antispam

<?php

print "Executing tcpdump\n";
$pid = exec('/usr/sbin/tcpdump -e -n -c 3000 -i eth1 \'(tcp dst port 25 or tcp src port 25) and tcp[tcpflags] & tcp-syn != 0\' 2>/dev/null > dump.txt & echo $!;');

if(empty($pid)) {
    print "Detected empty pid [$pid]\n";
    exit;
}

print "Sleeping\n";
sleep(12);
print "Killing tcpdump\n";
exec('kill -s INT ' . $pid);

$lines = explode("\n", file_get_contents('dump.txt'));
$ips = array();

foreach($lines as $line) {
    $line = trim($line);
    $parts = explode(' ', $line);

    if(count($parts) >= 12) {
        $ip1 = $parts[9];
        $ip2 = str_replace(':', '', $parts[11]);

        if(strlen($ip1) > 5 && strlen($ip2) > 5) {
            $ip1_actual = substr($ip1, 0, strrpos($ip1, '.'));
            $ip2_actual = substr($ip2, 0, strrpos($ip2, '.'));
            $ip1_partial = substr($ip1_actual, 0, strrpos($ip1_actual, '.')); //192.168.0.1 => 192.168.0
            $ip1_partial = substr($ip1_partial, 0, strrpos($ip1_partial, '.')); //192.168.0 => 192.168
            $ip2_partial = substr($ip2_actual, 0, strrpos($ip2_actual, '.')); //192.168.0.1 => 192.168.0
            $ip2_partial = substr($ip2_partial, 0, strrpos($ip2_partial, '.')); //192.168.0 => 192.168

            if(substr($ip1, -3) != '.25') {
                if(!isset($ips[$ip1_actual])) {
                    $ips[$ip1_actual] = array();
                }

                $ips[$ip1_actual][] = $ip2_partial;
            }

            if(substr($ip2, -3) != '.25') {
                if(!isset($ips[$ip2_actual])) {
                    $ips[$ip2_actual] = array();
                }

                $ips[$ip2_actual][] = $ip1_partial;
            }
        }
    }
}

mysql_connect('localhost', 'whmcs', 'password');
mysql_select_db('whmcs');
mysql_query("DELETE FROM antispam_hits WHERE time < DATE_SUB(NOW(), INTERVAL 3 HOUR)");

foreach($ips as $ip => $describe) {
    foreach($describe as $target) {
        $safe_source = mysql_real_escape_string($ip);
        $safe_target = mysql_real_escape_string($target);

        $result = mysql_query("SELECT user_id FROM yourvmlist WHERE ip = '$safe_source'");
        if($row = mysql_fetch_array($result)) {
            $user_id = $row[0];
            mysql_query("INSERT INTO antispam_hits (source_ip, target_ip) VALUES ('$safe_source', '$safe_target')");
        }
    }
}

$result = mysql_query("SELECT source_ip, COUNT(id), COUNT(DISTINCT target_ip) FROM antispam_hits WHERE time > DATE_SUB(NOW(), INTERVAL 25 MINUTE) GROUP BY source_ip");

while($row = mysql_fetch_array($result)) {
    $source_ip = $row[0];
    $count_all = $row[1];
    $count_unique = $row[2];

    if($count_all >= 18 && $count_unique >= 2) {
        exec('iptables -A FORWARD -p tcp --dport 25 -s ' . escapeshellarg($source_ip) . ' -j DROP');
        exec('iptables -A FORWARD -p tcp --sport 25 -d ' . escapeshellarg($source_ip) . ' -j DROP'); //for GRE tunnel and shit
        mail('youremail@example.com', 'blocked a guy', "blocked this guy -- {$source_ip}");
    }
}

?>