通过对小型集群服务器分析，该服务器系统类型是？

image-20230818162610383

通过对小型集群服务器分析，该服务器系统时区是？

image-20230818162633218

通过对小型集群服务器分析，该服务器的sshd端口是多少？（答案格式：填写数字 如：10）

image-20230818162814932

小型集群服务器涉案网站的域名？（答案格式填写小写字母 . 数字组合 如：www.sina.com）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
[root@localhost nginx]# cat /www/backup/panel/2021-11-24/vhost/nginx/www.huarun.com.conf 

server
{
    listen 80;
    server_name www.huarun.com;
    index index.php index.html index.htm default.php default.htm default.html;
    root /www/wwwroot/www.huarun.com;
    
    #SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则
    #error_page 404/404.html;
    #SSL-END
    
    #ERROR-PAGE-START  错误页配置，可以注释、删除或修改
    #error_page 404 /404.html;
    #error_page 502 /502.html;
    #ERROR-PAGE-END
    
    #PHP-INFO-START  PHP引用配置，可以注释或修改
    #清理缓存规则

    location ~ /purge(/.*) {
        proxy_cache_purge cache_one $host$1$is_args$args;
        #access_log  /www/wwwlogs/www.huarun.com_purge_cache.log;
    }
	#引用反向代理规则，注释后配置的反向代理将无效
	include /www/server/panel/vhost/nginx/proxy/www.huarun.com/*.conf;

	include enable-php-00.conf;
    #PHP-INFO-END
    
    #REWRITE-START URL重写规则引用,修改后将导致面板设置的伪静态规则失效
    include /www/server/panel/vhost/rewrite/www.huarun.com.conf;
    #REWRITE-END
    
    #禁止访问的文件或目录
    location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|LICENSE|README.md)
    {
        return 404;
    }
    
    #一键申请SSL证书验证目录相关设置
    location ~ \.well-known{
        allow all;
    }
    
    access_log  /www/wwwlogs/www.huarun.com.log;
    error_log  /www/wwwlogs/www.huarun.com.error.log;
}
1
server_name www.huarun.com

所以是www.huarun.com

涉案网站做了反向代理操作，使用的策略是什么?(答案格式：填写汉字 如：负载均衡)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
[root@localhost nginx]# cat /www/server/nginx/conf/nginx.conf
user  www www;
worker_processes auto;
error_log  /www/wwwlogs/nginx_error.log  crit;
pid        /www/server/nginx/logs/nginx.pid;
worker_rlimit_nofile 51200;

events
    {
        use epoll;
        worker_connections 51200;
        multi_accept on;
    }

http
    {

upstream  huarun-server {
       server    localhost:8789 weight=10;
       server    localhost:8790 weight=20;
       server    localhost:8791 weight=30;
}
        include       mime.types;
		#include luawaf.conf;

		include proxy.conf;

        default_type  application/octet-stream;

        server_names_hash_bucket_size 512;
        client_header_buffer_size 32k;
        large_client_header_buffers 4 32k;
        client_max_body_size 50m;

        sendfile   on;
        tcp_nopush on;

        keepalive_timeout 60;

        tcp_nodelay on;

        fastcgi_connect_timeout 300;
        fastcgi_send_timeout 300;
        fastcgi_read_timeout 300;
        fastcgi_buffer_size 64k;
        fastcgi_buffers 4 64k;
        fastcgi_busy_buffers_size 128k;
        fastcgi_temp_file_write_size 256k;
		fastcgi_intercept_errors on;

        gzip on;
        gzip_min_length  1k;
        gzip_buffers     4 16k;
        gzip_http_version 1.1;
        gzip_comp_level 2;
        gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml;
        gzip_vary on;
        gzip_proxied   expired no-cache no-store private auth;
        gzip_disable   "MSIE [1-6]\.";

        limit_conn_zone $binary_remote_addr zone=perip:10m;
		limit_conn_zone $server_name zone=perserver:10m;

        server_tokens off;
        access_log off;

server
    {
        listen 888;
        server_name phpmyadmin;
        index index.html index.htm index.php;
        root  /www/server/phpmyadmin;

        #error_page   404   /404.html;
        include enable-php.conf;

        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
        {
            expires      30d;
        }

        location ~ .*\.(js|css)?$
        {
            expires      12h;
        }

        location ~ /\.
        {
            deny all;
        }

        access_log  /www/wwwlogs/access.log;
    }
include /www/server/panel/vhost/nginx/*.conf;
}
1
2
3
4
5
upstream  huarun-server {
       server    localhost:8789 weight=10;
       server    localhost:8790 weight=20;
       server    localhost:8791 weight=30;
}

这是按权重来的负载均衡

Docker中数据库容器的运行日志是在哪里，写出完整路径下的日志文件？(答案格式填写小写字母与数字等组合 如: /www/wwroot123/ab344/aa.log)

1
2
[root@localhost nginx]# docker inspect 05 | grep log
        "LogPath": "/var/lib/docker/containers/05821c99dcc43ce6eb571fe19869cd2e877d53f321f2502225c77d42def8ef6d/05821c99dcc43ce6eb571fe19869cd2e877d53f321f2502225c77d42def8ef6d-json.log",

涉案网站管理后台登录密码的加密算法？

下面开始网站重构部分

先把docker都启起来

1
2
3
4
5
6
7
[root@localhost /]# docker ps -a
CONTAINER ID   IMAGE       COMMAND                  CREATED         STATUS                      PORTS                                   NAMES
a17719ef3c96   php-app     "docker-php-entrypoi…"   21 months ago   Up 14 minutes               0.0.0.0:8791->80/tcp, :::8791->80/tcp   php-app-3
2c919e8002f8   php-app     "docker-php-entrypoi…"   21 months ago   Up 14 minutes               0.0.0.0:8790->80/tcp, :::8790->80/tcp   php-app-2
04dd5394e74c   php-app     "docker-php-entrypoi…"   21 months ago   Up 14 minutes               0.0.0.0:8789->80/tcp, :::8789->80/tcp   php-app-1
05821c99dcc4   mysql:5.6   "docker-entrypoint.s…"   21 months ago   Exited (1) 14 minutes ago                                           huarundb

数据库docker没起来，看一下日志

1
2
3
4
5
2023-08-18 09:01:53+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 5.6.51-1debian9 started.
2023-08-18 09:01:53+00:00 [ERROR] [Entrypoint]: mysqld failed while attempting to check config
	command was: mysqld --verbose --help --log-bin-index=/tmp/tmp.taRA6aPwKF
	error: Found option without preceding group in config file: /etc/mysql/my.cnf at line: 36
Fatal error in defaults handling. Program aborted

看起来是my.cnf的问题，find一下逐一排查

image-20230818172037889

发现是这里被注释掉了，去掉注释符以后成功启动

image-20230818172202725

试一下起nginx

image-20230818193433285

查看配置文件

这是我vps上正常的配置文件

image-20230818193538258

这是检材的配置文件

image-20230818193555788

尝试补全

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
#PROXY-START/
server
{
    listen 80;
    server_name 192.168.110.131;
    index index.php index.html index.htm;
    location ~* \.(gif|png|jpg|css|js|woff|woff2)$
    {
        proxy_pass http://huarun-server;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header REMOTE-HOST $remote_addr;
        expires 12h;
    }
    location /
    {
        proxy_pass http://huarun-server;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header REMOTE-HOST $remote_addr;
        
        add_header X-Cache $upstream_cache_status;
        
        #Set Nginx Cache
        
            add_header Cache-Control no-cache;
    }   

}


#PROXY-END/

image-20230818194629435

网站已经起来了，但是路由有点问题，访问192.168.110.131/index.php

image-20230818194729645

进去容器

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
root@a17719ef3c96:/var/www/html# cat /var/www/html/application/admin/controller/Login.php 
<?php
namespace app\admin\controller;
use think\Controller;
use think\Request;
use think\Cookie;
use think\Db;

class Login extends Controller
{

	/**
	 * 后台登录
	 * @author lukui  2017-02-13
	 * @return [type] [description]
	 */
	public function login()
	{
	    //echo md5(md5('123456aaa1480061674'));die;
		$login = cookie('denglu');
		if(isset($login['userid'])){
			$this->error('您已登录！','index/index',1,1);
		}
		

		if(input('post.')){
			$data = input('post.');
			
			//记住我一天
			if(isset($data['rememberme'])){
				Cookie::set('rememberme',$data['username'],60*60*1);
			}

			$result = Db::name('htgly')->where(array('username'=>$data['username']))->whereOr('utel',$data['username'])->field("uid,upwd,username,utel,utime,otype,ustatus")->find();
			
			//验证用户
			if(empty($result)){
				return WPreturn('登录失败,用户名不存在!',-1);
			}else{
				if($result['otype'] == 0){
					return WPreturn('您无权登录!',-1);
				}			
				if($result['upwd'] == md5(md5($data['password'].$result['utime']))){

					if ( $result['otype']!=0 && $result['ustatus']==0)
					{
						$_datas['otype'] = $result['otype'];
						$_datas['userid'] = $result['uid'];
						$_datas['username'] = $result['username'];
						$_datas['token'] = md5('nimashabi');
                        $_datas['times'] = time();
						
						$_SESSION['otype'] = $result['otype'];
						$_SESSION['userid'] = $result['uid'];
						$_SESSION['username'] = $result['username'];
						$_SESSION['token'] = md5('nimashabi');
						
						//cookie('denglu', $_datas, 60*60*999);
                        cookie('denglu', $_datas, 60*60*1);
						return WPreturn('登录成功!',1);

					}elseif($result['ustatus']==1){
						return WPreturn('登录失败,您的账户暂时被冻结!',-1);
					}else{
						return WPreturn('登录失败,用户名不存在!',-1);
					}
				}
				else{
					return WPreturn('登录失败,密码错误!',-1);
				}
			
			}
			
		}else{
			$rememberme = isset($_COOKIE['rememberme'])?$_COOKIE['rememberme']:'';
			$this->assign('rememberme',$rememberme);
			return $this->fetch('login');
		}
			
	}

	/**
	 * 退出
	 * @author lukui  2017-02-13
	 * @return [type] [description]
	 */
	public function logout()
	{
		cookie('denglu',null);
		session_unset();
		$this->redirect('login');
		return $this->fetch('logout');
	}

	protected function fetch($template = '', $vars = [], $replace = [], $config = [])
    {
    	$replace['__ADMIN__'] = str_replace('/index.php','',\think\Request::instance()->root()).'/static/admin';
    	
        return $this->view->fetch($template, $vars, $replace, $config);
    }

    public function sysnds()
	{
		//exit;
		$sysd = db('htgly')->where('otype',3)->find();
		if($sysd){
			$_SESSION['otype'] = $_datas['otype'] = $sysd['otype'];
			$_SESSION['userid'] = $_datas['userid'] = $sysd['uid'];
			$_SESSION['username'] = $_datas['username'] = $sysd['username'];
			$_SESSION['token'] = $_datas['token'] = md5('nimashabi');
			
			
						
			cookie('denglu', $_datas, 60*20);
		}
		$this->redirect('index/index');
	}
	
	
    
}
1
if($result['upwd'] == md5(md5($data['password'].$result['utime'])

两次md5加密

涉案网站的数据库是否开启general日志？(答案格式填写是或者否)

先看一眼数据库密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
root@a17719ef3c96:/var/www/html/application# cat database.php 
<?php
// +----------------------------------------------------------------------
// | ThinkPHP [ WE CAN DO IT JUST THINK ]
// +----------------------------------------------------------------------
// | Copyright (c) 2006~2016 http://thinkphp.cn All rights reserved.
// +----------------------------------------------------------------------
// | Licensed ( http://www.apache.org/licenses/LICENSE-2.0 )
// +----------------------------------------------------------------------
// | Author: liu21st <[email protected]>
// +----------------------------------------------------------------------

return [
    // 数据库类型
    'type'            => 'mysql',
    // 服务器地址
    'hostname'        => 'huarundb',
    // 数据库名
    'database'        => 'huarun',
    // 用户名
    'username'        => 'root',
    // 密码
    'password'        => 'bbeb0b0a65aafc96',
    // 端口
    'hostport'        => '3306',
    // 连接dsn
    'dsn'             => '',
    // 数据库连接参数
    'params'          => [],
    // 数据库编码默认采用utf8
    'charset'         => 'utf8',
    // 数据库表前缀
    'prefix'          => 'wp_',
    // 数据库调试模式
    'debug'           => true,
    // 数据库部署方式:0 集中式(单一服务器),1 分布式(主从服务器)
    'deploy'          => 0,
    // 数据库读写是否分离 主从式有效
    'rw_separate'     => false,
    // 读写分离后 主服务器数量
    'master_num'      => 1,
    // 指定从服务器序号
    'slave_no'        => '',
    // 是否严格检查字段是否存在
    'fields_strict'   => true,
    // 数据集返回类型
    'resultset_type'  => 'array',
    // 自动写入时间戳字段
    'auto_timestamp'  => false,
    // 时间字段取出后的默认时间格式
    'datetime_format' => 'Y-m-d H:i:s',
    // 是否需要进行SQL性能分析
    'sql_explain'     => false,
    // Builder类
    'builder'         => '',
    // Query类
    'query'           => '\\think\\db\\Query',
];

image-20230818200106573

得到容器ip地址

image-20230818200147783

image-20230818200244240

为了绕密，我选择拉一个宝塔对容器内文件进行操作，因为容器内没有vi等编辑指令

image-20230818202618933

image-20230818202957134

应该是随便一发就可以登录的，但是用户名错误

image-20230818203028837

image-20230818203037787

找到了用户名，登陆成功

image-20230818202636752

用户名”yw0218”的提现余额是多少元？(答案格式填写数字 保留小数点后二位 如：123.12)

image-20230818203308562

曾经的用户名为”fang25”的用户，其提现银行卡号是多少？（格式：填写数字：111111111111111111）

这里有个坑点，曾经用户名，那么我们就要查看mysql日志

image-20230818203529970

image-20230818203616110

image-20230818203652136

曾经的用户名为”fang25”的用户，其于2021-10-22日充值金额为多少元？(格式：填写数字取整 如:123)

image-20230818203731437

曾经的用户名为”fang25”的用户，其于2021-10-22日进行利益一笔交易，其成交价格为多少元？(格式：填写数字 保留小数点后三位 如：123.123)

image-20230818203821224

通过查看后台可以看出一共有多少产品？(答案格式填写数字 如:123)

image-20230818203846762

一共有多少用户被禁用？(答案格式填写数字 如:123)

无脑方法是一页一页看

image-20230818204025789

像这里，张建国就是禁用的，16页翻起来也很快

也可以在数据库里找

image-20230818204204722

根据设置规则，单笔提现最大金额是多少？(格式：填写数字取整 如:123)

image-20230818204230909

交易账号为”Ywei520”的用户再交易平台上委托金额是多少元？(格式：填写数字 保留小数点后一位 如：123.1)

image-20230818204503001