
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# These rules were developed based on <http://xforce.iss.net/alerts/
# advise30.php>.
#
# NetSphere is a backdoor that performs the standard backdoor functions,
# including logging keystrokes, setting up a port redirector, capturing 
# screenshots, and several functions to operate with Mirabilis ICQ. 
# NetSphere works on Windows 95, 98, and Windows NT. 
#
# To install, copy this file to /etc/firewall/modules/public/
# block-remote-ports/netsphere. There's no need to execute rc.firewall 
# with the --update-config parameter.
# 
#-----------------------------------------------------------------------
# CHANGES
#-----------------------------------------------------------------------
#
# 2001-02-05  Edwin ten Brink <edwin@privateer.student.utwente.nl>
#             Updated documentation to reflect path changes in v5.1
# 2000-10-17  Jean-Sebastien Morisset <jsmoriss@jsm-mv.dyndns.org>
#             Initial module written for v5.0.
#
#-----------------------------------------------------------------------
# START OF MODULE CODE
#-----------------------------------------------------------------------

echo "Reject $INTOPT $IPADDR -> $ANY NetSphere (logged)"
ipchains -A $OUTCHAIN -j REJECT -p tcp -y -s $IPADDR $UNPRIVPORTS -d $ANY 30100 -l
ipchains -A $OUTCHAIN -j REJECT -p tcp -y -s $IPADDR $UNPRIVPORTS -d $ANY 30102 -l

