in reply to RAdmin detector for Win32
Okay, for what it's worth, here's my version. It does seem to work well enough:
#!C:\perl\bin\perl.exe my $netstat = "C:\\WINNT\\System32\\netstat.exe"; sub clear_screen { my $cmd; if ($^O =~ /win32/i) {$cmd = 'cls'} else {$cmd = 'clear'} system($cmd); } sub ferret { my ($line, @ports) = @_; my ($protocol, $local, $other, $status) = split(/\s+/, $line, 4); my ($local_addr, $local_port) = split(/:/, $local); my ($other_addr, $other_port) = split(/:/, $other); my @scan; foreach (@ports) { if ($local_port =~ /$_/){ push @scan, "$local_port -> $other_addr" if $status =~ /ESTABLISHED/; push @scan, "$local_port listening..." if $status =~ /LISTENING/; push @scan, "$local_port waiting..." if $status =~ /TIME_WAIT/; } } return @scan; } # Scan a range of ports, sub scan_range { my $range = shift; my @ports; foreach (@_) {push @ports, ($_-$range .. $_+$range)}; open(NETSTAT, "$netstat -a -p tcp|") or die "Oops! Cannot run netstat: $! \n"; my $report; while(<NETSTAT>) { next unless $_ =~ /TCP/; $_ =~ s/^\s+//; $report .= join "\n", ferret($_, @ports); } close(NETSTAT); $report = "Ports idle..." unless $report; clear_screen(); return "$report\n"; } # Repeatedlt scan certain ports and their immediate neighbors. my @ports = (4899, 8080); # Win32 RAdmin, XML-RPC. my $range = 5; # How many neigbhbors to either side. my $seconds = 60; # How long to wait between scans. my $minutes = 30; # How long to keep re-scaning. for (1 .. int($minutes / $seconds * 60)) { print "Scan $_ ", scan_range($range, @ports); sleep $seconds; }
|
|---|