项目地址:

GitHub - misaki7in/ipfilter: IP地址白名单过滤器，可配合微步API分析，护网蓝队重保工具

0X01 工具背景

在护网场景中，作为乙方公司的蓝队防守人员，经常会遇到一些客户具有相当多的不可封禁的IP地址，如负载均衡IP，站前代理IP，内网漏扫IP，云防节点IP地址。尽管我们在研判流量威胁时，已经确认了这些IP地址确实存在攻击流量，但是在防火墙封锁恶意IP地址的时候，经常要手工剔除这些IP，十分繁琐。

之前在SXF工作时，经常会看见一线安服工程师因为封锁IP 时未过滤不可封禁IP地址，导致客户的业务中断甚至全部断网【封锁了出口IP】，被记黑事件，甚至辞退

于是针对该场景于2022年8月hvv时开发了IP地址的自动过滤工具，并于2023年3月添加了微步自动化查询IP地址和IP属性【是否具备恶意标签】的功能，方便防守人员快速输出威胁IP话术。

0X02 代码实现

1.微步API接口实现

using Newtonsoft.Json.Linq;
using Newtonsoft.Json;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

namespace IPFilter.Model
{
    public struct Result
    {
        public bool success;
        public string msg;
        public string data;
    }
    public class WBApi
    {
        private const string useragent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36";
        public HttpClient httpClient;
        public DateTime CurrentTime;
        private readonly HttpClientHandler handler;
        public WBApi()
        {
            handler = new HttpClientHandler
            {
                AllowAutoRedirect = false,
                UseCookies = true,
            };
            httpClient = new HttpClient(handler);
            httpClient.DefaultRequestHeaders.Add("user-agent", useragent);
        }
        public Result ip_reputation(string apiKey, string ipString)
        {
            var r = new Result();
            try
            {
        
                string url = $"https://api.threatbook.cn/v3/scene/ip_reputation?apikey={apiKey}&resource={ipString}&lang=zh";
                var response = httpClient.GetAsync(url).Result;
                response.EnsureSuccessStatusCode();
                var data = response.Content.ReadAsStringAsync().Result;

                var json = JsonConvert.DeserializeObject<JObject>(data);
                if (json != null && json.ContainsKey("response_code") && json.ContainsKey("verbose_msg"))
                {
                    r.msg = json["verbose_msg"].ToString();
                    if (json["response_code"].ToString() == "0")
                    {
                        r.data = data;
                        r.success = true;
                    }
                }
                if (string.IsNullOrEmpty(r.msg))
                {
                    r.msg = "查询失败";
                }
            }
            catch (Exception ex)
            {
                if (string.IsNullOrEmpty(r.msg))
                {
                    r.msg = ex.Message;
                }
            }
            r.msg = "微步查询信誉:" + r.msg;
            return r;
        }
    }
}

2.白名单规则匹配实现

using Newtonsoft.Json;
using System;
using System.Collections.Generic;
using System.Text.RegularExpressions;

namespace IPFilter.Model
{
    [JsonObject(MemberSerialization.OptIn)]
    internal class WhiteInfo : UIObject
    {
        private bool enable;
        [JsonProperty]
        public bool Enable
        {
            get => enable;
            set => this.RaiseAndSetIfChanged(ref enable, value);
        }
        private string title;
        [JsonProperty]
        public string Title
        {
            get => title;
            set => this.RaiseAndSetIfChanged(ref title, value);
        }
        private string whiteContents;
        [JsonProperty]
        public string WhiteContents
        {
            get => whiteContents;
            set => this.RaiseAndSetIfChanged(ref whiteContents, value);
        }

        public List<uint> IP;
        public List<(uint, byte)> IPAndMask;
        public List<(uint, uint)> IPRange;
        internal bool Has(uint targetip)
        {
            if (IP == null)
            {
                if (string.IsNullOrEmpty(WhiteContents)) return false;
                var str = WhiteContents.Trim();
                var arr = Regex.Split(str, "\n+");
                IP = new List<uint>();
                IPAndMask = new List<(uint, byte)>();
                IPRange = new List<(uint, uint)>();
                for (int i = 0; i < arr.Length; i++)
                {
                    var ip = arr[i].Trim();
                    if (string.IsNullOrEmpty(ip)) continue;
                    if (SetWindow.IsIP(ip))
                    {
                        uint tt = 0;
                        var iparr = Regex.Split(ip, "\\.");
                        for (int j = 0; j < 4; j++)
                        {
                            tt = (tt << 8) + Convert.ToUInt32(iparr[j]);
                        }
                        IP.Add(tt);
                    }
                    else if (SetWindow.IsIPAndMask(ip))
                    {
                        uint tt = 0;
                        var iparr = Regex.Split(ip, "[\\./]+");
                        for (int j = 0; j < 4; j++)
                        {
                            tt = (tt << 8) + Convert.ToUInt32(iparr[j]);
                        }
                        byte b = Convert.ToByte(iparr[4]);
                        IPAndMask.Add((tt, b));
                    }
                    else if (SetWindow.IsIPRange(ip))
                    {
                        uint tt = 0;
                        var iparr = Regex.Split(ip, "[\\.-]+");
                        for (int j = 0; j < 4; j++)
                        {
                            tt = (tt << 8) + Convert.ToUInt32(iparr[j]);
                        }
                        uint bb = 0;
                        for (int j = 0; j < 4; j++)
                        {
                            bb = (bb << 8) + Convert.ToUInt32(iparr[j + 4]);
                        }
                        IPRange.Add((tt, bb));
                    }
                }
            }

            if (IP.Contains(targetip))
                return true;
            for (int i = 0; i < IPAndMask.Count; i++)
            {
                var right = 32 - IPAndMask[i].Item2;
                if ((IPAndMask[i].Item1 >> right) == (targetip >> right))
                {
                    return true;
                }
            }
            for (int i = 0; i < IPRange.Count; i++)
            {
                if (IPRange[i].Item1 <= targetip && targetip <= IPRange[i].Item2)
                {
                    return true;
                }
            }
            return false;
        }
    }
}

3.视图设计

4.视图逻辑

using System;
using System.Collections;
using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Text.RegularExpressions;
using System.Threading.Tasks;
using System.Windows;
using System.Windows.Documents;
using System.Windows.Input;
using IPFilter.Model;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;

namespace IPFilter.ViewModel
{
    [JsonObject(MemberSerialization.OptIn)]
    internal class IPFilterConfig : UIObject
    {
        [JsonProperty]
        public ObservableCollection<WhiteInfo> WhiteInfos { get; set; }
        private bool enable;
        [JsonProperty]
        public bool Enable
        {
            get => enable;
            set => this.RaiseAndSetIfChanged(ref enable, value);
        }
        public Window fwindow;
        internal void Init()
        {
            if (WhiteInfos == null)
                WhiteInfos = new ObservableCollection<WhiteInfo>();
        }

        private ICommand addWhiteInfo;
        public ICommand AddWhiteInfo
        => addWhiteInfo ?? (addWhiteInfo = UIObject.Create(() =>
        {
            var t = new WhiteInfo();
            t.Enable = false;
            t.Title = WhiteInfos.Count.ToString();
            var f = new SetWindow();
            f.DataContext = t;
            f.Owner = fwindow;
            f.ShowDialog();
            if (f.Result)
            {
                WhiteInfos.Add(t);
            }
        }));
        private ICommand delWhiteInfo;
        public ICommand DelWhiteInfo
        => delWhiteInfo ?? (delWhiteInfo = UIObject.Create(() =>
        {
            var list = new List<WhiteInfo>();
            for (int i = 0; i < WhiteInfos.Count; i++)
            {
                if (WhiteInfos[i].Enable)
                {
                    list.Add(WhiteInfos[i]);
                }
            }
            if (list.Count > 0)
            {
                var f = new TostWindow();
                f.ContentText.Text = "共删除" + list.Count + "项";
                f.Owner = fwindow;
                f.ShowDialog();
                if (f.Result)
                {
                    for (int i = 0; i < list.Count; i++)
                    {
                        WhiteInfos.Remove(list[i]);
                    }
                }
            }
            else
            {
                var f = new TostWindow();
                f.ContentText.Text = "请勾选要删除的项！";
                f.Owner = fwindow;
                f.ShowDialog();
            }
        }));

        private ICommand selectAllWhiteInfo;
        public ICommand SelectAllWhiteInfo
        => selectAllWhiteInfo ?? (selectAllWhiteInfo = UIObject.Create(() =>
        {

            for (int i = 0; i < WhiteInfos.Count; i++)
            {
                WhiteInfos[i].Enable = true;
            }
        }));
        private ICommand selectReverseWhiteInfo;
        public ICommand SelectReverseWhiteInfo
        => selectReverseWhiteInfo ?? (selectReverseWhiteInfo = UIObject.Create(() =>
        {

            for (int i = 0; i < WhiteInfos.Count; i++)
            {
                WhiteInfos[i].Enable = !WhiteInfos[i].Enable;
            }
        }));


        private string inputIp;
        public string InputIp
        {
            get => inputIp;
            set
            {
                if (Equals(inputIp, value)) return;
                this.RaiseAndSetIfChanged(ref inputIp, value);
                if (Enable)
                {
                    MyFilter();
                }
            }
        }

        private string whiteIp;
        public string WhiteIp
        {
            get => whiteIp;
            set => this.RaiseAndSetIfChanged(ref whiteIp, value);
        }
        private string noWhiteIp;
        public string NoWhiteIp
        {
            get => noWhiteIp;
            set => this.RaiseAndSetIfChanged(ref noWhiteIp, value);
        }
        private string wbIpInfo;
        public string WBIpInfo
        {
            get => wbIpInfo;
            set => this.RaiseAndSetIfChanged(ref wbIpInfo, value);
        }
        private string evilIPInfos;
        public string EvilIPInfos
        {
            get => evilIPInfos;
            set => this.RaiseAndSetIfChanged(ref evilIPInfos, value);
        }
        private string wbAPPKey;
        [JsonProperty]
        public string WBAPPKey
        {
            get => wbAPPKey;
            set => this.RaiseAndSetIfChanged(ref wbAPPKey, value);
        }
        private ICommand filterFormWhiteInfos;
        public ICommand FilterFormWhiteInfos
        => filterFormWhiteInfos ?? (filterFormWhiteInfos = UIObject.Create(() =>
        {
            MyFilter();

        }));
        private ICommand showEvilIPInfos;
        public ICommand ShowEvilIPInfos
        => showEvilIPInfos ?? (showEvilIPInfos = UIObject.Create(() =>
        {
            MyShowEvilIPInfos();

        }));

        private WBApi myWBApi;
        private ICommand wbGetIPInfos;
        private List<string> WBIplist;

        public ICommand WBGetIPInfos
        => wbGetIPInfos ?? (wbGetIPInfos = UIObject.Create(() =>
        {
            MyWBGetIPInfos();

        }));
        private void MyShowEvilIPInfos()
        {
            var list = new List<string>();
            for (int i = 0; i < WBIplist.Count; i++)
            {
                if (WBIplist[i].IndexOf("恶意") > -1)
                {
                    list.Add(WBIplist[i].Replace("恶意"," "));
                }
            }
            EvilIPInfos = string.Join("\r\n", list);
        }
        private void MyWBGetIPInfos()
        {
            if (string.IsNullOrEmpty(NoWhiteIp)) return;
            var arr = Regex.Split(NoWhiteIp, "[\r\n]+");
            if (WBIplist == null) WBIplist = new List<string>();
            else
                WBIplist.Clear();
            WBIpInfo = string.Empty;
            for (int i = 0; i < arr.Length; i += 100)
            {
                var ipstirng = string.Join(",", arr.Skip(i).Take(100).ToList());
                if (myWBApi == null) myWBApi = new WBApi();
                var r = myWBApi.ip_reputation(wbAPPKey, ipstirng);
                if (r.success)
                {
                    ParseWBip_reputation(r.data);
                }
                WBIpInfo += r.msg;
            }
            WBIpInfo += "\r\n" + string.Join("\r\n", WBIplist);
        }
        private void ParseWBip_reputation(string data)
        {
            /*
             {
                "data": {
                    "159.203.93.255": {
                        "severity": "info",
                        "judgments": [
                            "IDC"
                        ],
                        "tags_classes": [],
                        "basic": {
                            "carrier": "digitalocean.com",
                            "location": {
                                "country": "United States",
                                "province": "New York",
                                "city": "New York City",
                                "lng": "-74.006",
                                "lat": "40.713",
                                "country_code": "US"
                            }
                        },
                        "asn": {
                            "rank": 2,
                            "info": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US",
                            "number": 14061
                        },
                        "scene": "",
                        "confidence_level": "low",
                        "is_malicious": false,
                        "update_time": "2016-05-17 20:18:33"
                    }
                },
                "response_code": 0,
                "verbose_msg": "OK"
            }
             */
            var json = JObject.Parse(data);
            var arr = json["data"].Children<JProperty>().Select(x =>
            {
                var a = x.Name;
                if (x.Value["is_malicious"].Value<bool>())
                {
                    a += " 恶意";
                }
                a += " " + x.Value["basic"]["location"]["country"].ToString() + x.Value["basic"]["location"]["province"].ToString();
                return a;
            }).ToArray();
            WBIplist.AddRange(arr);
        }
        private void MyFilter()
        {
            if (string.IsNullOrEmpty(InputIp))
                return;
            var str = InputIp.Trim();
            var arr = Regex.Split(str, "\n+");
            var list = new List<string>();
            var rlist = new List<string>();
            for (int i = 0; i < arr.Length; i++)
            {
                var ip = arr[i].Trim();
                if (string.IsNullOrEmpty(ip)) continue;
                if (!SetWindow.IsIP(ip))
                {
                    list.Add(ip);
                }
                else
                {
                    rlist.Add(ip);
                }
            }
            if (list.Count > 0)
            {
                var f = new TostWindow();
                f.ContentText.Text = string.Join("\r\n", list) + "\r\n不是有效IP格式";
                var h = f.Height + 20 * list.Count;
                f.Height = h > 500 ? 500 : h;
                f.Owner = fwindow;
                f.ShowDialog();
            }
            var whiteIpList = new List<string>();
            for (int k = 0; k < rlist.Count; k++)
            {
                var has = false;
                uint tt = 0;
                var iparr = Regex.Split(rlist[k], "\\.");
                for (int j = 0; j < 4; j++)
                {
                    tt = (tt << 8) + Convert.ToUInt32(iparr[j]);
                }
                for (int i = 0; i < WhiteInfos.Count; i++)
                {
                    if (WhiteInfos[i].Enable && WhiteInfos[i].Has(tt))
                    {
                        has = true;
                        break;
                    }
                }
                if (has)
                {
                    whiteIpList.Add(rlist[k]);
                }
            }
            var noWhiteIpList = new List<string>();
            for (int i = 0; i < arr.Length; i++)
            {
                var ip = arr[i].Trim();
                if (string.IsNullOrEmpty(ip)) continue;
                if (!whiteIpList.Contains(ip))
                {
                    noWhiteIpList.Add(ip);
                }
            }
            NoWhiteIp = string.Join("\r\n", noWhiteIpList);
            WhiteIp = string.Join("\r\n", whiteIpList);
        }
    }
}

0X03 使用方法

1.录入白名单的标题，如XX单位【云防节点】，输入白名单规则，支持三种IP格式的输入。

2.根据需求启用或新建白名单规则，输入对应的IP段，即可实现IP地址的过滤

3.如果你具有微步的APItoken的话【注意:微步API需要申请，并且非企业用户每天可查询额度固定为50，超出则无法查询】，可以输入APItoken，对IP地址进行威胁查询和地址查询，并过滤出恶意标签的IP地址。

获取微步API的方式: 访问链接: ThreatBook 用户登录

注意: 注意确认自己每日的API查询IP的额度，个人用户较少，每天只有50次，建议申请企业用户。

0X04 效果展示

最终结果整理成值守话术，美滋滋~~~~,再也不担心封错IP地址。

0X05 使用注意

1.项目目录文件如下

2.项目文件哈希值如下【注意别被攻击队钓鱼了】

SHA1 的 IPFilter.exe 哈希:
ec2302560afdb52b2fe772570df7943808476158
MD5 的 IPFilter.exe 哈希:
f102e67b979a4daefd195ca8e859b537

3.考虑到部分小伙伴有特殊的需求，可以在github上留言