rm -R /tmp/*.rules curl -ko /tmp/botcc.portgrouped.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-botcc.portgrouped.rules curl -ko /tmp/botcc.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-botcc.rules curl -ko /tmp/ciarmy.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-ciarmy.rules curl -ko /tmp/compromised.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-compromised.rules curl -ko /tmp/dshield.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-dshield.rules curl -ko /tmp/emerging-exploit.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-exploit.rules curl -ko /tmp/emerging-malware.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-malware.rules curl -ko /tmp/emerging-mobile_malware.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-mobile_malware.rules curl -ko /tmp/emerging-user_agents.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-user_agents.rules curl -ko /tmp/emerging-web_client.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-web_client.rules curl -ko /tmp/emerging-worm.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-worm.rules curl -ko /tmp/emerging-current_events.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-current_events.rules # curl -ko /tmp/emerging-trojan.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-trojan.rules # curl -ko /tmp/drop.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-drop.rules # curl -ko /tmp/emerging-web_specific_apps.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-web_specific_apps.rules # curl -ko /tmp/emerging-scan.rules https://rules.emergingthreats.net/open/snort-edge/rules/emerging-scan.rules cat /tmp/*.rules > alert.list sed -i 's/alert /drop /' alert.list sed '/^\#/d' alert.list >> temp.rules sed '/^$/d' temp.rules > snort.rules sed -i '/sid:2002802/s/^/#/' snort.rules sed -i '/sid:2019237/s/^/#/' snort.rules sed -i '/sid:2018194/s/^/#/' snort.rules sed -i '/sid:2012251/s/^/#/' snort.rules sed -i '/sid:2100527/s/^/#/' snort.rules sed -i '/sid:2100649/s/^/#/' snort.rules sed -i '/sid:2009080/s/^/#/' snort.rules sed -i '/sid:2009205/s/^/#/' snort.rules sed -i '/sid:2009206/s/^/#/' snort.rules sed -i '/sid:2009207/s/^/#/' snort.rules sed -i '/sid:2009208/s/^/#/' snort.rules sed -i '/sid:2008975/s/^/#/' snort.rules sed -i '/sid:2010515/s/^/#/' snort.rules sed -i '/sid:2003099/s/^/#/' snort.rules sed -i '/sid:2101201/s/^/#/' snort.rules sed -i '/sid:2001689/s/^/#/' snort.rules sed -i '/sid:2011695/s/^/#/' snort.rules sed -i '/sid:2013359/s/^/#/' snort.rules sed -i '/sid:2013358/s/^/#/' snort.rules sed -i '/sid:2013357/s/^/#/' snort.rules sed -i '/sid:2013355/s/^/#/' snort.rules sed -i '/sid:2013354/s/^/#/' snort.rules sed -i '/sid:2013353/s/^/#/' snort.rules sed -i '/sid:2013360/s/^/#/' snort.rules sed -i '/sid:2100648/s/^/#/' snort.rules sed -i '/sid:2009080/s/^/#/' snort.rules sed -i '/sid:2101390/s/^/#/' snort.rules sed -i '/sid:2012086/s/^/#/' snort.rules sed -i '/sid:2100650/s/^/#/' snort.rules sed -i '/sid:2011803/s/^/#/' snort.rules sed -i '/sid:2012510/s/^/#/' snort.rules sed -i '/sid:2001219/s/^/#/' snort.rules sed -i '/sid:2003068/s/^/#/' snort.rules sed -i '/sid:2002995/s/^/#/' snort.rules sed -i '/sid:2011347/s/^/#/' snort.rules sed -i '/sid:2102925/s/^/#/' snort.rules sed -i '/sid:2012263/s/^/#/' snort.rules sed -i '/sid:2012848/s/^/#/' snort.rules sed -i '/sid:2001046/s/^/#/' snort.rules sed -i '/sid:2003055/s/^/#/' snort.rules sed -i '/sid:2002993/s/^/#/' snort.rules sed -i '/sid:2002992/s/^/#/' snort.rules sed -i '/sid:2001353/s/^/#/' snort.rules sed -i '/sid:2009205/s/^/#/' snort.rules sed -i '/sid:2009206/s/^/#/' snort.rules sed -i '/sid:2009207/s/^/#/' snort.rules sed -i '/sid:2009208/s/^/#/' snort.rules sed -i '/sid:2001046/s/^/#/' snort.rules sed -i '/sid:2016950/s/^/#/' snort.rules sed -i '/sid:2019509/s/^/#/' snort.rules sed -i '/sid:2011507/s/^/#/' snort.rules sed -i '/sid:2010514/s/^/#/' snort.rules sed -i '/sid:2010516/s/^/#/' snort.rules sed -i '/sid:2010518/s/^/#/' snort.rules sed -i '/sid:2010520/s/^/#/' snort.rules sed -i '/sid:2010522/s/^/#/' snort.rules sed -i '/sid:2010525/s/^/#/' snort.rules sed -i '/sid:2010527/s/^/#/' snort.rules sed -i '/sid:2012056/s/^/#/' snort.rules sed -i '/sid:2012075/s/^/#/' snort.rules sed -i '/sid:2012119/s/^/#/' snort.rules sed -i '/sid:2012205/s/^/#/' snort.rules sed -i '/sid:2012272/s/^/#/' snort.rules sed -i '/sid:2012398/s/^/#/' snort.rules sed -i '/sid:2010931/s/^/#/' snort.rules sed -i '/sid:2011764/s/^/#/' snort.rules sed -i '/sid:2103088/s/^/#/' snort.rules sed -i '/sid:2103192/s/^/#/' snort.rules sed -i '/sid:2103134/s/^/#/' snort.rules sed -i '/sid:2101852/s/^/#/' snort.rules sed -i '/sid:2015526/s/^/#/' snort.rules sed -i '/sid:2009151/s/^/#/' snort.rules sed -i '/sid:2012997/s/^/#/' snort.rules sed -i '/sid:2101201/s/^/#/' snort.rules sed -i '/sid:2016672/s/^/#/' snort.rules sed -i '/sid:2000538/s/^/#/' snort.rules sed -i '/sid:2000540/s/^/#/' snort.rules sed -i '/sid:2011367/s/^/#/' snort.rules sed -i '/sid:2012251/s/^/#/' snort.rules sed -i '/sid:2100528/s/^/#/' snort.rules sed -i '/sid:2007994/s/^/#/' snort.rules sed -i '/sid:2008066/s/^/#/' snort.rules sed -i '/sid:2012180/s/^/#/' snort.rules sed -i '/sid:2102925/s/^/#/' snort.rules sed -i '/sid:2100628/s/^/#/' snort.rules sed -i '/sid:2010697/s/^/#/' snort.rules sed -i '/sid:2013479/s/^/#/' snort.rules sed -i '/sid:2001046/s/^/#/' snort.rules sed -i '/sid:2011803/s/^/#/' snort.rules sed -i '/sid:2009768/s/^/#/' snort.rules sed -i '/sid:2019490/s/^/#/' snort.rules sed -i '/sid:2011347/s/^/#/' snort.rules sed -i '/sid:2011037/s/^/#/' snort.rules sed -i '/sid:2103133/s/^/#/' snort.rules sed -i '/sid:2103132/s/^/#/' snort.rules sed -i '/sid:2017005/s/^/#/' snort.rules sed -i '/sid:2006445/s/^/#/' snort.rules sed -i '/sid:2003927/s/^/#/' snort.rules sed -i '/sid:2010908/s/^/#/' snort.rules sed -i '/sid:2014020/s/^/#/' snort.rules sed -i '/sid:2017479/s/^/#/' snort.rules rm alert.list rm temp.rules echo "#*************************************************************" >> snort.rules echo "#" >> snort.rules echo "# Copyright (c) 2003-2016, Emerging Threats" >> snort.rules echo "# All rights reserved." >> snort.rules echo "# " >> snort.rules echo "# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the " >> snort.rules echo "# following conditions are met:" >> snort.rules echo "# " >> snort.rules echo "# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following " >> snort.rules echo "# disclaimer." >> snort.rules echo "# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the " >> snort.rules echo "# following disclaimer in the documentation and/or other materials provided with the distribution." >> snort.rules echo "# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived " >> snort.rules echo "# from this software without specific prior written permission." >> snort.rules echo "# " >> snort.rules echo "# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES," >> snort.rules echo "# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE " >> snort.rules echo "# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, " >> snort.rules echo "# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR " >> snort.rules echo "# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, " >> snort.rules echo "# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE " >> snort.rules echo "# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. " >> snort.rules echo "#" >> snort.rules echo "#*************************************************************" >> snort.rules #sleep 1 #rm /tmp/ads.tmp #### Ads Updates #### #curl -s -d mimetype=plaintext -d hostformat=unixhosts http://pgl.yoyo.org/adservers/serverlist.php? | sort >> /tmp/ads.tmp #curl -s http://winhelp2002.mvps.org/hosts.txt | grep -v "#" | grep -v "127.0.0.1" | sed '/^$/d' | sed 's/\ /\\ /g' | awk '{print $2}' | sed -e '1,3d' | sort >> /tmp/ads.tmp ##curl -s http://someonewhocares.org/hosts/hosts | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | grep -v '^\\' | grep -v '\\$' | awk '{print $2}' | grep -v '^\\' | grep -v '\\$' | sort >> /tmp/ads.tmp #curl -s http://sysctl.org/cameleon/hosts | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | grep -v '^\\' | grep -v '\\$' | awk '{print $3}' | grep -v '^\\' | grep -v '\\$' | sort >> /tmp/ads.tmp #curl -s http://optimate.dl.sourceforge.net/project/adzhosts/HOSTS.txt | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | grep -v '^\\' | grep -v '\\$' | awk '{print $2}' | grep -v '^\\' | grep -v '\\$' | sort >> /tmp/ads.tmp #curl -s https://hosts.neocities.org/ -k | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | awk '{print $2}' | grep -v '^\\' | grep -v '\\$' | sort >> /tmp/ads.tmp #sleep 1 #sed 's/^/address=\//g' -i /tmp/ads.tmp #sed -e 's/$/\/10.10.10.11/' -i /tmp/ads.tmp #sleep 1 #rm /tmp/malicious.tmp ### Malware Updates ### #curl -s http://www.malwaredomainlist.com/hostslist/hosts.txt | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | awk '{print $3}' | grep -v '^\\' | grep -v '\\$' | sort >> /tmp/malicious.tmp #curl -s http://mirror1.malwaredomains.com/files/justdomains | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | sort >> /tmp/malicious.tmp #curl -s https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt -k | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | sort >> /tmp/malicious.tmp #curl -s https://hosts.neocities.org/ -k | grep -v "#" | sed '/^$/d' | sed 's/\ /\\ /g' | awk '{print $2}' | grep -v '^\\' | grep -v '\\$' | sort >> /tmp/malicious.tmp #sleep 1 #sed 's/^/address=\//g' -i /tmp/malicious.tmp #sed -e 's/$/\/10.10.10.11/' -i /tmp/malicious.tmp sleep 1 #mv /tmp/ads.tmp /etc/itus/lists/ads #sleep 1 #mv /tmp/malicious.tmp /etc/itus/lists/malicious #sleep 1 #chmod 655 /etc/itus/lists/ads #chmod 655 /etc/itus/lists/malicious #sleep 1 #/etc/init.d/dnsmasq restart #sleep 3 mv snort.rules /etc/snort/rules/snort.rules sleep 2 /etc/init.d/snort restart sleep 2 date > /.do_date exit 0