{"id":388,"date":"2018-05-31T22:05:40","date_gmt":"2018-05-31T14:05:40","guid":{"rendered":"http:\/\/120.76.142.240\/?p=388"},"modified":"2018-05-31T22:05:40","modified_gmt":"2018-05-31T14:05:40","slug":"%e7%ba%bf%e4%b8%8b%e6%94%bb%e9%98%b2%e8%b5%9b%e6%80%bb%e7%bb%93","status":"publish","type":"post","link":"http:\/\/ssynas.top\/?p=388","title":{"rendered":"\u7ebf\u4e0b\u653b\u9632\u8d5b\u603b\u7ed3"},"content":{"rendered":"<h1><strong>\u524d\u8a00<\/strong><\/h1>\n<p>2018\u5e749\u670813\u65e5 \u66f4\u65b0\u4e00\u4e2a\u65b0\u7684\u603b\u7ed3\uff1ahttps:\/\/hackmd.io\/s\/Hypjn6D_X<\/p>\n<p>\u7b97\u4e0a\u8fd9\u6b21\u5df2\u7ecf\u6253\u4e86\u4e24\u6b21\u7ebf\u4e0b\u8d5b\u4e86\uff0c\u7b2c\u4e00\u6b21\u90a3\u4e2a\u6709\u70b9\u592a\u83dc\u3002\u8fd9\u6b21\u8fd8\u7b97\u662f\u51c6\u5907\u4e86\u4e1c\u897f\uff0c\u4f46\u8fd8\u662f\u7ecf\u9a8c\u4e0d\u8db3\u3002\u3002\u3002\u3002<\/p>\n<p>\u4e3b\u529e\u65b9\u4e3a\u4e86\u63d0\u793a\uff0c\u5411cms\u91cc\u52a0\u4e86shell\uff0c\u987a\u7740\u8fd9\u4e2ashell\u7c7b\u4f3c\u4e8epop\u94fe\u4e00\u6837\u5411\u4e0a\u5ba1\u8ba1\u5f88\u5bb9\u6613\u53d1\u73b0\u6f0f\u6d1e\uff0c\u53ef\u60dc\u6700\u540e\u4e00\u4e2a\u5c0f\u65f6\u624d\u770b\u51fa\u6765\u3002\u3002\u3002<\/p>\n<p>\u4e0a\u6b21\u6253\u7684\u65f6\u5019\u4e0a\u4e86\u4e2awaf\u7ed3\u679c\u88abcheck down\u4e86\uff0c\u4e8e\u662f\u8fd9\u6b21\u6ca1\u6562\u3002\u3002\u3002\u53ea\u7528\u4e86\u4e00\u4e2a\u5220\u9664\u65b0\u6587\u4ef6\u7684\u811a\u672c\u3002\u7ed3\u679c\u8fd8\u662f\u6709\u5e08\u5085\u80fd\u6253\u51fashell\u6765\uff0c\u8fd8\u662f\u4ee5\u524d\u6ca1\u89c1\u8fc7\u7684\u5185\u5b58\u9a6c\uff0c\u6da8\u59ff\u52bf\u4e86<\/p>\n<p><span style=\"display: inline !important; float: none; background-color: transparent; color: #333333; cursor: text; font-family: 'Fira Sans',sans-serif; font-size: 18px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;\">\u7b2c\u4e00\u540d\u7684\u5e08\u5085\u4eec\u5f00\u5c40\u4e94\u5206\u949f\u5c31\u6253\u4e86\u4e00\u6ce2\uff0c\u90a3\u4e2a\u65f6\u5019\u6211\u4eec\u8fd8\u5728\u627essh\u7684\u767b\u5f55\u5bc6\u7801\u3002\u3002\u3002<\/span>log\u4e5f\u6ca1\u51c6\u5907\u660e\u767d\uff0c\u603b\u4f53\u8fd8\u662f\u7f3a\u4e4f\u7ecf\u9a8c\u3002\u4e8e\u662f\u8fd9\u6b21\u603b\u7ed3\u4e00\u4e0b<\/p>\n<p>\u4e24\u4e2acms\uff1ahxcms\uff0cxsite\uff0c\u90fd\u662f\u5f88\u4e45\u6ca1\u66f4\u65b0\u4e86\uff0c\u662f\u5165\u95e8\u5ba1\u8ba1\u633a\u597d\u7684cms\uff0c\u7f51\u4e0a\u4e5f\u6709\u516c\u5f00\u7684\u6f0f\u6d1e<\/p>\n<hr \/>\n<h1><strong>\u9996\u5148<\/strong><\/h1>\n<p>\u5206\u5de5\u8981\u660e\u786e\uff0c\u4e00\u822c\u6765\u8bb2\u662f\u4e00\u4e2a\u4eba\u5b88\u4e24\u4e2a\u4eba\u653b\u3002<\/p>\n<p>\u9632\u5b88\u8981\u505a\u7684\u5305\u62ec\u4f46\u4e0d\u9650\u4e8e\uff1a\u9996\u5148\u5907\u4efd\u6e90\u7801\u3001\u4e0alog\u3001waf\u7b49\u524d\u671f\u5de5\u4f5c\u3001\u968f\u65f6\u89c2\u5bdf\u5206\u6570\u60c5\u51b5\u3001\u968f\u65f6\u95f2\u901b\u670d\u52a1\u5668\uff0c\u624b\u52a8\/\u5199\u811a\u672c\u6740shell\u3001\u653b\u51fb\u624b\u90a3\u8fb9\u6316\u51fa\u6d1e\u4e86\u5f97\u8d76\u7d27\u4fee\u8865\u3001\u6ca1\u601d\u8def\u4e86\u53ef\u4ee5\u9002\u5f53\u5173\u6389\u5220\u65b0\u6587\u4ef6\u7684waf\u8ba9\u4eba\u6765\u6253\uff0c\u88ab\u6253\u7684shell\u4e00\u822c\u90fd\u662f\u6279\u91cf\u6253\u8fdb\u6765\u7684\uff0c\u5bc6\u7801\u4e00\u822c\u90fd\u4e00\u6837\uff0c\u7136\u540e\u6279\u91cf\u8bbf\u95eewebshell\u4e5f\u80fd\u8e6d\u5230\u4e0d\u5c11\u5206\u3002<\/p>\n<p>\u653b\u51fb\u8981\u505a\u7684\u5c31\u662f\u5ba1\u8ba1\u6316\u6d1e\u5199\u811a\u672c\u6279\u91cf\u653b\u51fb\uff0c\u6316\u5230\u6d1e\u540e\u53ca\u65f6\u901a\u77e5\u9632\u5b88\u7684\u8001\u5f1f\u4fee\u590d\uff0c\u5982\u679c\u987a\u4fbf\u544a\u8bc9\u600e\u4e48\u4fee\u590d\u5f53\u7136\u662f\u6700\u597d\u7684\uff0c\u6bd4\u5982\u8bf4\u6ce8\u91ca\u54ea\u4e00\u884c\u4e4b\u7c7b\u7684\uff0c\u8d8a\u7b80\u5355\u7c97\u66b4\u8d8a\u597d\u3002\u6ca1\u601d\u8def\u4e86\u770b\u65e5\u5fd7\u6478\u522b\u4eba\u7684shell\u8e6d\u5206<\/p>\n<h3><strong>\u5185\u5b58\u6728\u9a6c\/\u4e0d\u6b7b\u9a6c\uff1a<\/strong><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-390\" src=\"http:\/\/120.76.142.240\/wp-content\/uploads\/2018\/05\/\u672a\u547d\u540d\u56fe\u7247.png\" alt=\"\" width=\"668\" height=\"291\" \/><span style=\"display: inline !important; float: none; background-color: transparent; color: #333333; font-family: 'Hiragino Sans GB','Microsoft YaHei','WenQuanYi Micro Hei',sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: 1px; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;\">\u8bfb\u53d6\u8fdc\u7a0b\u6587\u4ef6\u7684\u5185\u5bb9\u5199\u5165<\/span><code>$code<\/code><span style=\"display: inline !important; float: none; background-color: transparent; color: #333333; font-family: 'Hiragino Sans GB','Microsoft YaHei','WenQuanYi Micro Hei',sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: 1px; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;\">\u4e2d\u5f53\u4f5c\u5b57\u7b26\u4e32\uff0c\u8fdb\u5165\u6b7b\u5faa\u73af\uff0c\u6bcf\u6b21\u5faa\u73af\u540e\u7b49\u5f85\u4e94\u79d2\u7ee7\u7eed\u8fd0\u884c\u3002\u524d\u4e09\u884c\u662f\u6700\u5173\u952e\u7684\uff0c\u5220\u9664\u81ea\u8eab\uff0c\u4e0d\u5173\u95ed\u4e14\u4fdd\u6301\u8fdb\u7a0b\uff0c\u4e4b\u540e\u5c31\u53ef\u4ee5\u5b9e\u73b0\u6728\u9a6c\u7684\u529f\u80fd\u4e86\u3002<\/span><\/p>\n<p>\u6709\u51e0\u79cd\u65b9\u6cd5\u5e94\u5bf9\u8fd9\u79cd\u6728\u9a6c\uff1a<\/p>\n<p>1.ps auxww|grep shell.php \u627e\u5230pid\u540e\u6740\u6389\u8fdb\u7a0b\u5c31\u53ef\u4ee5\uff0c\u5220\u6389\u811a\u672c\u662f\u8d77\u4e0d\u4e86\u4f5c\u7528\u7684\uff0c\u56e0\u4e3aphp\u6267\u884c\u7684\u65f6\u5019\u5df2\u7ecf\u628a\u811a\u672c\u8bfb\u8fdb\u53bb\u89e3\u91ca\u6210opcode\u8fd0\u884c\u4e86<\/p>\n<p>2.\u91cd\u542fphp\u7b49web\u670d\u52a1<\/p>\n<p>3.\u7528\u4e00\u4e2aignore_user_abort(true)\u811a\u672c\uff0c\u4e00\u76f4\u7ade\u4e89\u5199\u5165\uff08\u65ad\u65ad\u7eed\u7eed\uff09\u3002usleep\u8981\u4f4e\u4e8e\u5bf9\u65b9\u4e0d\u6b7b\u9a6c\u8bbe\u7f6e\u7684\u503c\u3002<\/p>\n<p>4.\u521b\u5efa\u4e00\u4e2a\u548c\u4e0d\u6b7b\u9a6c\u751f\u6210\u7684\u9a6c\u4e00\u6837\u540d\u5b57\u7684\u6587\u4ef6\u5939\u3002<\/p>\n<p>\u8fd8\u6709\u4e00\u4e9b\u6076\u5fc3\u7684php\u6728\u9a6c\u5728\u8fd9\u91cc\u5c31\u4e0d\u5c55\u5f00\u4e86<\/p>\n<h1><strong>log<\/strong><\/h1>\n<p>\u8bb0\u5f55\u4efb\u4f55\u8bbf\u95ee\uff0c\u901a\u8fc7\u65e5\u5fd7\u76f4\u63a5\u5c31\u80fd\u7528\u522b\u4eba\u7684payload\u53bb\u6253\u5176\u4ed6\u4eba<\/p>\n<p>\u9644\u4e00\u4e2alog\uff1ahttps:\/\/github.com\/wupco\/weblogger<\/p>\n<h1><strong>\u6709\u51e0\u70b9\u9700\u8981\u6ce8\u610f<\/strong><\/h1>\n<p><span style=\"display: inline !important; float: none; background-color: transparent; color: #333333; cursor: text; font-family: 'Fira Sans',sans-serif; font-size: 18px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;\">waf\u5f88\u5bb9\u6613\u5c31\u88abcheck down\uff0c\u6240\u4ee5\u8981\u683c\u5916\u5c0f\u5fc3\u3002\u4f46\u662f\u4e5f\u8981\u6709\u6700\u57fa\u672c\u7684\u9632\u5fa1\u80fd\u529b\uff1a<\/span><\/p>\n<p>1\u3001\u81ea\u52a8\u5220\u9664\u65b0\u589e\u6587\u4ef6\u3001\u5168\u5c40\u65e5\u5fd7<\/p>\n<p>2\u3001D\u76fe\/\u5b89\u5168\u72d7\u3002\u5b9e\u5728\u4e0d\u884c\u76f4\u63a5\u628a\u6e90\u7801\u4e0b\u8f7d\u5230\u672c\u5730\u67e5\u6740<\/p>\n<p>3\u3001\u73b0\u573a\u5ba1\u8ba1\u4e00\u822c\u662f\u6765\u4e0d\u53ca\u7684 \uff0c\u7528seay\u53bb\u626b\u3002\u5982\u679c\u80fd\u77e5\u9053\u662f\u4ec0\u4e48cms\u76f4\u63a5\u53bb\u641c\u6f0f\u6d1e\u5c31\u884c\uff0c\u4e00\u822c\u6765\u8bb2\u4f38\u51fa\u6765\u7684\u53ef\u80fd\u6027\u4e0d\u5927\uff0c\u4e3b\u8981\u770b\u7684\u662f\u5bf9\u6f0f\u6d1e\u7684\u5feb\u901f\u53cd\u5e94\u80fd\u529b\u3002\u5b9e\u5728\u4e0d\u884c\u6839\u636eseay\u7684\u7ed3\u679c\u53bb\u5ba1\u8ba1\u6548\u7387\u4f1a\u9ad8\u5f88\u591a<\/p>\n<p>4\u3001\u4e00\u5f00\u59cb\u5c31\u628a\u6700\u521d\u7684\u6e90\u7801\u5907\u597d\u4efd\uff0c\u5982\u679c\u771f\u7684check down\u4e5f\u597d\u8fd8\u539f<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u524d\u8a00 2018\u5e749\u670813\u65e5 \u66f4\u65b0\u4e00\u4e2a\u65b0\u7684\u603b\u7ed3\uff1ahttps:\/\/ha&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-388","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/posts\/388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=388"}],"version-history":[{"count":0,"href":"http:\/\/ssynas.top\/index.php?rest_route=\/wp\/v2\/posts\/388\/revisions"}],"wp:attachment":[{"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=388"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ssynas.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}