项目地址:
GitHub - misaki7in/ipfilter: IP地址白名单过滤器,可配合微步API分析,护网蓝队重保工具
0X01 工具背景
在护网场景中,作为乙方公司的蓝队防守人员,经常会遇到一些客户具有相当多的不可封禁的IP地址,如负载均衡IP,站前代理IP,内网漏扫IP,云防节点IP地址。尽管我们在研判流量威胁时,已经确认了这些IP地址确实存在攻击流量,但是在防火墙封锁恶意IP地址的时候,经常要手工剔除这些IP,十分繁琐。
之前在SXF工作时,经常会看见一线安服工程师因为封锁IP 时未过滤不可封禁IP地址,导致客户的业务中断甚至全部断网【封锁了出口IP】,被记黑事件,甚至辞退
于是针对该场景于2022年8月hvv时开发了IP地址的自动过滤工具,并于2023年3月添加了微步自动化查询IP地址和IP属性【是否具备恶意标签】的功能,方便防守人员快速输出威胁IP话术。
0X02 代码实现
1.微步API接口实现
using Newtonsoft.Json.Linq; using Newtonsoft.Json; using System; using System.Collections.Generic; using System.Linq; using System.Net.Http; using System.Text; using System.Threading.Tasks; namespace IPFilter.Model { public struct Result { public bool success; public string msg; public string data; } public class WBApi { private const string useragent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36"; public HttpClient httpClient; public DateTime CurrentTime; private readonly HttpClientHandler handler; public WBApi() { handler = new HttpClientHandler { AllowAutoRedirect = false, UseCookies = true, }; httpClient = new HttpClient(handler); httpClient.DefaultRequestHeaders.Add("user-agent", useragent); } public Result ip_reputation(string apiKey, string ipString) { var r = new Result(); try { string url = $"https://api.threatbook.cn/v3/scene/ip_reputation?apikey={apiKey}&resource={ipString}&lang=zh"; var response = httpClient.GetAsync(url).Result; response.EnsureSuccessStatusCode(); var data = response.Content.ReadAsStringAsync().Result; var json = JsonConvert.DeserializeObject<JObject>(data); if (json != null && json.ContainsKey("response_code") && json.ContainsKey("verbose_msg")) { r.msg = json["verbose_msg"].ToString(); if (json["response_code"].ToString() == "0") { r.data = data; r.success = true; } } if (string.IsNullOrEmpty(r.msg)) { r.msg = "查询失败"; } } catch (Exception ex) { if (string.IsNullOrEmpty(r.msg)) { r.msg = ex.Message; } } r.msg = "微步查询信誉:" + r.msg; return r; } } }
2.白名单规则匹配实现
using Newtonsoft.Json; using System; using System.Collections.Generic; using System.Text.RegularExpressions; namespace IPFilter.Model { [JsonObject(MemberSerialization.OptIn)] internal class WhiteInfo : UIObject { private bool enable; [JsonProperty] public bool Enable { get => enable; set => this.RaiseAndSetIfChanged(ref enable, value); } private string title; [JsonProperty] public string Title { get => title; set => this.RaiseAndSetIfChanged(ref title, value); } private string whiteContents; [JsonProperty] public string WhiteContents { get => whiteContents; set => this.RaiseAndSetIfChanged(ref whiteContents, value); } public List<uint> IP; public List<(uint, byte)> IPAndMask; public List<(uint, uint)> IPRange; internal bool Has(uint targetip) { if (IP == null) { if (string.IsNullOrEmpty(WhiteContents)) return false; var str = WhiteContents.Trim(); var arr = Regex.Split(str, "\n+"); IP = new List<uint>(); IPAndMask = new List<(uint, byte)>(); IPRange = new List<(uint, uint)>(); for (int i = 0; i < arr.Length; i++) { var ip = arr[i].Trim(); if (string.IsNullOrEmpty(ip)) continue; if (SetWindow.IsIP(ip)) { uint tt = 0; var iparr = Regex.Split(ip, "\\."); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } IP.Add(tt); } else if (SetWindow.IsIPAndMask(ip)) { uint tt = 0; var iparr = Regex.Split(ip, "[\\./]+"); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } byte b = Convert.ToByte(iparr[4]); IPAndMask.Add((tt, b)); } else if (SetWindow.IsIPRange(ip)) { uint tt = 0; var iparr = Regex.Split(ip, "[\\.-]+"); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } uint bb = 0; for (int j = 0; j < 4; j++) { bb = (bb << 8) + Convert.ToUInt32(iparr[j + 4]); } IPRange.Add((tt, bb)); } } } if (IP.Contains(targetip)) return true; for (int i = 0; i < IPAndMask.Count; i++) { var right = 32 - IPAndMask[i].Item2; if ((IPAndMask[i].Item1 >> right) == (targetip >> right)) { return true; } } for (int i = 0; i < IPRange.Count; i++) { if (IPRange[i].Item1 <= targetip && targetip <= IPRange[i].Item2) { return true; } } return false; } } }
3.视图设计
4.视图逻辑
using System; using System.Collections; using System.Collections.Generic; using System.Collections.ObjectModel; using System.Linq; using System.Runtime.InteropServices; using System.Text; using System.Text.RegularExpressions; using System.Threading.Tasks; using System.Windows; using System.Windows.Documents; using System.Windows.Input; using IPFilter.Model; using Newtonsoft.Json; using Newtonsoft.Json.Linq; namespace IPFilter.ViewModel { [JsonObject(MemberSerialization.OptIn)] internal class IPFilterConfig : UIObject { [JsonProperty] public ObservableCollection<WhiteInfo> WhiteInfos { get; set; } private bool enable; [JsonProperty] public bool Enable { get => enable; set => this.RaiseAndSetIfChanged(ref enable, value); } public Window fwindow; internal void Init() { if (WhiteInfos == null) WhiteInfos = new ObservableCollection<WhiteInfo>(); } private ICommand addWhiteInfo; public ICommand AddWhiteInfo => addWhiteInfo ?? (addWhiteInfo = UIObject.Create(() => { var t = new WhiteInfo(); t.Enable = false; t.Title = WhiteInfos.Count.ToString(); var f = new SetWindow(); f.DataContext = t; f.Owner = fwindow; f.ShowDialog(); if (f.Result) { WhiteInfos.Add(t); } })); private ICommand delWhiteInfo; public ICommand DelWhiteInfo => delWhiteInfo ?? (delWhiteInfo = UIObject.Create(() => { var list = new List<WhiteInfo>(); for (int i = 0; i < WhiteInfos.Count; i++) { if (WhiteInfos[i].Enable) { list.Add(WhiteInfos[i]); } } if (list.Count > 0) { var f = new TostWindow(); f.ContentText.Text = "共删除" + list.Count + "项"; f.Owner = fwindow; f.ShowDialog(); if (f.Result) { for (int i = 0; i < list.Count; i++) { WhiteInfos.Remove(list[i]); } } } else { var f = new TostWindow(); f.ContentText.Text = "请勾选要删除的项!"; f.Owner = fwindow; f.ShowDialog(); } })); private ICommand selectAllWhiteInfo; public ICommand SelectAllWhiteInfo => selectAllWhiteInfo ?? (selectAllWhiteInfo = UIObject.Create(() => { for (int i = 0; i < WhiteInfos.Count; i++) { WhiteInfos[i].Enable = true; } })); private ICommand selectReverseWhiteInfo; public ICommand SelectReverseWhiteInfo => selectReverseWhiteInfo ?? (selectReverseWhiteInfo = UIObject.Create(() => { for (int i = 0; i < WhiteInfos.Count; i++) { WhiteInfos[i].Enable = !WhiteInfos[i].Enable; } })); private string inputIp; public string InputIp { get => inputIp; set { if (Equals(inputIp, value)) return; this.RaiseAndSetIfChanged(ref inputIp, value); if (Enable) { MyFilter(); } } } private string whiteIp; public string WhiteIp { get => whiteIp; set => this.RaiseAndSetIfChanged(ref whiteIp, value); } private string noWhiteIp; public string NoWhiteIp { get => noWhiteIp; set => this.RaiseAndSetIfChanged(ref noWhiteIp, value); } private string wbIpInfo; public string WBIpInfo { get => wbIpInfo; set => this.RaiseAndSetIfChanged(ref wbIpInfo, value); } private string evilIPInfos; public string EvilIPInfos { get => evilIPInfos; set => this.RaiseAndSetIfChanged(ref evilIPInfos, value); } private string wbAPPKey; [JsonProperty] public string WBAPPKey { get => wbAPPKey; set => this.RaiseAndSetIfChanged(ref wbAPPKey, value); } private ICommand filterFormWhiteInfos; public ICommand FilterFormWhiteInfos => filterFormWhiteInfos ?? (filterFormWhiteInfos = UIObject.Create(() => { MyFilter(); })); private ICommand showEvilIPInfos; public ICommand ShowEvilIPInfos => showEvilIPInfos ?? (showEvilIPInfos = UIObject.Create(() => { MyShowEvilIPInfos(); })); private WBApi myWBApi; private ICommand wbGetIPInfos; private List<string> WBIplist; public ICommand WBGetIPInfos => wbGetIPInfos ?? (wbGetIPInfos = UIObject.Create(() => { MyWBGetIPInfos(); })); private void MyShowEvilIPInfos() { var list = new List<string>(); for (int i = 0; i < WBIplist.Count; i++) { if (WBIplist[i].IndexOf("恶意") > -1) { list.Add(WBIplist[i].Replace("恶意"," ")); } } EvilIPInfos = string.Join("\r\n", list); } private void MyWBGetIPInfos() { if (string.IsNullOrEmpty(NoWhiteIp)) return; var arr = Regex.Split(NoWhiteIp, "[\r\n]+"); if (WBIplist == null) WBIplist = new List<string>(); else WBIplist.Clear(); WBIpInfo = string.Empty; for (int i = 0; i < arr.Length; i += 100) { var ipstirng = string.Join(",", arr.Skip(i).Take(100).ToList()); if (myWBApi == null) myWBApi = new WBApi(); var r = myWBApi.ip_reputation(wbAPPKey, ipstirng); if (r.success) { ParseWBip_reputation(r.data); } WBIpInfo += r.msg; } WBIpInfo += "\r\n" + string.Join("\r\n", WBIplist); } private void ParseWBip_reputation(string data) { /* { "data": { "159.203.93.255": { "severity": "info", "judgments": [ "IDC" ], "tags_classes": [], "basic": { "carrier": "digitalocean.com", "location": { "country": "United States", "province": "New York", "city": "New York City", "lng": "-74.006", "lat": "40.713", "country_code": "US" } }, "asn": { "rank": 2, "info": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "number": 14061 }, "scene": "", "confidence_level": "low", "is_malicious": false, "update_time": "2016-05-17 20:18:33" } }, "response_code": 0, "verbose_msg": "OK" } */ var json = JObject.Parse(data); var arr = json["data"].Children<JProperty>().Select(x => { var a = x.Name; if (x.Value["is_malicious"].Value<bool>()) { a += " 恶意"; } a += " " + x.Value["basic"]["location"]["country"].ToString() + x.Value["basic"]["location"]["province"].ToString(); return a; }).ToArray(); WBIplist.AddRange(arr); } private void MyFilter() { if (string.IsNullOrEmpty(InputIp)) return; var str = InputIp.Trim(); var arr = Regex.Split(str, "\n+"); var list = new List<string>(); var rlist = new List<string>(); for (int i = 0; i < arr.Length; i++) { var ip = arr[i].Trim(); if (string.IsNullOrEmpty(ip)) continue; if (!SetWindow.IsIP(ip)) { list.Add(ip); } else { rlist.Add(ip); } } if (list.Count > 0) { var f = new TostWindow(); f.ContentText.Text = string.Join("\r\n", list) + "\r\n不是有效IP格式"; var h = f.Height + 20 * list.Count; f.Height = h > 500 ? 500 : h; f.Owner = fwindow; f.ShowDialog(); } var whiteIpList = new List<string>(); for (int k = 0; k < rlist.Count; k++) { var has = false; uint tt = 0; var iparr = Regex.Split(rlist[k], "\\."); for (int j = 0; j < 4; j++) { tt = (tt << 8) + Convert.ToUInt32(iparr[j]); } for (int i = 0; i < WhiteInfos.Count; i++) { if (WhiteInfos[i].Enable && WhiteInfos[i].Has(tt)) { has = true; break; } } if (has) { whiteIpList.Add(rlist[k]); } } var noWhiteIpList = new List<string>(); for (int i = 0; i < arr.Length; i++) { var ip = arr[i].Trim(); if (string.IsNullOrEmpty(ip)) continue; if (!whiteIpList.Contains(ip)) { noWhiteIpList.Add(ip); } } NoWhiteIp = string.Join("\r\n", noWhiteIpList); WhiteIp = string.Join("\r\n", whiteIpList); } } }
0X03 使用方法
1.录入白名单的标题,如XX单位【云防节点】,输入白名单规则,支持三种IP格式的输入。
2.根据需求启用或新建白名单规则,输入对应的IP段,即可实现IP地址的过滤
3.如果你具有微步的APItoken的话【注意:微步API需要申请,并且非企业用户每天可查询额度固定为50,超出则无法查询】,可以输入APItoken,对IP地址进行威胁查询和地址查询,并过滤出恶意标签的IP地址。
获取微步API的方式: 访问链接: ThreatBook 用户登录
注意: 注意确认自己每日的API查询IP的额度,个人用户较少,每天只有50次,建议申请企业用户。
0X04 效果展示
最终结果整理成值守话术,美滋滋~~~~,再也不担心封错IP地址。
0X05 使用注意
1.项目目录文件如下
2.项目文件哈希值如下【注意别被攻击队钓鱼了】
SHA1 的 IPFilter.exe 哈希: ec2302560afdb52b2fe772570df7943808476158 MD5 的 IPFilter.exe 哈希: f102e67b979a4daefd195ca8e859b537
3.考虑到部分小伙伴有特殊的需求,可以在github上留言