Martinp23 Majorly Fabexplosive @@ -161,8 +174,11 @@ Cbrown1023 - + + ##wikimedia-ops + + Cbrown1023 @@ -171,6 +187,11 @@ TheLetterE Golbez Mbimmler + AndrewB + wimt + Snowolf + Mitchell + werdan7 Karlprof Martinp23 Pilotguy @@ -192,10 +213,10 @@ mike42 Pilotguy kloeri + Cometstyles #wikimedia-ops - ##wikimedia-ops @@ -207,7 +228,7 @@ - + Cometstyles Majorly Worby @@ -218,12 +239,16 @@ werdan7 Animum Deskana + Martinp23 + Snowolf + Mitchell AppleBoy Soms Martinp23 Cbrown1023 TheLetterE KFP + Snowolf #wikimedia-ops @@ -236,6 +261,8 @@ werdan7 GDonato TheLetterE + Cometstyles + Thehelpfulone #wikimedia-ops @@ -243,6 +270,7 @@ + @@ -254,6 +282,8 @@ + Mitchell + Snowolf Eagle-101 Mbimmler Pilotguy @@ -279,26 +309,26 @@ + 5:3 ^requested by ChanServ blah .* - ^DCC SEND |\bDCC SEND "?[A-Za-z0-9]+"? \d+ \d+ \d+ + ^DCC (SEND|S?CHAT) |\bDCC (SEND|S?CHAT) "?[A-Za-z0-9]+"? \d+ \d+ \d+ DCC SEND DCC SEND \bDCC SEND ^... DDOS COUNTDOWN.* - dnsbl.dronebl.org - rbl.efnet.org + rbl.efnetrbl.org ([^ ]{4,} +)\1{5,} goatse\.cz - 3:20 + 5:20 ^startkeylogger$|^stopkeylogger$ \bstartkeylogger\b|\bstopkeylogger\b http://\S+\.on\.nimp\.org contentisuseless + cafe.* lilo.* tell.* RV i=magical - 5:3 - 5:3 + 4:4 150:20 .* RED ARMY OF LOL @@ -307,10 +337,11 @@ AfterDeath ST47 - troubled alindeman seanw dave2 + RichiH + troubled ##asb-nexus diff --git a/config-default/commands.xml b/config-default/commands.xml index 5a4341c..3595281 100644 --- a/config-default/commands.xml +++ b/config-default/commands.xml @@ -1,4 +1,9 @@ + + privmsg($event->{to}->[0], "source is at http://svn.linuxrulz.org/repos/antispammeta"); + ]]> + {DBH}; @@ -40,7 +45,7 @@ {person}->{$nick}->{flags})) { $conn->privmsg($event->{to}->[0], "Flags for $nick: $::users->{person}->{$nick}->{flags}"); } else { @@ -124,7 +129,7 @@ $conn->privmsg($event->{to}->[0], "$nick removed from targets for $chan"); ]]> - + - + privmsg($event->{to}->[0], "$nick added to $level risk hilights for $chan"); ]]> - + privmsg($event->{to}->[0], $x . " exempted"); ]]> - + {to}->[0]; $tgt = $1 if (defined($1)); - my $msg = $2; + my $msg = $1; + $msg = $2 if defined($2); my $hilite=ASM::Util->commaAndify(ASM::Util->getAlert($tgt, 'opalert', 'hilights')); $conn->privmsg($_, "[$tgt] - $event->{nick} wants op attention ($msg) $hilite") foreach ASM::Util->getAlert($tgt, 'opalert', 'msgs'); ]]> diff --git a/config-default/dnsbl.xml b/config-default/dnsbl.xml new file mode 100644 index 0000000..f4f51a3 --- /dev/null +++ b/config-default/dnsbl.xml @@ -0,0 +1,23 @@ + + + Open proxy + Trojan spreader + Trojan infected client + TOR exit server + Drones / Flooding + + + Testing data + Sample + IRC Drone + Tor + Bottler + Unknown spambot or drone + DDOS drone + SOCKS proxy + HTTP proxy + ProxyChain + MediaDefender crap + Unknown + + diff --git a/config-default/users.xml b/config-default/users.xml index f0fc3a6..580d1a6 100644 --- a/config-default/users.xml +++ b/config-default/users.xml @@ -1,22 +1,33 @@ - - - + + + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/modules/classes.pl b/modules/classes.pl index 775eae6..f2372f2 100644 --- a/modules/classes.pl +++ b/modules/classes.pl @@ -79,7 +79,16 @@ sub dnsbl if (defined $rev) { my $iaddr = gethostbyname( "$rev$chk->{content}" ); my @dnsbl = unpack( 'C4', $iaddr ) if defined $iaddr; - return 1 if (@dnsbl); + my $strip; + if (@dnsbl) { + $strip = sprintf("%s.%s.%s.%s", @dnsbl); + print "found host (rev $rev) in $chk->{content} - $strip\n"; + } + if ((@dnsbl) && (defined($::dnsbl->{query}->{$chk->{content}}->{response}->{$strip}))) { + $::lastlookup=$::dnsbl->{query}->{$chk->{content}}->{response}->{$strip}->{content}; + # lol really icky hax + return 1; + } } return 0; } diff --git a/modules/inspect.pl b/modules/inspect.pl index faa4dd7..c86fd25 100644 --- a/modules/inspect.pl +++ b/modules/inspect.pl @@ -4,6 +4,7 @@ use strict; #use Data::Dumper; #use List::Util qw(first); +use String::Interpolate qw(interpolate); %::ignored = (); sub new @@ -45,11 +46,15 @@ sub inspect { } } delete $dct{$_} foreach @override; + my $mylastreason = $::lastreason; + my $evcontent = $event->{args}->[0]; + my $evhost = $event->{host}; foreach $chan (@{$event->{to}}) { foreach $id ( keys %dct ) { - $::db->record($chan, $event->{nick}, $event->{user}, $event->{host}, $::sn{lc $event->{nick}}->{gecos}, $dct{$id}{risk}, $id, $dct{$id}{reason}); + my $nicereason = interpolate($dct{$id}{reason}); + $::db->record($chan, $event->{nick}, $event->{user}, $event->{host}, $::sn{lc $event->{nick}}->{gecos}, $dct{$id}{risk}, $id, $nicereason); $txtz = "\x03" . $::RCOLOR{$::RISKS{$dct{$id}{risk}}} . "\u$dct{$id}{risk}\x03 risk threat [\x02$chan\x02]: ". - "\x02$event->{nick}\x02 - $dct{$id}{reason}; ping "; + "\x02$event->{nick}\x02 - ${nicereason}; ping "; $txtz = $txtz . ASM::Util->commaAndify(ASM::Util->getAlert(lc $chan, $dct{$id}{risk}, 'hilights')) if (ASM::Util->getAlert(lc $chan, $dct{$id}{risk}, 'hilights')); if (ASM::Util->cs(lc $chan)->{op} ne 'no') { if ($event->{type} eq 'topic') { #restore old topic diff --git a/modules/mysql.pl b/modules/mysql.pl index 22369e1..f0b7845 100644 --- a/modules/mysql.pl +++ b/modules/mysql.pl @@ -76,23 +76,36 @@ sub logg $string = $string . 'channel, '; } $string = $string . 'nick, user, host, geco'; - if ($table ne 'join') { + if (($table ne 'join') && ($table ne 'kick')) { $string = $string . ', content1'; } - if (($table eq 'kick') || ($table eq 'mode')) { + if ($table eq 'mode') { $string = $string . ', content2'; } + if ($table eq 'kick') { + $string = $string . ', victim_nick, victim_user, victim_host, victim_geco, content1'; + } $string = $string . ') VALUES ('; - if (($table ne 'nick') && ($table ne 'quit')) { + if (($table ne 'nick') && ($table ne 'quit') && ($table ne 'kick')) { $string = $string . $dbh->quote($event->{to}->[0]) . ", "; } + if ($table eq 'kick') { + $string = $string . $dbh->quote($event->{args}->[0]) . ", "; + } my $geco = $::sn{lc $event->{nick}}->{gecos}; $string = $string . $dbh->quote($event->{nick}) . ", " . $dbh->quote($event->{user}) . ", " . $dbh->quote($event->{host}) . ", " . $dbh->quote($geco); - if ($table ne 'join') { + if (($table ne 'join') && ($table ne 'kick')) { $string = $string. ', ' . $dbh->quote($event->{args}->[0]); } - if (($table eq 'kick') || ($table eq 'mode')) { + if ($table eq 'kick') { + $string = $string . ', ' . $dbh->quote($event->{to}->[0]); + $string = $string . ', ' . $dbh->quote($::sn{lc $event->{to}->[0]}->{user}); + $string = $string . ', ' . $dbh->quote($::sn{lc $event->{to}->[0]}->{host}); + $string = $string . ', ' . $dbh->quote($::sn{lc $event->{to}->[0]}->{gecos}); + $string = $string . ', ' . $dbh->quote($event->{args}->[1]); + } + if ($table eq 'mode') { $string = $string . ', ' . $dbh->quote($event->{args}->[1]); } $string = $string . ');'; diff --git a/modules/xml.pl b/modules/xml.pl index 1978af9..ce7712d 100644 --- a/modules/xml.pl +++ b/modules/xml.pl @@ -17,6 +17,7 @@ sub readXML { $::users = $::xs1->XMLin( "$p/users.xml", ForceArray => 'person'); $::commands = $::xs1->XMLin( "$p/commands.xml", ForceArray => [qw/command/]); $::mysql = $::xs1->XMLin( "$p/mysql.xml", ForceArray => []); + $::dnsbl = $::xs1->XMLin( "$p/dnsbl.xml", ForceArray => []); } sub writeXML { -- cgit v1.2.3