Stop fsockopen phpddos Solution

Www.2cto.com. In practice, it will bring about some problems, such as the inability to collect data. The official Weibo of the red/Black alliance once discussed this issue. Later, a method to set the process time is not a permanent solution, you also need to find another method.

Previous Article:

Solution to the use of the fsockopen function by PHPDDOS
Defense from PHPDDOS source code
Use IP Security Policy and PHP configuration to perfectly solve PHPDDOS packet sending
Prevent PHPDDOS packets

Thanks:
 
Network Planners
Sreang
 
 
Cause
Php script source code:
 
 
 
$ Fp = fsockopen ("udp: // $ ip", $ rand, $ errno, $ errstr, 5 );
If ($ fp ){
Fwrite ($ fp, $ out );
Fclose ($ fp); The fsockopen function in the php script sends a large number of packets to the external address through UDP to attack the other party.
 
 
 
Response
You can use php. ini to disable the fsockopen function and use the security policy of Windows 2003 to shield the UDP port of the local machine.
 
 
 
Disable Functions
Find disable_functions and add the function name to be disabled, as shown in the following example:
 
 
 
Passthru, exec, system, chroot, scandir, chgrp, chown, shell_exec, proc_open, proc_get_status, ini_alter, ini_alter, begin, dl, pfsockopen, openlog, syslog, readlink, symlink, login, stream_socket_server, fsocket, and fsockopen take effect after IIS is restarted.
 
 
 
Shield UDP ports
Copy the following colored text to notepad, save it as banudp. bat or any name, and double-click it to run it.
 
 
 
Add security policy, name
Netsh ipsec static add policy name = my security policy
 
Add IP Filter list by REM
Netsh ipsec static add filterlist name = allowed list
Netsh ipsec static add filterlist name = reject list
 
Add the REM filter to the IP Filter list (allow Internet access)
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 209.11.240.36 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 209.11.240.35 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 208.98.0.7 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 208.98.0.8 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 4.2.2.1 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 8.8.8.8 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 208.67.222.222 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 66.90.68.16 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 66.90.68.25 description = dns access protocol = udp mirrored = yes dstport = 53
Netsh ipsec static add filter filterlist = allow list srcaddr = me dstaddr = 192.43.244.18 description = dns access protocol = udp mirrored = yes dstport = 123
 
Add the REM filter to the IP Filter list (not accessible to others)
Netsh ipsec static add filter filterlist = reject list srcaddr = me dstaddr = any description = anyone else sends me any access to protocol = udp mirrored = yes
 
REM Add filter operation
Netsh ipsec static add filteraction name = Yes action = permit
Netsh ipsec static add filteraction name = no action = block
 
REM creates a link to specify the IPSec Policy, Filter list, and filter operation rules (add rules to my security policy)
Netsh ipsec static add rule name = allow rule policy = my security policy filterlist = allow list filteraction = Yes
Netsh ipsec static add rule name = deny rule policy = my security policy filterlist = deny list filteraction = No
 
REM activates my security policy
Netsh ipsec static set policy name = my security policy assign = iptables in yLinux environment, which may be used:
 
 
 
Iptables-a input-p tcp-m tcp -- sport 53 -- dport 1024: 65535-m state -- state ESTABLISHED-j ACCEPT
Iptables-a input-p udp-m udp -- sport 53 -- dport 1024: 65535-m state -- state ESTABLISHED-j ACCEPT
Iptables-a output-p tcp-m tcp -- sport 1024: 65535-d 209.11.240.36 -- dport 53-m state -- state NEW, ESTABLISHED-j ACCEPT
Iptables-a output-p udp-m udp -- sport 1024: 65535-d 209.11.240.36 -- dport 53-m state -- state NEW, ESTABLISHED-j ACCEPT
-A output-p udp-j REJECT