rid.conf

又一个检测黑客远程禁止服务攻击主机的程序

# Sample config file
start AgentStacheldraht
	send icmp type=0 id=668 data=""
	recv icmp type=0 id=669 data="sicken" nmatch=2
end AgentStacheldraht
start AgentStacheldraht4
	send icmp type=0 id=6268 data=""
	recv icmp type=0 id=669 data="sicken" nmatch=2
end AgentStacheldraht4
start AgentTFN
	send icmp type=0 id=789
	recv icmp type=0 id=123 nmatch=2
end AgentTFN
start AgentTrinoo
	send udp dport=27444 data="png l44adsl"
	recv udp data="PONG" nmatch=1
end AgentTrinoo
start WinTrinoo
	send udp dport=34555 data="png []..Ks l44"
	recv udp sport=35555 data="PONG" nmatch=1
end WinTrinoo
start rootshell
	send tcp dport=1524 data="\nexit;\n"
	recv tcp data="# " nmatch=1
end rootshell
start HandlerTrinoo
       send tcp dport=27665 data="betaalmostdone"
       recv tcp data="trinoo" nmatch=1
end HandlerTrinoo
start HandlerStacheldraht4
       send tcp dport=65512 data="tagada"
       send tcp dport=61111 data="tagada"
       recv tcp sport=65512 data="failed" nmatch=2
       recv tcp sport=61111 data="failed" nmatch=2
end HandlerStacheldraht4
# Work with Stachel V4 too
# The id sent triggers TFN agent SMURF attack but should
# be harmless due to lack of arguments
start HandlerStacheldraht
       send icmp type=0 id=666 data="skillz"
       recv icmp type=0 id=667 data="ficken" nmatch=2
end HandlerStacheldraht
start AgentShaft
       send udp dport=18753 data="alive tijgu hi 5 1918"
       recv udp sport=20433 data="alive" nmatch=2
end AgentShaft