某站点安全漏洞分析与建议报告 - 网站安全

某站点安全漏洞分析与建议报告 - 网站安全 - 自

来源：自学PHP网时间：2015-04-15 15:00 作者：阅读:次

[导读] 前两天应上司的要求对公司某频道做了日志的分析备注：xxx代表某域名或某信息一、日志记录分析漏洞 1 ：文件上传漏洞危险等级：非常严重通过日志分析，发现黑客在 2014 年 2 月 22 日...

前两天应上司的要求对公司某频道做了日志的分析

备注：xxx代表某域名或某信息

一、日志记录分析

漏洞 1 ：文件上传漏洞危险等级：非常严重

通过日志分析，发现黑客在 2014 年 2 月 22 日用 http://xxx/css_edit/css.php （后来更改为 cssx.php ）文件上传漏洞，获取 webshell 权限，并且在服务器上植入木马程序。

黑客分别在 2014 年 2 月 27 日和 2014 年 3 月 3 日通过木马程序远程操作，植入恶意 “ 时时彩 templates_c/templates.php” 。

漏洞 2 ：数据库文件暴露危险等级：严重

http://xxx/configuration.php1205

http://xxx/configuration.php140304 等

运维人员不正确备份数据文件

下面具体日志记录

1.80.76.136 - - [22/Feb/2014:16:01:26 +0800] "GET /css_edit/css.php HTTP/1.1" 200 45841
1.80.76.136 - - [22/Feb/2014:16:01:43 +0800] "POST /css_edit/css.php HTTP/1.1" 200 45969
1.80.76.136 - - [22/Feb/2014:16:03:30 +0800] "POST /css_edit/css.php HTTP/1.1" 200 45943
1.80.76.136 - - [22/Feb/2014:16:06:43 +0800] "POST /css_edit/css.php HTTP/1.1" 200 45958
1.80.76.136 - - [22/Feb/2014:16:06:47 +0800] "GET /css_edit/css.php HTTP/1.1" 200 45841
1.80.76.136 - - [22/Feb/2014:16:09:41 +0800] "GET /css_edit/css.php HTTP/1.1" 404 214
1.80.76.136 - - [22/Feb/2014:19:17:11 +0800] "GET /css_edit/css-bak/css.php HTTP/1.1" 500 -
1.80.76.136 - - [22/Feb/2014:19:17:44 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 458
1.80.76.136 - - [22/Feb/2014:19:17:50 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 3463
222.90.106.49 - - [27/Feb/2014:19:55:17 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 3297
222.90.106.49 - - [27/Feb/2014:19:55:25 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 115
222.90.106.49 - - [27/Feb/2014:19:55:27 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 734
222.90.106.49 - - [27/Feb/2014:19:55:42 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 1370
222.90.106.49 - - [27/Feb/2014:19:55:54 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 4123
222.90.106.49 - - [27/Feb/2014:19:56:07 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 4187
222.90.106.49 - - [27/Feb/2014:19:56:15 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 996
222.90.106.49 - - [27/Feb/2014:19:56:17 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 1088
222.90.106.49 - - [27/Feb/2014:19:56:25 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 830
222.90.106.49 - - [27/Feb/2014:19:56:51 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 33488
222.90.106.49 - - [27/Feb/2014:19:57:11 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 226
222.90.106.49 - - [27/Feb/2014:19:57:12 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 73
222.90.106.49 - - [27/Feb/2014:19:57:17 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 273
222.90.106.49 - - [27/Feb/2014:19:57:20 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 73
1.86.179.21 - - [03/Mar/2014:13:26:43 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 47454
1.86.179.21 - - [03/Mar/2014:13:27:08 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 43
1.86.179.21 - - [03/Mar/2014:13:27:21 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 7
1.86.179.21 - - [03/Mar/2014:13:27:21 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 500 161
1.86.179.21 - - [03/Mar/2014:13:27:38 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 500 161
1.86.179.21 - - [03/Mar/2014:13:28:57 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 500 161
1.86.179.21 - - [03/Mar/2014:13:29:02 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 500 161
1.86.179.21 - - [03/Mar/2014:13:30:28 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 -
1.86.179.21 - - [03/Mar/2014:13:30:32 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 -
1.86.179.21 - - [03/Mar/2014:13:30:35 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 -
1.86.179.21 - - [03/Mar/2014:13:30:47 +0800] "POST /css_edit/css-bak/css.php?2=assert HTTP/1.1" 200 6

二、演示入侵点

入侵点： http://xxx/css_edit/cssx.php