The fsockopen function in the php script sends a large number of data packets to external addresses through UDP.
Php script source code:
The code is as follows:
$ Fp = fsockopen ("udp: // $ ip", $ rand, $ errno, $ errstr, 5 );
If ($ fp ){
Fwrite ($ fp, $ out );
Fclose ($ fp );
The fsockopen function in the php script sends a large number of packets to the external address through UDP to attack the other party.
Response
You can use php. ini to disable the fsockopen function and use the security policy of Windows 2003 to shield the UDP port of the local machine.
Disable functions
Find disable_functions and add the function name to be disabled, as shown in the following example:
Passthru, exec, system, chroot, scandir, chgrp, chown, shell_exec, proc_open, proc_get_status, ini_alter, ini_alter, begin, dl, pfsockopen, openlog, syslog, readlink, symlink, login, stream_socket_server, fsocket, fsockopen
It takes effect after you restart IIS.
Shield UDP ports
Copy the following colored text to notepad, save it as banudp. bat or any name, and double-click it to run it.
Add Security Policy, name
Netsh ipsec static add policy name = my security policy
Add IP filter list by REM
Netsh ipsec static add filterlist name = allowed List
Netsh ipsec static add filterlist name = Reject List
Add the REM filter to the IP filter list (allow Internet access)
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = any description = dns access protocol = udp mirrored = yes dstport = 53
Add the REM filter to the IP filter list (not accessible to others)
Netsh ipsec static add filter filterlist = reject list srcaddr = any dstaddr = me description = anyone else sends me any access to protocol = udp mirrored = yes
REM add filter operation
Netsh ipsec static add filteraction name = yes action = permit
Netsh ipsec static add filteraction name = no action = block
REM creates a link to specify the IPSec policy, filter list, and filter operation rules (add rules to my security policy)
Netsh ipsec static add rule name = allow rule policy = my security policy filterlist = allow list filteraction = yes
Netsh ipsec static add rule name = deny rule policy = my security policy filterlist = deny list filteraction = no
REM activates my security policy
Netsh ipsec static set policy name = my security policy assign = y
