Reason
PHP script part of the source code:
Copy Code code as follows:
$fp = Fsockopen ("udp://$ip", $rand, $errno, $ERRSTR, 5);
if ($fp) {
Fwrite ($fp, $out);
Fclose ($FP);
PHP script in the Fsockopen function, to the external address, through UDP send a large number of packets to attack each other.
Response
You can disable the Fsockopen function by php.ini, and use Windows 2003 security policy to block the local UDP port.
disabling functions
Find Disable_functions and add the name of the function you want to disable, as in the following example:
Passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_ Restore,dl,pfsockopen,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket,fsockopen
After restarting IIS, it takes effect.
Masking UDP ports
Copy the following shaded text to Notepad, save as Banudp.bat or any name, and double-click to run.
REM Add security Policy, name
netsh ipsec static add policy name= my security policy
REM Add IP Filter List
netsh ipsec static add filterlist name= allow List
netsh ipsec static add filterlist name= deny list
REM add filter to IP filter list (allow Internet access)
netsh ipsec static add filter filterlist= allow List srcaddr=me dstaddr=any description=dns access protocol=udp mirrored=yes dstport= 53
REM add filter to IP Filter list (no access to others)
netsh ipsec static add filter filterlist= deny list Srcaddr=any dstaddr=me description= others to me any access protocol=udp Mirrored=yes
REM Add filter action
netsh ipsec static add filteraction name= can be action=permit
netsh ipsec static add filteraction name= cannot be action=block
REM Create a link specify the rules for IPSEC policy, filter list, and filter actions (join rule to my security policy)
netsh ipsec static add rule name= allows rules policy= my security policy filterlist= allow List filteraction= can
netsh ipsec static add rule name= deny rules policy= my security policy filterlist= deny list filteraction= can not
REM activates my security policy
netsh ipsec static set policy name= my security policy assign=y
