ZR-Tools - 0day zip-cleaner, ban-script

[WarC]

todiloo,


so its finally released to the public. This is some small utils requested by Zer0Racer and is specially designed for him but some others might like them as well.

enjoy
/WarC

ZR-Tools v3.x Features

ZR-Clean Features
+ Clean within zip-files when uploading to ioFTPD.
+ Can be run manually as util in cmd or as script inside ioFTPD.
+ Clean zips and dirs recursively when run manually.
+ Removes comments from zipfiles.
+ Logs names and paths of all new (unknown) nfo-files.
+ Logs names and paths of all removed nfo-files.
+ Exclude paths where ZR-Clean should not be active.
+ Includes Zer0Racers lists with banned and accepted nfo-files.

ZR-Ban Features
+ Ban dirs and files from being uploaded in ioFTPD.
+ Section specific. Add your own sections to ZR-Tools.cfg.
+ Ability to use multiple ban-lists.
+ Exclude paths where ZR-Ban should not be active.

ZR-2F
+ Converts ZR-Tools ban-list to FlashFXP skiplist format.
+ Usage: ZR-2F.exe <ban-list> <skiplist name>
Skiplist name should be SKIPLIST.DAT


EDIT by Zer0Racer: Merged ZR-Tools 1.x 2.x and 3.x threads. Here is link to post about ZR-Tools v3.x, http://www.ioftpd.com/board/showthre...1786#post11786

[Zer0Racer]

Yes it's very good isn't it? I've been waiting for an app like this for a long time.

Another very nice feature is logging of unknown nfo-files. It logs filename and vfs path to the zipfile which contains that unknown file. This makes it very easy to spot new crappy nfos. And also easy to know which ones to add to the accepted list. The lists of unwanted and accepted (nfo)filenames that I have put together are left as they are. It's up to you to add new entries when needed.

ZR-Clean.exe can also be executed from cmd line for cleaning your already existing 0day-archive recursively.

Read the manual included for further info.

WarC rules.

/Zer0Racer

[Giant]

Very nice and usefull this one.

One little problem i do have.
Must be a user error but i'll ask for advice anyway.

I made a Test.zip with 5 nfos that is on the banned list.
Cleaning this one from cmd works just fine. Trying to upload the nfos is blocked.
So far so good.
But when uploading this Test.zip i only see this response:
226--[ZR-Clean]--------------------------
226-Processing ZipFile...
226--------------------------------------

And the nfos isnt removed.

From the cmd line it looks like:
-[ZR-Clean]--------------------------
Processing ZipFile...
deleting: af.nfo
deleting: trope.nfo
deleting: bps-0wnz.nfo
deleting: HAPPY-BDAY.jpg
deleting: hol.nfo
-------------------------------------


Ideas and hints would be nice.
Using windows Xp with sp1.
ioFTPD the regged version
ioZS v1.02
ioA 0.7.4

[Zer0Racer]

Ah you're right Giant. We forgot to mention that ComSpec has to be added to ioftpd.env in ioFTPD/etc dir in order to get it to work as wanted.

Check your enviroment variables in windows to see which ComSpec-path is used in your computer.

Example for win2k:
ComSpec=C:\WINNT\system32\cmd.exe

WinXP should be ComSpec=C:\WINDOWS\system32\cmd.exe or something like that.

It should work now

WarC has added the additional info to manual.

[phoenixfr]

remind me the good old CFA ZipClean
But on a server side
as always , good job and very nice util for 0-day lovers

sugestion:
maybe you could use the same principle as in ZipClean : when there's only one nfo and it is not in the accepted list just automatically add it to the allowed list. You can also auto add to the banned list when you know that an accepted nfo is already there but you don't know the other nfos.

NB: haven't used the app, but just read the manual and ini so maybe. I don't know if such a level of automation is good . so maybe there's an other way of asking user approval to add the nfos found in the banned and accepted list.

[Giant]

Jupp works sweet now.
Thanks for the fast reply with info

[Zer0Racer]

In answer to phoenixfr's suggestion, ZR-Tools was never intended to have that kind of AI. That level of automation would take too much time to develop and would not be worth it, and not very accurate.

The example from zipclean that phoenixfr mentioned will actually not work. Some 0day-releases with multiple zips often has the rel-nfo in only the first or last zip-file. In the case where rel-nfo is in last zip, unwanted nfos could be injected in the other zips. Then if that nfo is not present in either banned or accepted list, when first zip is uploaded, automation would then add it to accepted list. What a mess!

I downloaded zipclean to have a look at it and found that the included purge.txt contained multiple entries of one or two nfos, and I saw ucf2000.nfo in there which is nfo for 0day-group UCF. Zipclean's list is not alphabetically sorted either.

ZR-Tools logs nfos that are not present in either banned or accepted list. The log also shows exactly what file contains that unknown nfo. Only thing you have to do is check that log once in a while to see if anything new and suspicous had turned up. Any half-good siteop keeps these lists up-to-date.

ZR-Tools is working exactly as I wanted it to from the start. Of course I have more ideas on how to develop it even further, but I'm very grateful and happy for how ZR-Tools is working right now. But who knows, maybe it will updated some time in the future, if WarC feels it is worth it.

When my banned and accepted lists have grown for some time I will probably attach them here. If anyone of you out there has a load of unwanted nfo-filenames that are still appearing here and there these days, feel free to update the ZR-Tools cfgs (alphabetically plz) and post them here. Suggestions are welcome even though there is no planned new version of the util.

Please let WarC know what wonderful work he has done!

[iXi]

moin,
thx WarC for this realy nice util

I've got little ioa request on nuke a dir can add some stuff that users thay are currently uploading / leeching the release will be kicked so that the rename on nuke works... all the time?

thx cya

[WarC]

1. I updated ZR-Tools. Its bugfix that affects in rare occasions.

NOTE!!! in the default config files there is a rule ".io*"
remove that ASAP! or it will remove all permissionfiles.


2. pRoLuCkY that will work when new io comes out. dark0ne disabled the function to kick some versions back but it is back in next one.


/WarC

[DR. GiGa BYTe]

Hi,

i still have the same problem as Giant had... although i added the comspec variable...

i use Windows 2003 Server
ioFTPd v4.6.2
ioA v0.7.4
ioZS v1.02
ZR-Tools v1.3

any ideas how i can solve this problem?

thanx
dr.gb

[Zer0Racer]

Changes to ioftpd.env requires restart (of ioFTPD). And make sure you've entered the correct ComSpec path. To find out which path you got simply open cmd.exe in windows (Start.. Run.. cmd) and type set and press enter.

[DR. GiGa BYTe]

Hi,

finally i found the problem... i'am using spaces in my "real" and my virtual file system.
because of the spaces in the file system the exe does not find the target file (the spaces in the vfs doesn't matter).

may it be possible to fix this? so i have not to re-organize my directory structure.


thanx
DR.GB

this is a sample of my vfs

"F:\Root"								/
"E:\Root\11                      GAMEz\15                GAME STUFF"	/11                      GAMEz/15                GAME STUFF
"G:\Root\12                      M0ViEz"				/12                      M0ViEz
"E:\Root\15MiSC"							/15                        MiSC
"H:\Root\21                     UPL0ADz"				/21                     UPL0ADz
"H:\Root\17                   REQUESTz"					/17                   REQUESTz

[WarC]

thats the absolutly funkiest dirnames I've ever seen but that is your choice

I'll check on it as soon as I get the time. Not a really high prio though atm

/WarC

[WarC]

1.4 is up. Should hopefully take care of this matter for you.

/WarC

[DR. GiGa BYTe]

Great!!!

Thanx 4 the fast help!

cya
DR.GB