溯源linux查看脚本,针对此次安全事件的一个溯源追踪

Line 4546: 116.162.2.123 - - [23/Aug/2020:20:21:58 +0800] "GET /pma HTTP/1.1" 301 301

Line 4609: 116.162.2.123 - - [23/Aug/2020:20:22:01 +0800] "POST /pma/ajax.php HTTP/1.1" 200 1636

Line 4625: 116.162.2.123 - - [23/Aug/2020:20:22:02 +0800] "POST /pma/ajax.php HTTP/1.1" 200 153

Line 4635: 116.162.2.123 - - [23/Aug/2020:20:22:04 +0800] "GET /pma/server_databases.php?lang=zh_CN&ajax_request=true&ajax_page_request=true&_nocache=1598185617151301742&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 6974

Line 4647: 116.162.2.123 - - [23/Aug/2020:20:22:16 +0800] "GET /pma/db_structure.php?db=qf529261876&ajax_request=true&ajax_page_request=true&_nocache=1598185629063355548&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9625

Line 4653: 116.162.2.123 - - [23/Aug/2020:20:22:17 +0800] "GET /pma/navigation.php?ajax_request=1&lang=zh_CN&aPath=cm9vdA%3D%3D.cWY1MjkyNjE4NzY%3D&vPath=cm9vdA%3D%3D.cWY1MjkyNjE4NzY%3D&pos=0&pos2_name=&pos2_value=&searchClause=&searchClause2=&_nocache=1598185629999987513&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 2654

Line 4671: 116.162.2.123 - - [23/Aug/2020:20:22:21 +0800] "GET /pma/sql.php?db=qf529261876&table=shua_shequ&pos=0&ajax_request=true&ajax_page_request=true&_nocache=1598185633976880332&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 811

Line 4680: 116.162.2.123 - - [23/Aug/2020:20:22:22 +0800] "GET /pma/index.php?ajax_request=1&recent_table=1&no_debug=true&_nocache=1598185634811871850&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 1599

Line 4687: 116.162.2.123 - - [23/Aug/2020:20:22:50 +0800] "GET /pma/db_structure.php?db=qf529261876&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185662820268041&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9627

Line 4688: 116.162.2.123 - - [23/Aug/2020:20:22:51 +0800] "GET /pma/server_databases.php?db=&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185663730361942&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 6977

Line 4690: 116.162.2.123 - - [23/Aug/2020:20:22:53 +0800] "GET /pma/db_structure.php?db=qf1099&ajax_request=true&ajax_page_request=true&_nocache=1598185666016804661&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 48338

Line 4691: 116.162.2.123 - - [23/Aug/2020:20:22:55 +0800] "GET /pma/navigation.php?ajax_request=1&lang=zh_CN&aPath=cm9vdA%3D%3D.cWYxMDk5&vPath=cm9vdA%3D%3D.cWYxMDk5&pos=0&pos2_name=&pos2_value=&searchClause=&searchClause2=&_nocache=159818566748120702&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 3938

Line 4692: 116.162.2.123 - - [23/Aug/2020:20:22:57 +0800] "GET /pma/server_databases.php?db=&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185669412527903&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 6977

Line 4693: 116.162.2.123 - - [23/Aug/2020:20:22:59 +0800] "GET /pma/db_structure.php?db=qf1095&ajax_request=true&ajax_page_request=true&_nocache=1598185671730124437&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 5678

Line 4695: 116.162.2.123 - - [23/Aug/2020:20:23:00 +0800] "GET /pma/navigation.php?ajax_request=1&lang=zh_CN&aPath=cm9vdA%3D%3D.cWYxMDk1&vPath=cm9vdA%3D%3D.cWYxMDk1&pos=0&pos2_name=&pos2_value=&searchClause=&searchClause2=&_nocache=1598185672482192049&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 2011

Line 4698: 116.162.2.123 - - [23/Aug/2020:20:23:01 +0800] "GET /pma/server_databases.php?db=&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185673774234926&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 6977

Line 4699: 116.162.2.123 - - [23/Aug/2020:20:23:03 +0800] "GET /pma/db_structure.php?db=qf1094&ajax_request=true&ajax_page_request=true&_nocache=1598185675585584773&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 2976

Line 4700: 116.162.2.123 - - [23/Aug/2020:20:23:04 +0800] "GET /pma/navigation.php?ajax_request=1&lang=zh_CN&aPath=cm9vdA%3D%3D.cWYxMDk0&vPath=cm9vdA%3D%3D.cWYxMDk0&pos=0&pos2_name=&pos2_value=&searchClause=&searchClause2=&_nocache=1598185676327705919&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 1567

Line 4703: 116.162.2.123 - - [23/Aug/2020:20:23:05 +0800] "GET /pma/server_databases.php?db=&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185677244119316&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 6977

Line 4705: 116.162.2.123 - - [23/Aug/2020:20:23:06 +0800] "GET /pma/db_structure.php?db=mysql&ajax_request=true&ajax_page_request=true&_nocache=1598185678588405905&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9954

Line 4707: 116.162.2.123 - - [23/Aug/2020:20:23:07 +0800] "GET /pma/navigation.php?ajax_request=1&lang=zh_CN&aPath=cm9vdA%3D%3D.bXlzcWw%3D&vPath=cm9vdA%3D%3D.bXlzcWw%3D&pos=0&pos2_name=&pos2_value=&searchClause=&searchClause2=&_nocache=1598185679532866268&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 2712

Line 4708: 116.162.2.123 - - [23/Aug/2020:20:23:07 +0800] "GET /pma/server_databases.php?db=&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=159818568012651082&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 6977

Line 4710: 116.162.2.123 - - [23/Aug/2020:20:23:09 +0800] "GET /pma/db_structure.php?db=qf529261876&ajax_request=true&ajax_page_request=true&_nocache=1598185682005653639&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9627

Line 4711: 116.162.2.123 - - [23/Aug/2020:20:23:12 +0800] "GET /pma/sql.php?db=qf529261876&table=shua_shequ&pos=0&ajax_request=true&ajax_page_request=true&_nocache=1598185685005808308&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 8116

Line 4712: 116.162.2.123 - - [23/Aug/2020:20:23:13 +0800] "GET /pma/index.php?ajax_request=1&recent_table=1&no_debug=true&_nocache=159818568577118163&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 1599

Line 4713: 116.162.2.123 - - [23/Aug/2020:20:23:15 +0800] "GET /pma/db_structure.php?db=qf529261876&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185687616103033&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9627

Line 4727: 116.162.2.123 - - [23/Aug/2020:20:24:18 +0800] "GET /pma/sql.php?db=qf529261876&table=shua_tools&pos=0&ajax_request=true&ajax_page_request=true&_nocache=1598185750294732339&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 14900

Line 4728: 116.162.2.123 - - [23/Aug/2020:20:24:19 +0800] "GET /pma/index.php?ajax_request=1&recent_table=1&no_debug=true&_nocache=1598185751466596245&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 1611

Line 4729: 116.162.2.123 - - [23/Aug/2020:20:24:20 +0800] "GET /pma/db_structure.php?db=qf529261876&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185752537108547&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9630

Line 4730: 116.162.2.123 - - [23/Aug/2020:20:24:23 +0800] "GET /pma/db_structure.php?db=qf529261876&pos=0&sort=table&sort_order=DESC&ajax_request=true&ajax_page_request=true&_nocache=1598185755277636777&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9581

Line 4731: 116.162.2.123 - - [23/Aug/2020:20:24:28 +0800] "GET /pma/sql.php?db=qf529261876&table=shua_workorder&pos=0&ajax_request=true&ajax_page_request=true&_nocache=1598185760250246588&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 7184

Line 4732: 116.162.2.123 - - [23/Aug/2020:20:24:29 +0800] "GET /pma/index.php?ajax_request=1&recent_table=1&no_debug=true&_nocache=1598185761243827878&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 1625

Line 4733: 116.162.2.123 - - [23/Aug/2020:20:24:29 +0800] "GET /pma/db_structure.php?db=qf529261876&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185762119176774&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9630

Line 4736: 116.162.2.123 - - [23/Aug/2020:20:24:45 +0800] "GET /pma/sql.php?db=qf529261876&table=shua_workorder&pos=0&ajax_request=true&ajax_page_request=true&_nocache=1598185777752964155&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 7185

Line 4738: 116.162.2.123 - - [23/Aug/2020:20:24:46 +0800] "GET /pma/index.php?ajax_request=1&recent_table=1&no_debug=true&_nocache=1598185778545677432&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 1625

Line 4739: 116.162.2.123 - - [23/Aug/2020:20:24:47 +0800] "GET /pma/db_structure.php?db=qf529261876&table=&server=1&target=&ajax_request=true&ajax_page_request=true&_nocache=1598185779616618888&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 9630

Line 4742: 116.162.2.123 - - [23/Aug/2020:20:24:54 +0800] "GET /pma/sql.php?db=qf529261876&table=shua_config&pos=0&ajax_request=true&ajax_page_request=true&_nocache=1598185786412900480&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 10867

Line 4743: 116.162.2.123 - - [23/Aug/2020:20:24:55 +0800] "GET /pma/index.php?ajax_request=1&recent_table=1&no_debug=true&_nocache=1598185787487583076&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 1634

Line 5162: 116.162.2.123 - - [23/Aug/2020:20:36:47 +0800] "GET /pma/ HTTP/1.1" 200 14370

Line 5163: 116.162.2.123 - - [23/Aug/2020:20:36:48 +0800] "GET /pma/themes/pmahomme/css/theme.css?v=5.0.2&nocache=6367662178ltr&server=1 HTTP/1.1" 200 20259

Line 5164: 116.162.2.123 - - [23/Aug/2020:20:36:48 +0800] "GET /pma/js/whitelist.php?v=5.0.2 HTTP/1.1" 200 478

Line 5165: 116.162.2.123 - - [23/Aug/2020:20:36:48 +0800] "GET /pma/js/messages.php?l=zh_CN&v=5.0.2 HTTP/1.1" 200 9709

Line 5166: 116.162.2.123 - - [23/Aug/2020:20:36:49 +0800] "POST /pma/navigation.php?ajax_request=1 HTTP/1.1" 200 2517

Line 5167: 116.162.2.123 - - [23/Aug/2020:20:36:49 +0800] "POST /pma/ajax.php HTTP/1.1" 200 1641

Line 5168: 116.162.2.123 - - [23/Aug/2020:20:36:50 +0800] "POST /pma/version_check.php HTTP/1.1" 200 64

Line 5169: 116.162.2.123 - - [23/Aug/2020:20:36:50 +0800] "POST /pma/ajax.php HTTP/1.1" 200 1535

Line 5170: 116.162.2.123 - - [23/Aug/2020:20:36:52 +0800] "GET /pma/server_databases.php?ajax_request=true&ajax_page_request=true&_nocache=1598186503817237237&token=255b623043524b3c3a2e6b6d42355e49 HTTP/1.1" 200 6977

Line 5172: 116.162.2.123 - - [23/Aug/2020:20:36:57 +0800] "GET /pma/themes/pmahomme/jquery/images/ui-bg_highlight-soft_75_cccccc_1x100.png HTTP/1.1" 200 122

Line 5173: 116.162.2.123 - - [23/Aug/2020:20:36:57 +0800] "GET /pma/themes/pmahomme/jquery/images/ui-bg_glass_75_e6e6e6_1x400.png HTTP/1.1" 200 121

Line 5174: 116.162.2.123 - - [23/Aug/2020:20:36:57 +0800] "GET /pma/themes/pmahomme/jquery/images/ui-icons_888888_256x240.png HTTP/1.1" 200 3765

Line 5175: 116.162.2.123 - - [23/Aug/2020:20:36:57 +0800] "GET /pma/themes/pmahomme/jquery/images/ui-icons_222222_256x240.png HTTP/1.1" 200 3765

Line 5176: 116.162.2.123 - - [23/Aug/2020:20:36:57 +0800] "GET /pma/themes/pmahomme/jquery/images/ui-bg_glass_75_dadada_1x400.png HTTP/1.1" 200 126

Line 5177: 116.162.2.123 - - [23/Aug/2020:20:36:58 +0800] "GET /pma/themes/pmahomme/jquery/images/ui-bg_glass_65_ffffff_1x400.png HTTP/1.1" 200 73

Line 5178: 116.162.2.123 - - [23/Aug/2020:20:36:58 +0800] "POST /pma/server_databases.php HTTP/1.1" 200 1659