#######################################################################
#anal.php Auto NANAS And LART 0.2 blackhole@shat.net 5/15/2002
#
#This script helps automate the process of posting received spam to the
#Usenet newsgroup news.admin.net-abuse.sightings. It can also send out
#email LARTs with a copy of the spam, if you specify recipients. Just
#follow the config instructions and load the script in your browser.
#Paste in a full spam with headers, add any email addresses you wish
#to send LARTs to, fill in LART comments if needed, and post the form.
#
#Configuration:
#Set the variables below, then edit the str_replace statements in
#the post_it() function to adjust munging. You may also want to edit
#each of the blurb messages, these get appended to the top of usenet
#posts and LART emails.
#
#This script is donate-ware. You can use, modify, and redistribute it
#freely, so long as this notice and the X-Mailer and X-Posting-Agent
#headers remain intact. If you like the script and would like to send
#me a buck or two, paypal to s {at} shat'net.
#######################################################################
#Set nanasfrom to any NNTP-compliant From string. It will be used as
#the From header on posts made to NANAS, regardless of whether they
#are made via NNTP or email.
$nanasfrom = "spamtrap@example.com (Spam Trap)";
#Set lartfrom to an email address only. It will be used as the From
#and Return-Path on your email LARTs, and all email LARTs will also
#be BCC'd to this address.
$lartfrom = "spamtrap@example.com";
#Set newsserver to your news server's hostname or IP. If you leave
#it blank, NANAS posts will be made via email instead of NNTP.
$newsserver = "";
#Set newsuser to your news server username, if required
$newsuser = "";
#Set newspass to your news server password, if required
$newspass = "";
#######################################################################
#Editing below is not required, but you may want to adjust some of the
#munged strings or blurb messages.
#######################################################################
#Until I rewrite my scripts, this will suffice for 4.2.0+ compatibility
if(phpversion() >= "4.2.0"){
extract($_POST);
extract($_SERVER);
extract($_ENV);
}
function post_it(){
global $message,$reference,$nanasfrom,$slimy;
global $newsuser,$newspass,$newsserver,$larts_to;
$groups = "news.admin.net-abuse.sightings";
#You can edit the lines below, or add more str_replace statements,
#to mung your domain name and personal information out of each
#spam before it's posted.
$message = str_replace("shaun", "[munged]", $message);
$message = str_replace("shat", "[munged]", $message);
$message = str_replace("domain-i-own", "[munged]", $message);
$message = str_replace("another-domain", "[munged]", $message);
#Leave the following lines in place, they ensure that any quotes
#or slashes in the spam stay intact
$subject = str_replace("\\\"", "\"", $subject);
$subject = str_replace("\\'", "'", $subject);
$message = str_replace("\\\"", "\"", $message);
$message = str_replace("\\'", "'", $message);
#Is this an email spam or a usenet spam?
if(eregi("Newsgroups:", $message))
$spamtype = "usenet";
else if(eregi("Received: ", $message))
$spamtype = "email";
else
die("Couldn't determine spam type!
");
#Find the subject inside of the spam message
preg_match("/Subject: .*/i", $message, $result);
$result[0] = str_replace("Subject: ", "", $result[0]);
$subject = "[$spamtype] $result[0]";
$subject = trim($subject);
#If email LARTs were requested, send them out now
if($larts_to){
$lart_info = send_lart($message, $spamtype, $subject, $larts_to);
}
$blurb = "[NOTE: This NANAS post was generated and posted by a "
. "script, not a human. In cases of email sightings, the "
. "recipient address and mailhost are probably munged. "
. "If you require information about this post, please email"
. " the From: address, it's valid.]";
if(strlen($lart_info)>1)
$blurb .= $lart_info;
$message = "$blurb\n\n$message";
$message = wordwrap($message);
#Build the headers
$senddate = date("d M y h:m:s -0600");
srand((double)microtime() * 1000000);
$headers = "From: $nanasfrom\r\nNewsgroups: $groups\r\nDate: "
. "$senddate\r\nSubject: $subject\r\nX-No-Confirm: Yes\r\n"
. "X-Canned-Ham: Yes <-- You can filter on this.\r\n"
. "X-Posting-Agent: anal/0.2 (http://shat.net/php/anal/)\r\n";
#Generate Message-ID if applicable
if($slimy){
$guid = date("Ymd.");
for ($i=0;$i<16;$i++)
$guid .= rand(0,9);
$mid = "$guid.SIGHTED@slimy.canned-ham.biz";
$headers .= "Message-ID: <$mid>\r\n";
}
#Send the NANAS report
if($newsserver){
if (! $sock = fsockopen($newsserver, 119, &$err, &$errno, 10))
die("Error connecting to server: $err ($errno)\n\n");
$reply = fgets($sock, 1024);
if($newsuser){
fputs($sock, "authinfo user $newsuser\r\n");
$reply = fgets($sock, 1024);
fputs($sock, "authinfo pass $newspass\r\n");
$reply = fgets($sock, 1024);
}
fputs($sock, "post\r\n");
$reply = fgets($sock, 1024);
fputs($sock, "$headers\r\n");
fputs($sock, "$message\r\n.\r\n\r\n");
$reply = fgets($sock, 1024);
if(!ereg("240", $reply))
echo "Your post was not made, server said $reply.";
else{
echo "$mid will appear in Usenet shortly.";
}
}
else{
if(!$lartfrom) die("You didn't specify a From: email address.");
$toaddr = "nanas-sub@cybernothing.org";
if(!(mail($toaddr, $subject, $message, $headers))){
echo "Error while sending email NANAS report. ";
}
else{
echo "$mid will appear in Usenet shortly.";
}
}
}
function send_lart($message, $spamtype, $subject, $larts_to){
global $lart_comment, $lartfrom, $mailserver;
$mailbody = $message;
$lart_comment = str_replace("\\\"", "\"", $lart_comment);
$lart_comment = str_replace("\\'", "'", $lart_comment);
$blurb = "Hello,\r\n\r\nPasted below is a copy of a spam $spamtype"
. " message which appears to have been sent by one of your "
. "customers, or sent through a server on your network. "
. "Please review the message, and - if it indeed "
. "came from your network - take the appropriate "
. "action regarding this offense.\r\n\r\n";
if($lart_comment)
$blurb .= "Notes: $lart_comment\r\n\r\n";
$blurb .= "======= Begin Spam Copy =======";
$mailbody = "$blurb\r\n\r\n$mailbody\r\n\r\n";
$mailbody = wordwrap($mailbody);
#Build the headers
$mailsubj = "Abuse Report: $subject";
$senddate = date("d M y h:m:s -0600");
$headers = "From: $lartfrom\r\nReply-To: $lartfrom\r\nDate: "
. "$senddate\r\nReturn-Path: <$lartfrom>\r\n"
. "BCC: $lartfrom\r\n"
. "X-Mailer: anal/0.2 (http://shat.net/php/anal/)\r\n";
#Send the email
if(!(mail($larts_to, $mailsubj, $mailbody, $headers))){
echo "Error while sending email LARTs. ";
return "";
}
else{
echo "LARTs delivered via email. ";
$larts_to = str_replace(" ", "", $larts_to);
$larts_to = str_replace(",", ", ", $larts_to);
$larts_to = str_replace("@", " {at} ", $larts_to);
$larts_to = str_replace(".", "'", $larts_to);
$lart_info = "\n\nLARTs to: $larts_to\n\n";
$lart_info .= "$lart_comment\n\n";
$lart_info = wordwrap($lart_info);
return $lart_info;
}
}
echo <<ANAL - Auto NANAS And LART
EOT;
if($posted)
post_it();
echo <<