Security researcher Amir Khashayar Mohammadi has released a new tool called Memfixed that can help victims of DDoS attacks carried out through Memcached servers.
The tool, written in Python, is coded around a mitigation technique suggested by a developer and verified by Corero. The technique it uses involves sending a “flush_all” command to a Memcached server attacking a victim’s network.
Mohammadi created Memfixed to automate the mitigation process. A victim can use Memfixed to send a “flush_all” command to each IP individually or to a group of multiple IPs.
The flush_all command clears the cached memory of a Memcached server, including the malware that is performing the DDoS attack. At the same time, it also supports sending the “shutdown” command, but it is not recommended to use it as it is dangerous because it practically shuts down another company’s server in order to prevent a DDoS attack and you may cause damage to its operations and infrastructure.
The most common application of this tool is to send the “flush_all” command to a list of multiple malicious servers. Before starting the Memfixed operation, you should create a list of IPs and save it in the same folder as the tool, in a file named server.txt. The list should contain one IP per line. The program initially displays various settings such as selecting one or multiple IPs, choosing to collect IPs from the Shodan site or from a .txt file on your disk. Depending on the case, the corresponding modifications are made.
You can download it from the link below:
https://github.com/649/Memfixed-Mitigation-Tool
