全球主机交流论坛

标题: 应该是找到问题了 吗的 php文件挂马了 [打印本页]
作者: Chen    时间: 2023-7-20 21:06
标题: 应该是找到问题了 吗的 php文件挂马了
  1. 180.101.245.247 - - [20/Jul/2023:19:59:08 +0800] "GET /tag/burst HTTP/1.1" 200 7860 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36"
  2. 180.101.245.247 - - [20/Jul/2023:19:59:08 +0800] "GET /wp-content/themes/69rmb/font/josefinsans-regular-webfont.woff HTTP/1.1" 200 24176 "http://www.1.com/wp-content/themes/69rmb/style.css" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36"
  3. 180.101.244.14 - - [20/Jul/2023:19:59:08 +0800] "GET /wp-content/themes/69rmb/functions/timthumb.php?src=http://www.1.com/img/1_2012.03.30_15h26m32s_022_.png&h=112&w=112&zc=1 HTTP/1.1" 200 11798 "http://www.1com/tag/burst" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36"
  4. 180.101.245.248 - - [20/Jul/2023:19:59:09 +0800] "GET /wp-content/themes/69rmb/highslide/graphics/zoomout.cur HTTP/1.1" 200 4286 "http://www.1.com/tag/burst" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36"
  5. 180.101.245.250 - - [20/Jul/2023:19:59:53 +0800] "GET /about/comment-page-2 HTTP/1.1" 200 9751 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)"
  6. 220.196.160.76 - - [20/Jul/2023:19:59:54 +0800] "GET /about/comment-page-2 HTTP/1.1" 200 9750 "-" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)"
  7. 220.196.160.95 - - [20/Jul/2023:19:59:55 +0800] "GET /wp-content/themes/69rmb/font/josefinsans-regular-webfont.woff HTTP/1.1" 200 24176 "http://www.1.com/wp-content/themes/69rmb/style.css" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)"
  8. 177.55.118.104 - - [20/Jul/2023:20:00:17 +0800] "POST /xmlrpc.php HTTP/1.1" 503 18942 "-" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/95.0"
  9. 110.54.163.122 - - [20/Jul/2023:20:00:32 +0800] "GET / HTTP/2.0" 200 10170 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  10. 110.54.163.122 - - [20/Jul/2023:20:00:35 +0800] "GET /wp-content/themes/69rmb/functions/timthumb.php?src=https://www.1.com/img/2022/03/[email protected]&h=112&w=112&zc=1 HTTP/2.0" 200 12718 "https://www.1.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  11. 110.54.163.122 - - [20/Jul/2023:20:00:35 +0800] "GET /wp-content/themes/69rmb/functions/timthumb.php?src=https://www.1.com/img/2014/07/QQ%E6%88%AA%E5%9B%BE20140702213347.jpg&h=112&w=112&zc=1 HTTP/2.0" 200 5155 "https://www.1.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  12. 110.54.163.122 - - [20/Jul/2023:20:00:35 +0800] "GET /wp-content/themes/69rmb/functions/timthumb.php?src=https://www.1.com/img/2015/07/IMG_7748.jpg&h=112&w=112&zc=1 HTTP/2.0" 200 4794 "https://www.1.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  13. 110.54.163.122 - - [20/Jul/2023:20:00:35 +0800] "GET /wp-content/themes/69rmb/functions/timthumb.php?src=https://www.1.com/img/2022/02/QQ%E6%88%AA%E5%9B%BE20220218010250.png&h=112&w=112&zc=1 HTTP/2.0" 200 4999 "https://www.1.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  14. 110.54.163.122 - - [20/Jul/2023:20:00:38 +0800] "GET /favicon.ico HTTP/2.0" 200 4286 "https://www.1.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  15. 110.54.163.122 - - [20/Jul/2023:20:00:39 +0800] "GET /wp-content/themes/69rmb/font/josefinsans-regular-webfont.woff HTTP/2.0" 200 24176 "https://www.1.com/wp-content/themes/69rmb/style.css" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  16. 110.54.163.122 - - [20/Jul/2023:20:00:39 +0800] "GET /wp-content/themes/69rmb/highslide/graphics/zoomout.cur HTTP/2.0" 200 4286 "https://www.1.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  17. 110.54.163.122 - - [20/Jul/2023:20:00:39 +0800] "GET /wp-content/themes/69rmb/favicon.ico HTTP/2.0" 200 4286 "https://www.1.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  18. 110.54.163.122 - - [20/Jul/2023:20:00:46 +0800] "GET /wp-content/themes/lolimeow/component/index.php HTTP/2.0" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  19. 110.54.163.122 - - [20/Jul/2023:20:00:51 +0800] "GET /wp-content/upgrade/daterangepicker.php HTTP/2.0" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  20. 110.54.163.122 - - [20/Jul/2023:20:00:56 +0800] "GET /wp-admin/css/colors/coffee/css.php HTTP/2.0" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  21. 110.54.163.122 - - [20/Jul/2023:20:01:01 +0800] "GET /img/2013/04/Awesome.php HTTP/2.0" 200 833 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  22. 110.54.163.122 - - [20/Jul/2023:20:01:07 +0800] "POST /img/2013/04/Awesome.php HTTP/2.0" 200 3701 "https://www.1.com/img/2013/04/Awesome.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  23. 110.54.163.122 - - [20/Jul/2023:20:01:13 +0800] "POST /img/2013/04/Awesome.php HTTP/2.0" 200 4495 "https://www.1.com/img/2013/04/Awesome.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  24. 110.54.163.122 - - [20/Jul/2023:20:01:38 +0800] "POST /img/2013/04/Awesome.php HTTP/2.0" 200 4538 "https://www.1.com/img/2013/04/Awesome.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  25. 110.54.163.122 - - [20/Jul/2023:20:01:41 +0800] "GET / HTTP/2.0" 200 9426 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"
  26. 64.124.8.49 - - [20/Jul/2023:20:02:18 +0800] "GET /chrome-15-official-release.html HTTP/1.1" 200 9439 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36"
  27. 220.196.160.101 - - [20/Jul/2023:20:02:54 +0800] "GET /1676.html%E7%9C%8B%E5%88%B0%E8%BF%99%E5%88%99%E7%95%99%E8%A8%80%E7%9A%84%E8%AF%9D%E4%BD%A0%E7%BB%99%E4%B8%AA%E5%9B%9E%E5%BA%94%E5%90%A7%E3%80%82 HTTP/1.1" 200 9439 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Mobile/15E148 Safari/604.1"
  28. 220.196.160.96 - - [20/Jul/2023:20:02:54 +0800] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03\xAF\xE5\xD8\xFA\x01\x07U@\x19\x81\xA7D^\xD9\xDA\xFB" 400 150 "-" "-"
  29. 220.196.160.76 - - [20/Jul/2023:20:02:54 +0800] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03\xB1J\x060\x01\xF7A\xCFy\xAC\x97\x11le7\xE8\xA2\xCD\x97A0\xB4\x84\x22\xEC[t:\xFF^\xECe \xF79/p:\x95\xF0Nw(}\xDE)\x7F\x18S\xEE=\x13\xFC\x95\xA4\x9BL'\x88BT\x95!\x9E\x5C\x00 \x1A\x1A\x13\x01\x13\x02\x13\x03\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x13\xC0\x14\x00\x9C\x00\x9D\x00/\x005\x01\x00\x01\x93\xFA\xFA\x00\x00\x00\x00\x00\x14\x00\x12\x00\x00\x0Fwww.1.com\x00\x17\x00\x00\xFF\x01\x00\x01\x00\x00" 400 150 "-" "-"
  30. 220.196.160.45 - - [20/Jul/2023:20:02:54 +0800] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03\x8BA\xD4\x9C\xF8\xA4s\xC2\x1F\xE1\xEC\xAA\xD5D(\xF4LK\xCF\xB9\x07O\xFD\xB4-\x8BO\xE7L\xE5\xD6\xDE `\x03\xC0\x831\x8F\xF6\xD3\xB6\x14md\xF6\x00\x89\x1A_\x06\xAC\xA7\xFFd=6\x17\xFB\x86\xA5\xCD0\x84i\x00 jj\x13\x01\x13\x02\x13\x03\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x13\xC0\x14\x00\x9C\x00\x9D\x00/\x005\x01\x00\x01\x93\x8A\x8A\x00\x00\x00\x00\x00\x14\x00\x12\x00\x00\x0Fwww.1.com\x00\x17\x00\x00\xFF\x01\x00\x01\x00\x00" 400 150 "-" "-"
  31. 220.196.160.73 - - [20/Jul/2023:20:02:54 +0800] "\x16\x03\x01\x02\x00\x01\x00\x01\xFC\x03\x03*8\xCD\xEC\x92xQsu\x12,\xB0R\x13$\xE6X\x93\xE1\x02Hr\xDD\x9B]\x16\xAC\x85\xC2eq\x8F \x12k\x90\x8D\xE7\xE5w\x5C\xF5z\xF4\x93\x90\xAA\xD0\xDEO\xE8\xED\xE1\xF5\xC1\xCDs~\xED:f\xD6's\x22\x00 \xBA\xBA\x13\x01\x13\x02\x13\x03\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x13\xC0\x14\x00\x9C\x00\x9D\x00/\x005\x01\x00\x01\x93\xAA\xAA\x00\x00\x00\x00\x00\x14\x00\x12\x00\x00\x0Fwww.1.com\x00\x17\x00\x00\xFF\x01\x00\x01\x00\x00" 400 150 "-" "-"
  32. 220.196.160.84 - - [20/Jul/2023:20:02:54 +0800]

复制代码










作者: Chen    时间: 2023-7-20 21:09
Awesome.php 这个文件被挂的马 这我给删了 明天再看看








作者: BackDoor    时间: 2023-7-20 21:22
提示: 作者被禁止或删除 内容自动屏蔽
作者: Chen    时间: 2023-7-20 21:28
BackDoor 发表于 2023-7-20 21:22
怎么会有php文件 到你的img目录，说明有上传文件的漏洞，可能是主题漏洞，说明还有后门。他会继续上传php文 ...

再看看 先把那个给删了 我看看明天怎么样












欢迎光临 全球主机交流论坛 (https://443502.xyz/) Powered by Discuz! X3.4