novi upstream verzije 2.8.3

[ossec-hids.git] / active-response / win / route-null.cmd

diff --git a/active-response/win/route-null.cmd b/active-response/win/route-null.cmd
index 3960e31..6838c7a 100644 (file)
--- a/active-response/win/route-null.cmd
+++ b/active-response/win/route-null.cmd
@@ -1,31 +1,38 @@
-:: Simple script to null route an ip address.\r
-@ECHO OFF\r
-ECHO.\r
-\r
-\r
-:: Logging it all\r
-FOR /F "TOKENS=1* DELIMS= " %%A IN ('DATE/T') DO SET DATE=%%B\r
-FOR /F "TOKENS=1* DELIMS= " %%A IN ('TIME/T') DO SET TIME=%%A\r
-ECHO %DATE% %TIME% %0 %1 %2 %3 %4 %5 %6 %7 %8 %9 >> active-response/active-responses.log\r
-\r
-\r
-IF "%1"=="add" GOTO ADD\r
-IF "%1"=="delete" GOTO DEL\r
-:ERROR\r
-\r
-ECHO "Invalid argument. %1"\r
-GOTO Exit;\r
-\r
-\r
-:: Adding to the blocked.\r
-\r
-:ADD\r
-:: Extracts last ip address from ipconfig.\r
-FOR /F "TOKENS=2* DELIMS=:" %%A IN ('IPCONFIG ^| FIND "IP"') DO FOR %%B IN (%%A) DO SET IPADDR=%%B\r
-route add %3  mask 255.255.255.255 %IPADDR%\r
-GOTO Exit;\r
-\r
-:DEL\r
-route delete %3\r
-\r
-:Exit\r
+:: Script to null route an ip address.
+@ECHO OFF
+ECHO.
+
+:: Set some variables
+FOR /F "TOKENS=1* DELIMS= " %%A IN ('DATE/T') DO SET DAT=%%A %%B
+FOR /F "TOKENS=1-3 DELIMS=:" %%A IN ("%TIME%") DO SET TIM=%%A:%%B:%%C
+
+:: Check for required arguments
+IF /I "%1"=="" GOTO ERROR
+IF /I "%1"=="add" GOTO ADD
+IF /I "%1"=="delete" GOTO DEL
+
+:ERROR
+ECHO Invalid argument(s).
+ECHO Usage: route-null.cmd ^(ADD^|DELETE^) IPv4 Address 
+ECHO Example: route-null.cmd ADD 1.2.3.4
+EXIT /B 1
+
+
+:: Adding IP to be null-routed. IP will be routed to local machine IP
+
+:ADD
+:: Check for a valid IP
+ECHO "%2" | %WINDIR%\system32\findstr.exe /R "[0-2][0-9]*[0-9]*\.[0-2][0-9]*[0-9]*\.[0-2][0-9]*[0-9]*\.[0-2][0-9]*[0-9]*" >nul || ECHO Invalid IP && EXIT /B 2 
+:: Extracts last ip address from ipconfig and routes to this address. Windows will not allow routing to 127.0.0.1
+FOR /F "TOKENS=2* DELIMS=:" %%A IN ('%WINDIR%\system32\ipconfig.exe ^| %WINDIR%\system32\findstr.exe /R /C:"IPv*4* Address"') DO FOR %%B IN (%%A) DO SET IPADDR=%%B
+%WINDIR%\system32\route.exe ADD %2 MASK 255.255.255.255 %IPADDR%
+:: Log it
+ECHO %DAT%%TIM% %~dp0%0 %1 - %2 >> "%OSSECPATH%active-response\active-responses.log"
+GOTO EXIT
+
+:DEL
+ECHO "%2" | %WINDIR%\system32\findstr.exe /R "[0-2][0-9]*[0-9]*\.[0-2][0-9]*[0-9]*\.[0-2][0-9]*[0-9]*\.[0-2][0-9]*[0-9]*" >nul || ECHO Invalid IP && EXIT /B 2
+%WINDIR%\system32\route.exe DELETE %2
+ECHO %DAT%%TIM% %~dp0%0 %1 - %2 >> "%OSSECPATH%active-response\active-responses.log"
+
+:EXIT /B 0: