Fix - Proteção contra Brute Force para Effect-Web

Olá!

Fiz um fix para a Effect-Web 1.8.5 contra Brute Force.
Não garanto que a Effect-Web tem essa falha, mas é melhorar prevenir do que remediar. Não é atoa que até o MuSite tem esse fix.
Por isso quem utiliza Effect-Web, sugiro que aplique o fix.

Se não sabe o que é Brute Force, confira aqui: [Only registered and activated users can see links. Click Here To Register...]

O que o fix vai fazer é bem simples, ele vai bloquear por 5 minutos o login que um determinado usuário errar a senha por 3 vezes em menos de 5 minutos.

[Only registered and activated users can see links. Click Here To Register...]

Para aplicar o fix, faça os procedimentos abaixo:

1- Baixe a query abaixo e rode em seu SQL, para criar a tabela onde ficará armazenada as tentativas incorretas de login.
Download: [Only registered and activated users can see links. Click Here To Register...]

2- Baixe a query abaixo e rode em seu SQL, para criar a job que irá determinar o tempo de bloqueio.
Download: [Only registered and activated users can see links. Click Here To Register...]

3- Baixe o arquivo abaixo, extraia, copie a página CTM_Ajax.class.php e cole no seu site, em "modules/classes".
Download: [Only registered and activated users can see links. Click Here To Register...]

Pronto!
Site protegido contra Brute Force.
OBS: Querys tiradas do SQL 2005, então não garanto que vai rodar no SQL 2000.

Há outras formas mais fáceis de bloquear isso, mas foi a que "eu" consegui fazer.
Sou bastante noob ainda no ramo de programação. Na verdade, não me considero e nem estudo pra ser um programador.

Abraços!

Captcha mandou lembranças.

[]'s

Citação:

---

Postado originalmente por Renato [Only registered and activated users can see links. Click Here To Register...]

Captcha mandou lembranças.

[]'s

---

Recaptcha é ótimo, alem de um design agradável.

[Only registered and activated users can see links. Click Here To Register...]

Citação:

---

Postado originalmente por Renato [Only registered and activated users can see links. Click Here To Register...]

Captcha mandou lembranças.

[]'s

---

E aí Renato, beleza?
Como eu disse no post, há outras formas mais fáceis de bloquear isso, mas foi a que "eu" consegui fazer.
Sou bastante noob ainda no ramo de programação. Na verdade, não me considero e nem estudo pra ser um programador.

Os mais experientes no ramo, sintam-se a vontade pra fazer o fix de uma forma melhor. Eu mesmo serei grato.

Abraços!

Ter que fazer download de 3 arquivos de texto separados é triste! (sem falar que um deles esta compactado heuehuhe)

SQLQuery23.sql

Código:

---

USE [MuOnline]
GO
/****** Object:  Table [dbo].[BRUTE_FORCE]    Script Date: 10/13/2015 16:38:44 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
CREATE TABLE [dbo].[BRUTE_FORCE](
        [login] [nvarchar](10) COLLATE Latin1_General_CI_AS NULL,
        [tentativas] [int] NOT NULL CONSTRAINT [DF_BRUTE_FORCE_tentativas]  DEFAULT ((0)),
        [block] [int] NOT NULL CONSTRAINT [DF_BRUTE_FORCE_block]  DEFAULT ((0))
) ON [PRIMARY]

---

SQLQuery24.sql

Código:

---

USE [msdb]
GO
/****** Object:  Job [Proteção contra Brute  - EffectWeb]    Script Date: 10/13/2015 16:46:09 ******/
BEGIN TRANSACTION
DECLARE @ReturnCode INT
SELECT @ReturnCode = 0
/****** Object:  JobCategory [[Uncategorized (Local)]]]    Script Date: 10/13/2015 16:46:09 ******/
IF NOT EXISTS (SELECT name FROM msdb.dbo.syscategories WHERE name=N'[Uncategorized (Local)]' AND category_class=1)
BEGIN
EXEC @ReturnCode = msdb.dbo.sp_add_category @class=N'JOB', @type=N'LOCAL', @name=N'[Uncategorized (Local)]'
IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback

END

DECLARE @jobId BINARY(16)
EXEC @ReturnCode =  msdb.dbo.sp_add_job @job_name=N'Proteção contra Brute  - EffectWeb',
                @enabled=1,
                @notify_level_eventlog=0,
                @notify_level_email=0,
                @notify_level_netsend=0,
                @notify_level_page=0,
                @delete_level=0,
                @description=N'No description available.',
                @category_name=N'[Uncategorized (Local)]',
                @owner_login_name=N'sa', @job_id = @jobId OUTPUT
IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
/****** Object:  Step [1]    Script Date: 10/13/2015 16:46:09 ******/
EXEC @ReturnCode = msdb.dbo.sp_add_jobstep @job_id=@jobId, @step_name=N'1',
                @step_id=1,
                @cmdexec_success_code=0,
                @on_success_action=1,
                @on_success_step_id=0,
                @on_fail_action=2,
                @on_fail_step_id=0,
                @retry_attempts=0,
                @retry_interval=0,
                @os_run_priority=0, @subsystem=N'TSQL',
                @command=N'delete from brute_force where tentativas > 2',
                @database_name=N'MuOnline',
                @flags=0
IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
EXEC @ReturnCode = msdb.dbo.sp_update_job @job_id = @jobId, @start_step_id = 1
IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
EXEC @ReturnCode = msdb.dbo.sp_add_jobschedule @job_id=@jobId, @name=N'2',
                @enabled=1,
                @freq_type=4,
                @freq_interval=1,
                @freq_subday_type=4,
                @freq_subday_interval=5,
                @freq_relative_interval=0,
                @freq_recurrence_factor=0,
                @active_start_date=20151013,
                @active_end_date=99991231,
                @active_start_time=0,
                @active_end_time=235959
IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
EXEC @ReturnCode = msdb.dbo.sp_add_jobserver @job_id = @jobId, @server_name = N'(local)'
IF (@@ERROR <> 0 OR @ReturnCode <> 0) GOTO QuitWithRollback
COMMIT TRANSACTION
GOTO EndSave
QuitWithRollback:
        IF (@@TRANCOUNT > 0) ROLLBACK TRANSACTION
EndSave:

---

CTM_Ajax.class.php

Código PHP:

---

<?php
//**********************************************//
// -> Effect Web                                //
// -> Powered By: Erick-Master                  //
// -> CTM TeaM Softwares                        //
// -> www.ctmts.com.br                          //
//**********************************************//
$Page_Request = strtolower(basename($_SERVER['REQUEST_URI']));
$Page_File = strtolower(basename(__FILE__));
if ($Page_Request == $Page_File)
{
    exit("<span style=\"border:1px dashed #c00; color:#c00; padding:6px; background-color:#ffebe8;\"><strong>CTM-Error: N&atilde;o &eacute; permitido acessar o arquivo diretamente.</strong></span>");
}
if(IN_EFFECTWEB != "47e5098c88cc5f67543414ff1af32efc")
    exit("<!-- CTM.Error(x); -->");
if(!class_exists("CTM_Ajax")) :
class CTM_Ajax extends CTM_MSSQL
{
    public function Set_Panel()
    {
        global $CTM_General;
        
        if($CTM_General->Check_Logged(false) == FALSE)
        {
            $this->Login_Command();
            $this->Login_Form(false);
        }
        else
        {
            $this->Panel($_SESSION["Hash_Account"]);
        }
    }
    private function Login_Form($Message)
    {
        global $CTM_Template;
        
        $CTM_Template->Set("Account", $_POST["Log_Account"]);
        $CTM_Template->Set("Password", $_POST["Log_Password"]);
        $CTM_Template->Set("Message", $Message);
        
        $CTM_Template->Load("templates/".$CTM_Template->Open()."/pages/panel[LOGIN].ajax.php");
    }
    private function Panel($Account)
    {
        global $CTM_General, $CTM_Template, $CTM, $_PmSystem;
        
        if(isset($_SESSION["Hash_Account"]) == FALSE && isset($_SESSION["Hash_Password"]) == FALSE)
        {
            echo("<script>CTM_Load('?ajax=panel','Panel','GET');</script>
            <script>CTM_Load('?pag=home','conteudo','GET');</script>");
        }
        else
        {
            $Query = $this->Query("SELECT * FROM ".MuAcc_DB.".dbo.MEMB_INFO WHERE memb___id='{$Account}'");
            $Staff = $this->FetchQuery("SELECT type FROM {$CTM[0]} WHERE account='{$Account}'");
            $Type_Acc = $this->FetchQuery("SELECT ".VIP_Column." FROM ".VIP_DB.".dbo.".VIP_Table." WHERE ".VIP_Login."='{$Account}'");
            $Golds = $this->FetchQuery("SELECT ".GL_Column_1.",".GL_Column_2.",".GL_Column_3." FROM ".GL_DB.".dbo.".GL_Table." WHERE ".GL_Login."='{$Account}'");
            $Load_Acc = $this->FetchArray($Query);
            $VIP_Type = $CTM_General->Memb_Type($Type_Acc[0]);
            
            /*************************************
                @ Private Message System
                @ Notifications
                @ By: Erick-Master
            **************************************/
            /*if($_PmSystem["Enable"] == TRUE)
            {
                if($_PmSystem["Mode"] == 0)
                {
                    $Query_Chars = $this->Query("SELECT Name FROM ".MuGen_DB.".dbo.Character WHERE AccountID='".$_SESSION["Hash_Account"]."'");
                    while($PM_Chars = $this->Fetch($Query_Chars))
                    {
                        $Check_PM = $this->NumQuery("SELECT * FROM ".MuGen_DB.".dbo.".$_PmSystem["Main"]." WHERE Name='{$PM_Chars[0]}'");
                        if($Check_PM > 0)
                        {
                            $GUID = $this->FetchQuery("SELECT GUID FROM ".MuGen_DB.".dbo.".$_PmSystem["Main"]." WHERE Name='{$PM_Chars[0]}'");
                            $Count_PM = $this->FetchQuery("SELECT count(*) FROM ".MuGen_DB.".dbo.".$_PmSystem["Table"]." WHERE GUID={$GUID[0]} and bRead=0");
                        }
                    }
                }
            }*/
            
            /*if($_PmSystem["Enable"] == TRUE)
            {
                if($_PmSystem["Mode"] == 0)
                {
                    if($Count_PM[0] > 0)
                    {
                        $PM_Panel = "<li><a href=\"javascript: void(EffectWeb);\" onclick=\"CTM_Load('?pag=paneluser&option=PM_ENTER','conteudo','GET');\"><b>&raquo; Notifica&ccedil;&otilde;es <span class=\"colr\">(".$Count_PM[0].")</span></b></a></li>";
                    }
                    else
                    {
                        $PM_Panel = "<li><a href=\"javascript: void(EffectWeb);\" onclick=\"CTM_Load('?pag=paneluser&option=PM_ENTER','conteudo','GET');\">&raquo; Notifica&ccedil;&otilde;es (0)</a></li>";
                    }
                }
            }*/
            $CTM_Template->Set("Memb_Name", $Load_Acc["memb_name"]);
            $CTM_Template->Set("Memb_Type", $VIP_Type);
            $CTM_Template->Set("Memb_Amount[1]", $Golds[0]);
            $CTM_Template->Set("Memb_Amount[2]", $Golds[1]);
            $CTM_Template->Set("Memb_Amount[3]", $Golds[2]);
            $CTM_Template->Set("PanelAdmin_Link", $Staff[0] > 0 ? "<li><a href=\"javascript: void(EffectWeb);\" onclick=\"CTM_Load('?pag=paneladmin','conteudo','GET');\">&raquo; Painel Administrativo</a></li>" : NULL);
            //$CTM_Template->Set("PM_System#Notifications", $PM_Panel == TRUE ? $PM_Panel : NULL);
            
            $CTM_Template->Load("templates/".$CTM_Template->Open()."/pages/panel[LOGGED].ajax.php");
                    
        }
    }
    private function Login_Command()
    {
        global $CTM_Crypt;
        
        if($_GET["cmd"] == "login")
        {
            $Account = $_POST["Log_Account"];
            $Password = $_POST["Log_Password"];
            $Check = $this->FetchQuery("exec dbo.CTM_CheckLogin '".$Account."','".$Password."',".USE_MD5."");
            $Find = $this->FetchQuery("SELECT bloc_code,mail_chek FROM ".MuAcc_DB.".dbo.MEMB_INFO WHERE memb___id='{$Account}'");
            $Findd = $this->FetchQuery("SELECT login,block FROM ".MuAcc_DB.".dbo.brute_force WHERE login='{$Account}'");

            if(empty($Account))
            {
                $this->Login_Form("<div class=\"min-warning\">Digite seu Login</div>");
            }
            elseif(empty($Password))
            {
                $this->Login_Form("<div class=\"min-warning\">Digite sua Senha</div>");
            }
            elseif($Findd[1] == 1)
            {
                $this->Login_Form('<div class=\"min-error\">Login bloqueado por 5 minutos devido a 3 tentativas incorretas!</div>');
            }
            elseif($Check[0] !== 1)
            {
                $this->Login_Form('<div class=\"min-error\">Login ou senha incorretos!</div>');
if ($Findd[0] != $Account)
{
$this->Query("insert into MuOnline.dbo.brute_force (login,tentativas) values ('{$Account}',1)");
}
else
{
$this->Query("update MuOnline.dbo.brute_force set tentativas=tentativas+1 where login='{$Account}'");
$this->Query("update MuOnline.dbo.brute_force set block=1 where tentativas > 2 and login='{$Account}'");
}

            }
            elseif($Find[0] == 1)
            {
                $this->Login_Form("<div class=\"min-error\">Sua conta est&aacute; Bloqueada</div>");
            }
            elseif($Find[1] == 0)
            {
                $this->Login_Form("<div class=\"min-error\">Sua conta n&atilde;o esta confirmada.</div>");
            }
            else
            {
                $_SESSION["Hash_Account"] = utf8_encode($Account);
                $_SESSION["Hash_Password"] = $CTM_Crypt->Pwd($Password);
                
                $this->Login_Form("<script>setTimeout(\"count()\", 1000);</script>
                <div class=\"min-success\">&raquo; Logado com Sucesso.<br />&raquo; Aguarde...</div>
                <span id=\"time\" style=\"display: none;\">2</span>");
            }
        }
    }
    public function ServerList()
    {
        if(constant("Server_List") == TRUE)
        {
            global $_ServerList;
            $CTM_ConnectServer = new CTM_ConnectServer(true);
            
            for($GS = 0; $GS < count($_ServerList); $GS++)
            {
                $Count = ceil($CTM_ConnectServer->ServerCount(true, $_ServerList[$GS][1]) * 100 / $_ServerList[$GS][2]);
                echo("<li>&raquo; ".$_ServerList[$GS][0]." : <a href=\"javascript: void(EffectWeb);\" onclick=\"CTM_Load('?pag=online&gs=".urlencode($_ServerList[$GS][1])."','conteudo','GET');\"><strong id=\"".$_ServerList[$GS][1]."_ID\">".$Count."%</strong></a>
                <div class=\"OnlineCount\" id=\"ServerID".$_ServerList[$GS][1]."\">
                 <div class=\"ServerCount\" style=\"width: ".$Count."%\"></div>
                </div></li>");
            }
            echo("<li>Total: <strong id=\"TotalServers\"><a href=\"javascript: void(EffectWeb);\" onclick=\"CTM_Load('?pag=online','conteudo','GET');\">".$CTM_ConnectServer->ServerCount(false, false)."</a></strong> <a href=\"javascript: void(EffectWeb);\" onClick=\"CTM_Load('?ajax=check&cmd=servers', 'ServerRefresh', 'GET');\"><img src=\"images/icons/refresh.png\" width=\"10\" height=\"10\" border=\"0\"></a></li>");
        }
        else
        {
            $CTM_ConnectServer = new CTM_ConnectServer(false);
            echo("<li>Total: <strong id=\"TotalServers\"><a href=\"javascript: void(EffectWeb);\" onclick=\"CTM_Load('?pag=online','conteudo','GET')\">".$CTM_ConnectServer->ServerCount(false, false)."</a></strong> <a href=\"javascript: void(EffectWeb);\" onClick=\"CTM_Load('?ajax=check&cmd=servers', 'ServerRefresh', 'GET');\"><img src=\"images/icons/refresh.png\" width=\"10\" height=\"10\" border=\"0\"></a></li>");
        }
    }
    public function StaffList($Code)
    {
        $Query = $this->Query("SELECT Name,AccountID FROM ".MuGen_DB.".dbo.Character WHERE CtlCode={$Code} ORDER BY Name");
        $Check = $this->NumRow($Query);
        
        if($Check < 1)
        {
            exit("<div class=\"min-info\">Nenhum ADM/GM Cadastrados</div>");
        }
        for($WzAG = 0; $WzAG < $this->NumRow($Query); $WzAG++)
        {
            $Member = $this->Fetch($Query);
            $Status = $this->FetchQuery("SELECT ConnectStat FROM ".MuGen_DB.".dbo.MEMB_STAT WHERE memb___id='{$Member[1]}'");
            switch($Status[0])
            {
                case 0 : $Stat = "<span style=\"color: red;\">Offline</span>"; break;
                case 1 : $Stat = "<span style=\"color: green;\">Online</span>"; break;
            }
            echo("<li>&raquo; {$Member[0]} - {$Stat}</li>");
        }
    }
    public function RefreshServers()
    {
        global $_ServerList;
        $CTM_ConnectServer = new CTM_ConnectServer(true);
            
        echo "<script>document.getElementById('TotalServers').innerHTML = '<a href=\"javascript: void(EffectWeb);\" onclick=\"CTM_Load(\'?pag=online\',\'conteudo\',\'GET\');\">".$CTM_ConnectServer->ServerCount(false, false)."</a>';</script>";
        for($GS = 0; $GS < count($_ServerList); $GS++)
        {
            $Count = ceil($CTM_ConnectServer->ServerCount(true, $_ServerList[$GS][1]) * 100 / $_ServerList[$GS][2]);
            echo "<script>document.getElementById('".$_ServerList[$GS][1]."_ID').innerHTML = '{$Count}%';
document.getElementById('ServerID".$_ServerList[$GS][1]."').innerHTML = '<div class=\"ServerCount\" style=\"width: {$Count}%\"></div>';</script>";
        }
        exit();
    }
}
endif;
?>

---