[原创]捕获木马或蠕虫的程序

[watermark]木马和蠕虫的横行一直困扰着我们，本程序试图查找特定木马或蠕虫，以便查杀。本程序适用查找的木马如：http://www.thysea.com/lb/cgi-bin/topic.cgi?forum=1&topic=21947&show=0 首先这个是主程序。

/**
* Created by IntelliJ IDEA.
* User: fengzhizi
* Date: 2006-10-14
* Time: 11:26:00
* To change this template use File | Settings | File Templates.
*/
import java.net.*;
import java.util.*;
import java.io.*;
public class Worm&TrojanCatcher{
public static void main(String[] args)
{
ServerSocket serv = null;
ThreadPool tpool = null;
Socket clnt = null;
String tmp = null;
int port = 0;
if (args.length != 1)
{
System.err.println("usage:java Worm&TrojanCatcher"+" <local_port>");
System.err.println("Example:java Worm&TrojanCatcher"+" 80");
System.exit(1);
}
tmp = args[0];
try
{
port = Integer.parseInt(tmp);
tpool = new ThreadPool(5);
try
{
serv = new ServerSocket(port);
}
catch (IOException e)
{
System.out.println(e);
}
while (true)
{
try
{
clnt = serv.accept();
}
catch (IOException e)
{
System.out.println(e);
}
tpool.add(clnt);
}
}
catch (NumberFormatException nfe)
{
System.err.println("NumberFormatException:"+nfe.getMessage());
}
}
}

复制代码

以下是线程池

class ThreadPool
{
private Vector m_queue = new Vector();
public ThreadPool(int thread_count)
{
WorkerThread wt = null;
int x = 0;
for (x=0;x<thread_count;x++)
{
wt = new WorkerThread(m_queue);
wt.start();
}
}
public void add(Object object)
{
synchronized(m_queue)
{
m_queue.add(object);
}
}
}

复制代码

以下是工作线程

class WorkerThread extends Thread {
Vector m_queue = null;
public WorkerThread (Vector queue)
{
m_queue=queue;
}
public void run()
{
InetSocketAddress sa=null;
InputStreamReader isr = null;
LineNumberReader lnr = null;
OutputStream os = null;
InputStream is = null;
InetAddress ria = null;
boolean iscr = false;
Socket clnt = null;
String send = null;
String tmp = null;
int rp = 0;
int x = 0;
System.out.println("***WorkerThreader started.");
while (true)
{
synchronized (m_queue)
{
if (m_queue.size()>0)
{
clnt =(Socket)m_queue.remove(0);
}
}
if (clnt != null)
{
try
{
System.out.println("***new TCP"+"client connection.");
try
{
is = clnt.getInputStream();
}
catch (IOException e)
{
System.out.println(e);
}
isr = new InputStreamReader(is);
lnr = new LineNumberReader(isr);
x = 0;
iscr = false;
while ((tmp=lnr.readLine()) != null)
{
System.out.println(x++ + ") "+tmp);
if (tmp.length() == 0)
{
break;
}
// XXXX是蠕虫或木马所要连接的网址
if (tmp.indexOf("//XXXXX")>0)
{
iscr = true;
}
}
if (iscr = true)
{
InetSocketAddress rsa =(InetSocketAddress)clnt.getRemoteSocketAddress();
ria = rsa.getAddress();
rp = rsa.getPort();
System.out.println("***"+"Worm&Trojan request"+"detected!!!");
System.out.println("Source"+"Address:"+ria);
System.out.println("Source"+"port:"+rp);
}
else
{
send = "HTTP/1.1"
+"200 OK\r\n\r\n"
+"<HTML><BODY"
+"BGCOLOR=#d0d0d0>"
+" <CENTER>"
+"<FONT FACE=Verdana"
+"SIZE=1 COLOR=#0000AA"
+">..::"
+"Worm&TrojanCatcher ::.."
+""
+"</CENTER></BODY>"
+"</HTML>";
try
{
os = clnt.getOutputStream();
}
catch (IOException e)
{
System.out.println(e);
}
try
{
os.write(send.getBytes());
}
catch(IOException e)
{
System.out.println(e);
}
}
}
catch (Throwable t)
{
System.err.println("Throwable:"+t.getClass().getName()+":"+t.getMessage());
}
try
{
clnt.close();
}
catch (IOException e)
{
System.out.println(e);
}
finally
{
clnt = null;
}
try
{
Thread.sleep(10);
}
catch (InterruptedException ie)
{ }
}
}
}
}

复制代码

通过配置端口和木马或蠕虫访问的网页查找特定的木马或蠕虫，也可以把这些信息也入XML文件，让XML来配置这些信息，这样就不止查找某一个特定的木马或蠕虫了，这就成了一个通用的程序。本程序亦可修改成局域网内查找木马的程序，那样的意义就更大了，因此只在这里抛砖引玉。[/watermark]

starlight 该用户已被删除

沙发

starlight发表于 2006-10-18 21:39 | 只看该作者

[原创]捕获木马或蠕虫的程序

相当不错！
其实一说到java很多人可能第一反应就是JSP，以为java只是在这一方面有所建树而忽略了java本身就是一个完整的编程语言这一事实。所以风之子在此公布他的原创作品想大家展示java在web以外的应用。在用了太多API之后其实如果能够自己写出一个较完整的应用也是相当可贵的，感谢他的能够将自己的原创公布与众，支持原创！

TOP

风灵风之子 该用户已被删除

板凳

风灵风之子发表于 2006-10-19 00:32 | 只看该作者