豪哥全防

浮沉白里 · 发表于 2026-6-11 16:15:21

定向靶场防，ddos攻击，电脑运行，可能有bug，大佬帮看看，指点指点

#!/bin/bash
#===================================================
# 脚本名称: 定向靶场全防.sh (完整增强版)
# 功能描述: 针对指定靶场服务的精准 DDoS 动态防御
# 适用场景: CTF/演练靶场，Web/数据库/自定义服务
# 用法: sudo bash 定向靶场全防.sh
# 安装后自动启用，再次运行可修改配置或卸载
#===================================================
set -o pipefail
# ---------- 公共变量 ----------
SCRIPT_NAME="定向靶场全防"
SERVICE_NAME="target-defender"
BLOCKER_SCRIPT="/usr/local/sbin/target_blocker.sh"
WHITELIST_FILE="/root/target_whitelist.txt"
LOGFILE="/var/log/target_ddos_blocker.log"
LOGROTATE_CONF="/etc/logrotate.d/target-defender"
SERVICE_FILE="/etc/systemd/system/${SERVICE_NAME}.service"
# ---------- 颜色输出 ----------
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
# ---------- 检查 root ----------
if [[ $EUID -ne 0 ]]; then
echo -e "${RED}请使用 root 或 sudo 权限执行。${NC}"
exit 1
fi
# ---------- 函数：安装/更新 ----------
install_defender() {
echo -e "${GREEN}=========================================${NC}"
echo -e "${GREEN} 定向靶场全防 - 安装/更新向导${NC}"
echo -e "${GREEN}=========================================${NC}"
# 检测旧版，询问卸载
if systemctl is-active --quiet $SERVICE_NAME 2>/dev/null; then
echo -e "${YELLOW}检测到已有服务在运行。${NC}"
read -p "是否覆盖重新安装？[Y/n]: " REINSTALL
if [[ "$REINSTALL" =~ ^[Nn]$ ]]; then
echo "已取消。"
exit 0
fi
systemctl stop $SERVICE_NAME
systemctl disable $SERVICE_NAME
rm -f $SERVICE_FILE
crontab -l 2>/dev/null | grep -v "target_blocker.sh" | crontab - 2>/dev/null || true
fi
# 收集配置
echo ""
echo -e "${YELLOW}请配置防御参数（直接回车使用默认值）${NC}"
read -p "保护的目标 IP [默认 0.0.0.0]: " TARGET_IP
TARGET_IP=${TARGET_IP:-0.0.0.0}
read -p "保护的端口（逗号分隔，如 80,443,8080）[默认 80,443]: " TARGET_PORTS
TARGET_PORTS=${TARGET_PORTS:-80,443}
read -p "协议 (tcp/udp) [默认 tcp]: " PROTO
PROTO=${PROTO:-tcp}
read -p "单IP最大并发连接数阈值 [默认 50]: " CONN_THRESHOLD
CONN_THRESHOLD=${CONN_THRESHOLD:-50}
read -p "封禁时长（秒）[默认 3600]: " BAN_TIMEOUT
BAN_TIMEOUT=${BAN_TIMEOUT:-3600}
read -p "检测间隔（秒）[默认 10]: " CHECK_INTERVAL
CHECK_INTERVAL=${CHECK_INTERVAL:-10}
echo ""
echo -e "${GREEN}最终配置:${NC}"
echo " 目标: $TARGET_IP:$TARGET_PORTS/$PROTO"
echo " 阈值: $CONN_THRESHOLD"
echo " 封禁: ${BAN_TIMEOUT}s"
echo " 间隔: ${CHECK_INTERVAL}s"
read -p "确认开始安装？[Y/n]: " CONFIRM
if [[ "$CONFIRM" =~ ^[Nn]$ ]]; then
echo "已取消。"
exit 0
fi
# 安装依赖
echo -e "${GREEN}[*] 安装依赖...${NC}"
if command -v apt &>/dev/null; then
apt update -qq
apt install -y iptables ipset net-tools logrotate 2>/dev/null || true
elif command -v yum &>/dev/null; then
yum install -y iptables-services ipset net-tools logrotate 2>/dev/null || true
fi
modprobe ip_set 2>/dev/null || true
modprobe ip_set_hash_net 2>/dev/null || true
modprobe xt_set 2>/dev/null || true
# 初始化 ipset 黑名单
IPSET_NAME="target_blacklist"
ipset destroy $IPSET_NAME 2>/dev/null || true
ipset create $IPSET_NAME hash:net maxelem 100000 timeout $BAN_TIMEOUT
# 构建端口变量
IFS=',' read -ra PORT_ARRAY <<< "$TARGET_PORTS"
MULTIPORT=$(IFS=,; echo "${PORT_ARRAY[*]}")
# 写入 iptables 规则（幂等）
echo -e "${GREEN}[*] 配置 iptables 规则...${NC}"
# 基础允许
iptables -C INPUT -i lo -j ACCEPT 2>/dev/null || iptables -I INPUT -i lo -j ACCEPT
iptables -C INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || \
iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# 删除旧的黑名单规则（如果存在）
iptables -D INPUT -d $TARGET_IP -p $PROTO -m multiport --dports $MULTIPORT \
-m set --match-set $IPSET_NAME src -j DROP 2>/dev/null || true
# 添加新的黑名单匹配规则
iptables -I INPUT -d $TARGET_IP -p $PROTO -m multiport --dports $MULTIPORT \
-m set --match-set $IPSET_NAME src -j DROP
# 创建白名单模板
if [[ ! -f "$WHITELIST_FILE" ]]; then
echo "127.0.0.1" > $WHITELIST_FILE
echo "# 白名单 IP 或 CIDR，每行一个" >> $WHITELIST_FILE
echo "# 例: 192.168.1.100" >> $WHITELIST_FILE
echo "# 例: 10.0.0.0/8" >> $WHITELIST_FILE
echo -e "${YELLOW}已创建白名单文件: $WHITELIST_FILE，请立即添加你的管理IP！${NC}"
fi
# 生成动态封禁脚本
echo -e "${GREEN}[*] 生成封禁核心脚本...${NC}"
cat > $BLOCKER_SCRIPT << BLOCKER_EOF
#!/bin/bash
# 定向靶场动态封禁守护脚本
TARGET_IP="$TARGET_IP"
TARGET_PORTS=(${PORT_ARRAY[@]})
PROTO="$PROTO"
THRESHOLD=$CONN_THRESHOLD
IPSET_NAME="$IPSET_NAME"
WHITELIST_FILE="$WHITELIST_FILE"
LOGFILE="$LOGFILE"
BAN_TIMEOUT=$BAN_TIMEOUT
# 加载白名单
declare -a whitelist
if [[ -f "\$WHITELIST_FILE" ]]; then
mapfile -t whitelist < <(grep -vE '^\\s*#|^\\s*$' "\$WHITELIST_FILE")
fi
# 纯 bash 子网匹配（支持 x.x.x.x/xx）
match_cidr() {
local ip=\$1 cidr=\$2
local ip_hex cidr_ip cidr_mask
IFS='/' read -r cidr_ip cidr_mask <<< "\$cidr"
[[ -z "\$cidr_mask" ]] && cidr_mask=32
# 将 IP 转为整数
ip_to_int() {
local IFS=.
read -r a b c d <<< "\$1"
echo \$(( (a<<24) + (b<<16) + (c<<8) + d ))
}
ip_int=\$(ip_to_int "\$ip")
net_int=\$(ip_to_int "\$cidr_ip")
mask=\$(( 0xFFFFFFFF << (32 - cidr_mask) & 0xFFFFFFFF ))
(( (ip_int & mask) == (net_int & mask) ))
}
is_whitelisted() {
local ip=\$1 entry
for entry in "\${whitelist[@]}"; do
[[ -z "\$entry" ]] && continue
if [[ "\$entry" == "\$ip" ]]; then
return 0
elif [[ "\$entry" =~ / ]]; then
if match_cidr "\$ip" "\$entry"; then
return 0
fi
fi
done
return 1
}
# 检测逻辑
check_and_block() {
local filter port
for port in "\${TARGET_PORTS[@]}"; do
if [[ "\$PROTO" == "tcp" ]]; then
ss -nt state established "sport = :\$port or dport = :\$port" 2>/dev/null | \
awk '{print \$5}' | cut -d: -f1 | grep -v '^*' | sort | uniq -c
else
ss -nu "sport = :\$port or dport = :\$port" 2>/dev/null | \
awk '{print \$5}' | cut -d: -f1 | grep -v '^*' | sort | uniq -c
fi
done | while read count ip; do
[[ -z "\$ip" ]] && continue
if is_whitelisted "\$ip"; then
continue
fi
if [[ \$count -ge \$THRESHOLD ]]; then
ipset add \$IPSET_NAME \$ip timeout \$BAN_TIMEOUT 2>/dev/null
echo "\$(date '+%F %T') [BLOCK] \$ip conns:\$count -> banned \${BAN_TIMEOUT}s" >> \$LOGFILE
fi
done
}
# 主循环
while true; do
check_and_block
sleep $CHECK_INTERVAL
done
BLOCKER_EOF
chmod +x $BLOCKER_SCRIPT
# 日志轮转
cat > $LOGROTATE_CONF << EOF
$LOGFILE {
daily
rotate 7
missingok
notifempty
compress
delaycompress
copytruncate
}
EOF
# 创建 systemd 服务
echo -e "${GREEN}[*] 创建系统服务...${NC}"
cat > $SERVICE_FILE << EOF
[Unit]
Description=Target DDoS Defender
After=network.target
[Service]
Type=simple
ExecStart=$BLOCKER_SCRIPT
Restart=always
RestartSec=5
User=root
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable --now $SERVICE_NAME
echo ""
echo -e "${GREEN}=========================================${NC}"
echo -e "${GREEN} 定向靶场全防安装完成！${NC}"
echo -e "${GREEN}=========================================${NC}"
echo "服务状态: systemctl status $SERVICE_NAME"
echo "白名单文件: $WHITELIST_FILE (请立即添加你的IP！)"
echo "攻击日志: $LOGFILE"
echo "手动测试封禁: /usr/local/sbin/target_blocker.sh (会启动循环，按 Ctrl+C 停止)"
echo ""
}
# ---------- 函数：卸载 ----------
uninstall_defender() {
echo -e "${YELLOW}正在卸载定向靶场全防...${NC}"
systemctl stop $SERVICE_NAME 2>/dev/null || true
systemctl disable $SERVICE_NAME 2>/dev/null || true
rm -f $SERVICE_FILE
rm -f $BLOCKER_SCRIPT
rm -f $LOGROTATE_CONF
# 清除 iptables 相关规则
IPSET_NAME="target_blacklist"
iptables -D INPUT -m set --match-set $IPSET_NAME src -j DROP 2>/dev/null || true
ipset destroy $IPSET_NAME 2>/dev/null || true
# 删除 cron 残留
crontab -l 2>/dev/null | grep -v "target_blocker.sh" | crontab - 2>/dev/null || true
systemctl daemon-reload
echo -e "${GREEN}卸载完成。${NC}"
}
# ---------- 主菜单 ----------
echo -e "${GREEN}=========================================${NC}"
echo -e "${GREEN} 定向靶场全防管理脚本${NC}"
echo -e "${GREEN}=========================================${NC}"
# 检测当前是否已安装
if systemctl list-unit-files | grep -q "^${SERVICE_NAME}.service"; then
echo -e "${GREEN}当前状态: 已安装${NC}"
systemctl is-active --quiet $SERVICE_NAME && echo -e "服务: ${GREEN}运行中${NC}" || echo -e "服务: ${RED}未运行${NC}"
else
echo -e "${YELLOW}当前状态: 未安装${NC}"
fi
echo ""
echo "请选择操作:"
echo " 1) 安装 / 更新配置"
echo " 2) 卸载"
echo " 3) 查看实时日志"
echo " 4) 查看当前黑名单"
echo " 0) 退出"
read -p "输入序号: " CHOICE
case $CHOICE in
1) install_defender ;;
2) uninstall_defender ;;
3) tail -f $LOGFILE 2>/dev/null || echo "日志文件不存在";;
4) ipset list target_blacklist 2>/dev/null || echo "黑名单未创建";;
0) exit 0 ;;
*) echo "无效选择"; exit 1 ;;
esac

复制代码

director_mark · 发表于 2026-6-11 16:42:08

看看

GoldApple1939 · 发表于 2026-6-11 16:49:25

感谢分享

超帅内向小雪生 · 发表于 2026-6-11 20:51:48

看看

豪哥全防

发表回复

浏览过的版块

考神

MT论坛新人

MT论坛最佳新人

MT论坛帅哥