root/mwcollectd/mwcollect2/trunk/mwcollectd.conf.dist

# mwcollectd (linux) dist config
# 2005-05-12 Georg Wicherski

# the term default refers to what mwcollect will fall back to, if the value does not exist
# in the config file, not to what the value is set in the dist config

{
        modules
        {
                # the name of a config is completly up to you, however using something
                # related to the module is a good idea as the name may appear in the logs

                # everything such a block must have is the value library specifying the path
                # to the .so file, everything else is module specific stuff

                # to have multiple instances of a module loaded
                # just specify those blocks multiple times
                # but remember to give them different names if you don't want to use the same
                # config

                log-syslog
                {
                        library = "./bin/modules/log-syslog.so";

                        level = "info"; # defaults to critical
                        identity = "mwcollectd"; # defaults to mwcollectd                       
                }

                log-irc-1
                {
                        library = "./bin/modules/log-irc.so";

                        server
                        {
                                host = "irc.freenode.org";      # default "127.0.0.1"
                                port = "6667";          # default "6667"
                                channel = "#mwcollect-demo";    # default "#mwcollect-demo"
                                key = "";       # the channel key, default ""
                                password = "";          # the server password, default ""
                        }

                        admin
                        {
                                # "*" is wildcard as single value, matching
                                # like "fo*ba" not supported!

                                nick = "*";     # default "*"
                                host = "*";     # default "*"
                                user = "*";     # default "*"
                        }

                        nick = "mwcollect-sensor"; # CHANGEME
                }

                fetch-generic
                {
                        library = "./bin/modules/fetch-generic.so";

                        temp-directory = "/tmp/"; # defaults to /tmp/
                        user-agent = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"; # defaults to mwcollect2
                        max-filesize = "10485760"; # max filesize to be downloaded, in bytes
                        redirects = "3"; # limit number of Location: redirects, 0 means none, def: 3
                }

                fetch-tftp
                {
                        library = "./bin/modules/fetch-tftp.so";

                        timeout = "20"; # timeout in s, defaults to 30s
                        block-strict = "0"; # defaults to 0, whether tftp packets have to be sent in valid block order (most bots suck.)
                        retries = "16"; # how often will a packet be retransmited before timeout?
                }
                
                # duh, long lists of bagles :)

                vuln-bagle-1
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "2745"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }

                vuln-bagle-2
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "2556"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }

                vuln-bagle-3
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "8866"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }
                
                vuln-bagle-3
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "2535"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }
                
                vuln-bagle-4
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "4751"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }
                
                vuln-bagle-5
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "6777"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }
                
                vuln-bagle-6
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "11117"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }
                
                vuln-bagle-7
                {
                        library = "./bin/modules/vuln-bagle.so";

                        port = "81"; # port to listen on, default 2745

                        signatures
                        { # this is the hex dump of the auth string before the url, vnames do not matter
                                sign-1 = "43FFFFFF303030010A2891A12BE6602F328F60151A201A"; # thx anonymous
                        }
                }
                
                # end list of bagles

                vuln-rpc-dcom
                {
                        library = "./bin/modules/vuln-win32rpc.so";

                        port = "135"; # defaults to 135
                }

                vuln-rpc-lsass
                {
                        library = "./bin/modules/vuln-win32rpc.so";

                        port = "445"; # defaults to 135
                }
                
                vuln-rpc-defbind # windows binds some rpc stuff to 1025 as the first free default port..
                {
                        library = "./bin/modules/vuln-win32rpc.so";

                        port = "1025"; # defaults to 135
                }               

                vuln-wins
                {
                        library = "./bin/modules/vuln-wins.so";

                        port = "42"; # defaults to 42
                }

                submit-file
                {
                        library = "./bin/modules/submit-file.so";

                        destination = "/var/mwcollect/"; # defaults to /var/mwcollect CHANGEME
                        chown = "nobody:nobody"; # defaults to not performing any chown CHANGEME
                }


                # experimental mysql module provided by anonymous 3rd party
                # BLOCKING!
                # build with `make submit-mysql`
#               submit-mysql
#               {
#                       library = "./bin/modules/submit-mysql.so";
#
#                       host = "localhost"; # which mysql server to connect to, defaults to localhost
#                       user = "mwcollect"; # username for mysql, defaults to mwcollect
#                       password = "mwcollect"; # password for mysql, defaults to mwcollect
#                       db = "mwcollect"; # database to put data into, defaults to mwcollect
#                       port = "3306"; # port to connect to, defaults to 0
#               }

                generic-bot-shellcode-parser
                {
                        library= "./bin/modules/scparse-genbot.so";
                }
        };
        # you can put a semicolon after a block if you like to
        # you can also spam your file with them:
        ;;;
        # however you _must_ put it after a value assignment

        # shell emulation configuration (wow)
        shell-emulation
        {
                tftp # win32 tftp.exe
                {
                        enable = "1"; # defaults to off but is nearly a must for all bot shellcodes
                }

                enable-connectback = "1"; # defaults to off but is needed by most lsass bots
                enable-listenshell = "1"; # defaults to off but is nedded by most lsass bots; can mess with fw
        }


        fetch-multi-dispatch = "0"; # bool whether to dispatch one fetch request to all matching protocol handlers, default off!
        fetch-local = "0"; # bool whether to fetch `local' files (e.g. files within a 192.168.0.0/16 range), default: 0
        filter-unique-interval = "300"; # filter urls to be unique in the last n seconds, set to 0 to disable -- if not unique, file will be discarded, default 300 (5 minutes)

        bind-address = "0.0.0.0"; # address to bind server sockets to, default "0.0.0.0" (binds to all)
        backlog = "16"; # backlog for server sockets, defaults to 16
        data-timeout = "30"; # incoming data timeout in seconds after connections are forcefully closed (defaults to 300, 0 does NOT disable feature)
        max-filedescriptors = "0"; # if you are running this as root, you can increase the number of maximum file descriptors for this process here. this defaults to 0.
}