当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-051075

漏洞标题：搜狗某服务器配置不当导致敏感信息泄露

相关厂商：搜狗

漏洞作者： m1x7e1

提交时间：2014-02-16 13:00

修复时间：2014-04-02 13:00

公开时间：2014-04-02 13:00

漏洞类型：敏感信息泄露

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-02-16： 细节已通知厂商并且等待厂商处理中
2014-02-16： 厂商已经确认，细节仅向厂商公开
2014-02-26： 细节向核心白帽子及相关领域专家公开
2014-03-08： 细节向普通白帽子公开
2014-03-18： 细节向实习白帽子公开
2014-04-02： 细节向公众公开

简要描述：

hard to dream。

详细说明：

http://files.sogou.com/.bash_history
.bash_history保存了最近使用过的一些命令。

df -h
#1366626326
cd /search/nginx/script/
#1366626331
vi zabbix_ob.sh 
#1366626355
./zabbix_ob.sh Req
#1366669640
unset LANG; lsb_release -a; uname -a; 
#1366756042
unset LANG; lsb_release -a; uname -a; 
#1366770959
w
#1366770966
clustat 
#1366771739
clustat 
#1366771744
nload 
#1366771825
cd /search/nginx/logs/
#1366771825
ll
#1366771838
cd /search/nginx/logs/
#1366771838
ll
#1366772145
cd /search/nginx/logs
#1366772146
ll
#1366772150
ll | grep error
#1366772154
ll | grep error
#1366772162
nload
#1366772192
ps aux | grep nginx
#1366772435
ll
#1366772444
ll | grep news
#1366772450
ll | grep news
#1366772457
tail news
#1366772464
ll | grep error.log 
#1366772467
cd history/nginx
#1366772467
ll
#1366772481
head error.log.2013042409
#1366772494
grep "news" error.log.2013042409
#1366772513
grep "news" error.log.2013042409 | grep "09:44"
#1366772525
grep "news" error.log.2013042409 | grep "09:44" | wc -l
#1366772538
grep "news" error.log.2013042409 | grep "09:44" | less
#1366772555
ll /usr/local/nginx/conf/vhosts/| grep news
#1366772563
grep "news.sogou.com" error.log.2013042409 | grep "09:44" | less
#1366772594
grep "news.sogou.com" error.log.2013042409 | grep "09:44" 
#1366772625
grep "server: news.sogou.com" error.log.2013042409 | grep "09:4" 
#1366772627
grep "server: news.sogou.com" error.log.2013042409 | grep "09:4" 
#1366842431
unset LANG; lsb_release -a; uname -a; 
#1366854343
cd /etc/cluster/
#1366854344
ll
#1366854359
vi cluster.conf 
#1366854428
clear
#1366854429
pwd
#1366854434
clear
#1366854436
vi cluster.conf 
#1366854578
sogou-host -a
#1366854579
clear
#1366854581
sogou-host 
#1366855885
vi cluster.conf 
#1366875534
cd /etc/cluster/
#1366875566
ll
#1366875570
vi cluster.conf 
#1366875576
clear
#1366875586
cd /usr/lib/nagios/plugins/
#1366875587
ll
#1366875613
rsync odin@10.12.143.107::search/sumiao/script/check_ilo ./
#1366875638
ll -rt
#1366875648
./check_ilo 
#1366875814
clear
#1366875821
cd /etc/nagios/
#1366875822
ll
#1366875823
vi external_command.cfg 
#1366875847
vi external_command.cfg 
#1366875961
ll /usr/lib/nagios/plugins/check_ilo
#1366876034
service nrpe restart
#1366878996
cd /etc/cluster/
#1366928852
unset LANG; lsb_release -a; uname -a; 
#1366949921
cd /usr/local/nginx/conf/vhosts/
#1366949927
vi proxy.sogou.com.conf 
#1366949959
cd /search/nginx/html/
#1366949960
ll
#1366949964
cd VPN
#1366949967
ll [B
#1366949971
vi index.html
#1366950063
vi index.html
#1366950077
ll
#1366950087
mr -f vpn_for_*
#1366950088
LL
#1366950090
ll
#1366950099
rm -rf vpn_for_*
#1366950100
ll
#1366950103
rm -f SOGOU\ VPN配置手册.docx 
#1366950103
ll
#1366950106
ll
#1366950163
ll
#1366950165
vi index.html 
#1366950237
vi index.html 
#1366956323
cd /search/nginx/logs/
#1366956323
ll
#1366956326
cd ../html/
#1366956326
ll
#1366956330
cd VPN
#1366956330
ll
#1366956344
rm -f index.html 
#1366957375
rm -f SOGOU\ VPN配置手册.docx 
#1366957436
ll
#1366972024
cd /usr/local/nginx/html/
#1366972025
ll
#1366972037
vi index.html 
#1366973652
w
#1366973652
top
#1366973802
free
#1366973816
w
#1366973818
top
#1366979561
host cloud.pinyin.sogou.com
#1366993458
cd /usr/local/nginx/logs/
#1366993459
ll
#1366993462
cd history/prox
#1366993464
pwd
#1366993472
cd /usr/local/nginx/logs/history/proxy.sogou.com
#1366993473
ll
#1366993506
cat  proxy.sogou.com_access_log* |> /search/`sogou-host|grep -v rsync`.log
#1366993511
cd /search/
#1366993511
ll
#1366993519
cd -
#1366993526
cat  proxy.sogou.com_access_log* > /search/`sogou-host|grep -v rsync`.log
#1366993529
cd /search/
#1366993530
ll
#1366993535
less proxy07.ha.cnc.log 
#1366993541
ll
#1366993611
rsync -avz *.log 10.12.143.107::search/odin/apache/test/
#1366993637
rm -f *.log
#1366993638
ll
#1367101663
unset LANG; lsb_release -a; uname -a; 
#1367188057
unset LANG; lsb_release -a; uname -a; 
#1367274462
unset LANG; lsb_release -a; uname -a; 
#1367336724
unset LANG; lsb_release -a; uname -a; 
#1367360855
unset LANG; lsb_release -a; uname -a; 
#1367387192
unset LANG; lsb_release -a; uname -a; 
#1367395869
unset LANG; lsb_release -a; uname -a; 
#1367447164
unset LANG; lsb_release -a; uname -a; 
#1367533574
unset LANG; lsb_release -a; uname -a; 
#1367619968
unset LANG; lsb_release -a; uname -a; 
#1367706371
unset LANG; lsb_release -a; uname -a; 
#1367792771
unset LANG; lsb_release -a; uname -a; 
#1367824195
clustat 
#1367824196
nload 
#1367824354
ll
#1367824358
cd /search/nginx/
#1367824359
ll
#1367824366
cd /usr/local/nginx/conf/vhosts/
#1367824367
ll
#1367824368
ll -rt
#1367824374
vi bobo.sogou.com.conf
#1367824452
/usr/local/nginx/sbin/nginx -t 
#1367824610
service nginx reload
#1367824630
curl -H "Host: bobo.sogou.com" http://localhost/
#1367824700
curl -H "Host: bobo.sogou.com" http://localhost/
#1367827572
exit
#1367879175
unset LANG; lsb_release -a; uname -a; 
#1367831909
curl -H "Host: search.waibao.sogou-inc.com" http://localhost/
#1367898474
sogou-host 
#1367922435
cd /search/nginx/logs/
#1367922435
ll
#1367922483
cd /usr/local/nginx/conf/vhosts/
#1367922484
ll
#1367922489
rm -f waibao.sogou-inc.com.conf 
#1367922499
/usr/local/nginx/sbin/nginx -t
#1367965580
unset LANG; lsb_release -a; uname -a; 
#1368052141
unset LANG; lsb_release -a; uname -a; 
#1368138560
unset LANG; lsb_release -a; uname -a; 
#1368224970
unset LANG; lsb_release -a; uname -a; 
#1368311349
unset LANG; lsb_release -a; uname -a; 
#1368397719
unset LANG; lsb_release -a; uname -a; 
#1368484164
unset LANG; lsb_release -a; uname -a; 
#1368513153
cd /search/nginx/logs/
#1368513153
ll
#1368513156
cd history/
#1368513157
ll
#1368513161
cd sto
#1368513161
ll
#1368513214
ll st41*
#1368513437
clear
#1368513470
ll -rt
#1368517945
cd /search/nginx/logs
#1368517953
tail -f jobsogou| grep hr
#1368517970
tail -f jobsogou| grep "hr.sogou.com"
#1368570546
unset LANG; lsb_release -a; uname -a; 
#1368607620
ping 10.132.3.2
#1368656929
unset LANG; lsb_release -a; uname -a; 
#1368678312
cd /search/nginx/logs/
#1368678326
tail -f account.sogou.com_access_log 
#1368708197
if  id smarton > /dev/null ; then echo ok;  setfacl -R -x u:smarton /var ; fi
#1368717769
cd /usr/local/nginx/conf/vhosts/
#1368717770
ll
#1368717774
cd /search/g
#1368717776
cd /search/nginx/
#1368717777
ll
#1368717779
cd logs/
#1368717780
ll
#1368717783
cat /etc/rc.local 
#1368717791
cat /etc/passwd
#1368743350
unset LANG; lsb_release -a; uname -a; 
#1368761942
cd /search/nginx/html/
#1368761942
ll
#1368762182
ll
#1368762186
rsync -avz apache01.profile.cnc.dt.nop.vm
#1368762186
apache02.profile.cnc.dt.nop.vm
#1368762186
apache01.profile.djt.dt.nop.vm
#1368762187
apache02.profile.djt.dt.nop.vm
#1368762187
apache03.profile.djt.dt.nop.vm
#1368762187
apache04.profile.djt.dt.nop.vm
#1368762187
apache05.profile.djt.dt.nop.vm
#1368762189
ll
#1368762226
rsync -avz rsync.repos01.cdn.djt::search/deploy/repos/cdn.sogou.com/* ./
#1368762238
ll
#1368762273
rm -rf monitor update test
#1368762276
ll
#1368762288
rm -f del_path_list
#1368762291
ll
#1368829738
unset LANG; lsb_release -a; uname -a; 
#1368916145
unset LANG; lsb_release -a; uname -a; 
#1369002536
unset LANG; lsb_release -a; uname -a; 
#1369013643
w
#1369013654
curl localhost
#1369013671
top
#1369013682
cd /search/nginx/logs/
#1369013683
ll
#1369013692
ll -h error.log 
#1369013700
> error.log 
#1369013703
ll
#1369013704
cd history/
#1369013705
ll
#1369013708
cd nginx
#1369013708
ll
#1369013711
ll -h error.log.201305
#1369013717
ll -h error.log.201305*
#1369013722
cd ../
#1369013723
cd ..
#1369013724
ll
#1369013725
tail error.log 
#1369014670
w
#1369014685
w
#1369014688
> error.log 
#1369015221
> error.log 
#1369015225
ll
#1369015228
cd history/nginx
#1369015229
ll
#1369015242
>  error.log.2013052009
#1369088965
unset LANG; lsb_release -a; uname -a; 
#1369175340
unset LANG; lsb_release -a; uname -a; 
#1369206655
ip addr
#1369231887
df -h
#1369231890
w
#1369231902
cd /search/nginx/logs/
#1369231902
ll
#1369231915
cat  status.proxy.sogou.com_access_log|grep nagios|less
#1369261747
unset LANG; lsb_release -a; uname -a; 
#1369277542
sogou-host
#1369304082
ip addr |grep "115.25.216.36"
#1369304088
ip addr
#1369304093
clustat 
#1369347978
unset LANG; lsb_release -a; uname -a; 
#1369434370
unset LANG; lsb_release -a; uname -a; 
#1369520778
unset LANG; lsb_release -a; uname -a; 
#1369607181
unset LANG; lsb_release -a; uname -a; 
#1369693573
unset LANG; lsb_release -a; uname -a; 
#1369725260
cd /usr/local/nginx/conf/vhosts/
#1369725261
ll
#1369779983
unset LANG; lsb_release -a; uname -a; 
#1369866380
unset LANG; lsb_release -a; uname -a; 
#1369952778
unset LANG; lsb_release -a; uname -a; 
#1369971204
cd /usr/local/nginx/sbin/
#1369971205
ll
#1369971216
rm -f spawn-php.sh
#1369971217
ll
#1369973269
df -h
#1369976441
ll
#1369976452
cp nginx nginx.20130531
#1369976452
ll
#1369977465
w
#1369979644
w
#1369979655
w
#1369980466
ll
#1370039197
unset LANG; lsb_release -a; uname -a; 
#1370125580
unset LANG; lsb_release -a; uname -a; 
#1370211982
unset LANG; lsb_release -a; uname -a; 
#1370254095
w
#1370254099
w
#1370254100
w
#1370254101
top
#1370254130
curl localhost
#1370254132
curl localhost
#1370254132
curl localhost
#1370254133
curl localhost
#1370254134
curl localhost
#1370254134
curl localhost
#1370254135
w
#1370254141
free
#1370254143
top
#1370277337
cd /search/nginx/html/
#1370277337
ll
#1370277354
rsync -avz 10.12.133.3::search/nginx/html/* /search/nginx/html/
#1370277360
ll
#1370277377
ll
#1370277380
cat index.html 
#1370277389
cat index.html 
#1370277404
vi index.html 
#1370298388
unset LANG; lsb_release -a; uname -a; 
#1370343560
w
#1370343563
w
#1370343563
w
#1370343565
w
#1370343570
w
#1370343571
w
#1370343572
top
#1370343582
ps aux |grep nginx
#1370343586
curl localhost
#1370343587
curl localhost
#1370343588
curl localhost
#1370343589
curl localhost
#1370343589
curl localhost
#1370343590
curl localhost
#1370343591
curl localhost
#1370343591
curl localhost
#1370343592
curl localhost
#1370343592
curl localhost
#1370343593
curl localhost
#1370343593
curl localhost
#1370343594
curl localhost
#1370343595
w
#1370343610
w
#1370343611
w
#1370343611
w
#1370343618
iostat -kx 1
#1370343625
/search/nginx/script/zabbix_ob.sh Req
#1370343631
/search/nginx/script/zabbix_ob.sh Req
#1370343642
/search/nginx/script/zabbix_ob.sh Req
#1370343644
cd /search/nginx/logs/
#1370343645
ll
#1370343648
cd latest/
#1370343648
ll
#1370343650
ll
#1370343654
ll
#1370343655
ll
#1370343656
ll
#1370343699
w
#1370343700
w
#1370384790
unset LANG; lsb_release -a; uname -a; 
#1370418393
cd /usr/local/nginx/sbin/
#1370418393
ll
#1370418421
yum clean all
#1370418435
cd /usr/local/nginx/c
#1370418436
cd /usr/local/nginx/
#1370418437
ll
#1370418440
mv conf conf.bak
#1370418441
ll
#1370418446
yum update nginx-sogou
#1370418579
ll
#1370418583
rm -rf conf
#1370418589
ll
#1370418594
mv conf.bak conf
#1370418595
ll
#1370418599
w
#1370418602
cd /search/nginx/data
#1370418603
ll
#1370418616
cp ip2location.dat.sample ip2location.dat
#1370418618
ll
#1370418622
/usr/local/nginx/sbin/nginx-t
#1370418624
/usr/local/nginx/sbin/nginx -t
#1370418635
service nginx smoothupdate
#1370418651
cd /usr/local/nginx/sbin/
#1370418651
ll
#1370418662
kill -QUIT `cat nginx.pid.oldbin`
#1370418666
ps aux |grep nginx
#1370418673
top
#1370418696
/usr/local/nginx/sbin/nginx -V
#1370418706
top
#1370419116
ps aux |grep nginx
#1370419325
w
#1370429096
w
#1370429108
w
#1370471189
unset LANG; lsb_release -a; uname -a; 
#1370427019
cd /var/log/sogou-resource-util/
#1370427020
ll
#1370427076
vi message.log.20130605 
#1370427135
cd /var/log
#1370427135
ll
#1370427139
cd sogou-resource-util/
#1370427140
ll
#1370427149
tail message.log.20130605 
#1370509980
w
#1370509985
curl localhost
#1370509992
curl localhost
#1370509993
curl localhost
#1370509995
w
#1370509995
w
#1370509996
top
#1370510042
top
#1370510050
cd /search/nginx/logs
#1370510050
ll
#1370510058
ll | grep error
#1370510060
ll | grep error
#1370510261
nload
#1370510703
nload
#1370510803
sogou-host
#1370510825
history | tail
#1370510830
history |less
#1370510894
sogou-host
#1370513191
cd /search/nginx/logs
#1370513191
ll
#1370513200
grep "config.zhushou" error.log 
#1370513213
grep "zhushou" error.log  | less
#1370557580
unset LANG; lsb_release -a; uname -a; 
#1370572557
w
#1370572566
curl localhost
#1370573525
w
#1370573527
curl localhost
#1370573532
clustat 
#1370573771
w
#1370573896
w
#1370588496
clustat 
#1370588534
sogou-host 
#1370588543
exit
#1370589275
cd /opt/sogou-pack/
#1370589276
ll
#1370589278
cd resource-util/
#1370589279
ll
#1370589281
vi ru.cfg 
#1370591916
ll
#1370596217
cd /search/nginx/logs/history/
#1370596218
ll
#1370596232
cd union.sogou.com/
#1370596233
ll
#1370596248
cat union.sogou.com_access_log.2013060711 |grep "2013-06-07 11:50:20"
#1370596259
head  union.sogou.com_access_log.2013060711 
#1370596270
cat union.sogou.com_access_log.2013060711 |grep "11:50:20"
#1370596326
cat union.sogou.com_access_log.2013060711 |grep "10.14.140.205"
#1370596364
cat union.sogou.com_access_log.2013060711 |grep "10.14.140.205"|grep "10.13.198.194"
#1370596369
cat union.sogou.com_access_log.2013060711 |grep "10.14.140.205"|grep "10.13.198.194"
#1370596819
cd /search/nginx/logs/
#1370596829
cd history/union.sogou.com
#1370596836
ll
#1370596841
ll
#1370596855
cat union.sogou.com_access_log.2013060711|grep "59.53.170.8"
#1370644003
unset LANG; lsb_release -a; uname -a; 
#1370597731
cd /opt/sogou-pack/resource-util/
#1370597731
ll
#1370597746
sogou-host
#1370598440
ll
#1370598452
cd /var/log/sogou-resource-util/
#1370598453
ll
#1370598459
tail -f message.log.20130607
#1370702459
w
#1370702684
curl localhost
#1370702685
curl localhost
#1370702694
w
#1370730405
unset LANG; lsb_release -a; uname -a; 
#1370702416
top
#1370702457
nload
#1370702536
top
#1370702667
cd /search/nginx/logs
#1370702668
ll
#1370702672
cd latest
#1370702673
ll
#1370702784
ll
#1370702792
tail nginx.lat.log.201306082245
#1370703035
ll
#1370703329
uptime
#1370761961
cd /usr/local/nginx/
#1370761961
ll
#1370761969
cp -r conf conf.20130609
#1370761970
ll
#1370763400
cd /search/
#1370763401
ll
#1370763404
rm -f *.rpm
#1370763405
ll
#1370763410
cd logs
#1370763411
ll
#1370763412
cd log
#1370763412
ll
#1370763418
cd /search/
#1370763419
ll
#1370763421
rm -rf log
#1370763422
ll
#1370763692
ll
#1370763712
rsync -avz rsync.proxy07.ha.djt::search/conf.tar /usr/local/nginx/
#1370763721
cd /usr/local/nginx/
#1370763722
ll
#1370763728
rm -rf conf
#1370763732
tar -xvf conf.tar
#1370763734
ll
#1370763740
rm -f conf.tar
#1370763741
ll
#1370763748
cat conf/nginx.conf 
#1370763761
/usr/local/nginx/sbin/nginx -t
#1370763775
service nginx reload
#1370763787
cd
#1370763790
cd /usr/local/nginx/
#1370763790
ll
#1370763792
cd /search/
#1370763793
ll
#1370763797
rm -f conf.tar
#1370763798
ll
#1370763825
cd /usr/local/nginx/html/
#1370763825
ll
#1370763827
vi index.html 
#1370763843
ll
#1370763858
vi index.html 
#1370763877
chattr +i index.html 
#1370763878
ll
#1370763907
rsync -avz odin@rsync.proxy01.ha.djt::search/nginx/html/* /search/nginx/html/
#1370763915
ll
#1370763916
ll
#1370763917
cd ..
#1370763918
ll
#1370763927
cd /search/nginx/
#1370763928
ll
#1370763932
cd data
#1370763932
ll
#1370763936
cd ..
#1370763937
ll
#1370763938
df -h
#1370763941
ll
#1370763948
rm -f nginx_fail.log
#1370763949
ll
#1370763954
cd /usr/local/nginx/
#1370763954
ll
#1370763955
cd sbin/
#1370763956
ll
#1370763966
rm -f nginx.20130531
#1370763967
ll
#1370763975
ps aux
#1370763977
ps aux|grep nginx
#1370764029
ll
#1370764031
ll
#1370816826
unset LANG; lsb_release -a; uname -a; 
#1370903214
unset LANG; lsb_release -a; uname -a; 
#1370917719
w
#1370917731
curl localhost
#1370918317
curl localhost
#1370918319
curl localhost
#1370918322
ll
#1370918328
cd /search/nginx/logs/latest/
#1370918329
ll
#1370918501
ip addr
#1370989623
unset LANG; lsb_release -a; uname -a; 
#1371076015
unset LANG; lsb_release -a; uname -a; 
#1371106063
unset LANG; lsb_release -a; uname -a; 
#1371162423
unset LANG; lsb_release -a; uname -a; 
#1371248833
unset LANG; lsb_release -a; uname -a; 
#1371335228
unset LANG; lsb_release -a; uname -a; 
#1371421619
unset LANG; lsb_release -a; uname -a; 
#1371508036
unset LANG; lsb_release -a; uname -a; 
#1371522005
cd /search/nginx/logs/
#1371522006
ll
#1371522012
cd /search/nginx/
#1371522013
cd ..
#1371522014
ll
#1371522026
rm -f nginx.err* nginx.lat*
#1371522027
ll
#1371522031
ll
#1371522060
rm -rf tmp_log hostlist.txt proxy_deploy.sh zls rescue_nginx.sh
#1371522062
ll
#1371522089
rm -rf home  proxy_1.sh monitor lost+found 
#1371522092
ll
#1371522103
ll
#1371522104
ll
#1371522106
df -h
#1371522109
ll
#1371522110
cd nginx/
#1371522111
ll
#1371522113
cd logs/
#1371522113
ll
#1371522115
cd ..
#1371522115
ll
#1371522127
chown -R odin.odin .
#1371522135
cd /usr/local/nginx/conf
#1371522135
ll
#1371522147
chown -R root.root .
#1371522224
ll
#1371522226
cd
#1371522228
cd /search/
#1371522229
ll
#1371529375
w
#1371529378
cd /search/nginx/logs/
#1371529378
ll
#1371529381
ll
#1371529385
cd ..
#1371529386
ll
#1371529395
chown -R nobody.nobody .
#1371529397
ll
#1371529399
cd logs/
#1371529400
ll
#1371529405
ll -h logs
#1371529410
ll -h error.log 
#1371529415
> error.log 
#1371529422
tail -f error.log 
#1371529441
ll
#1371529821
cd /usr/local/nginx/
#1371529821
ll
#1371529827
rm -rf conf.20130609
#1371529828
ll
#1371529829
cd sbin
#1371529830
ll
#1371529968
w
#1371594431
unset LANG; lsb_release -a; uname -a; 
#1371637514
cd /search/
#1371637515
ll
#1371637517
mkdir tmp
#1371637517
ll
#1371637519
cd tmp/
#1371637526
ftp ftp://proxy.wsfdupload.lxdns.com
#1371637545
lftp sogou@proxy.wsfdupload.lxdns.com
#1371637658
ll
#1371637662
rm -f *
#1371637668
lftp sogou@wsfdupload.lxdns.com
#1371637995
ll
#1371638000
wget -R "http://files.sogou.com/test/"
#1371638004
man wget
#1371638010
wget -r "http://files.sogou.com/test/"
#1371638017
man wget
#1371638084
wget -nd "http://files.sogou.com/test/"
#1371638094
ll
#1371638096
ll -h
#1371638097
ll
#1371638098
w
#1371638100
top
#1371638115
ll
#1371638116
cd ,,
#1371638117
cd ..
#1371638117
ll
#1371638125
cp url  url2
#1371638127
vi url2 
#1371638146
mkdir tmp2
#1371638148
cd tmp2/
#1371638173
for i in `cat ../url2`;do wget -r -nd "$i" ; done
#1371638183
ll
#1371638184
ll
#1371638186
cd ..
#1371638187
ll
#1371638194
rm -rf url2 tmp2/
#1371638194
ll
#1371638199
cd tmp/
#1371638199
ll
#1371638842
host android2.cdn.sogou.com
#1371638845
cd
#1371638854
cd /search/
#1371638854
ll
#1371638856
du -sh tmp/
#1371648980
cd /search/tmp/
#1371648980
ll
#1371648983
ll |wc -l
#1371648986
ll|less
#1371648991
ll|head
#1371649157
ll|head
#1371649221
ll
#1371649225
ll|head
#1371649226
ll|head
#1371649226
ll|head
#1371649227
ll|head
#1371649227
ll|head
#1371649227
ll|head
#1371649228
ll|head
#1371649228
ll|head
#1371649228
ll|head
#1371649237
ll |grep 130619
#1371649241
ll |grep 130619
#1371649242
ll |grep 130619
#1371649242
ll |grep 130619
#1371649243
ll |grep 130619
#1371649243
ll |grep 130619
#1371649243
ll |grep 130619
#1371649244
ll |grep 130619
#1371649246
ll |grep 130619
#1371649246
ll |grep 130619
#1371649247
ll |grep 130619
#1371649247
ll |grep 130619
#1371649455
ll |grep 130619
#1371649456
ll |grep 130619
#1371649457
ll |grep 130619
#1371649458
ll |grep 130619
#1371649458
ll |grep 130619
#1371649459
ll |grep 130619
#1371649984
wget files2.sogou.com/sogou_explorer_silent_2.0.0.891_2180.exe
#1371649996
ll sogou_explorer_silent_2.0.0.891_2180.exe*
#1371650008
ll sogou_explorer_silent_2.0.0.891_2180.exe*
#1371650012
ll sogou_explorer_silent_2.0.0.891_2180.exe.1
#1371650019
rm -f sogou_explorer_silent_2.0.0.891_2180.exe.1
#1371650020
ll
#1371650042
cd ..
#1371650042
ll
#1371650045
grep sogou_explorer_silent_2.0.0.891_2180.exe url 
#1371650059
cd tmp/
#1371650059
ll
#1371650061
ll
#1371650099
ll|head
#1371680835
unset LANG; lsb_release -a; uname -a; 
#1371703743
cd /search/nginx/logs/latest/
#1371703743
ll
#1371649169
cd /search/tmp/
#1371649169
ll
#1371649180
lftp sogou@ftp://125.39.17.8
#1371649192
lftp sogou@125.39.17.8
#1371637581
cd /search/tmp/
#1371637582
ll
#1371637583
ll
#1371637616
ll
#1371637618
ll
#1371637740
lftp sogou@wsfdupload.lxdns.com
#1371637905
ll
#1371637907
rm -rf *
#1371637908
cd ..
#1371637909
ll
#1371637912
vi tmp
#1371637916
vi txt
#1371637936
awk '{print "http://files2.sogou.com/"$NF}'
#1371637940
awk '{print "http://files2.sogou.com/"$NF}' txt
#1371637946
awk '{print "http://files2.sogou.com/"$NF}' txt >> url
#1371637946
ll
#1371637950
rm -f txt
#1371637952
cat url 
#1371637953
ll
#1371637955
cd tmp/
#1371637973
for i in `cat ../url` ;do wget "$i" ;done
#1371648915
ll
#1371648918
du -sh .
#1371648929
lftp sogou@wsfdupload.lxdns.com
#1371649288
ll
#1371649318
rm -f PreUpdater130619.exe 
#1371649323
wget files2.sogou.com/PreUpdater130619.exe 
#1371649328
lftp sogou@wsfdupload.lxdns.com
#1371651076
ll
#1371654433
lftp sogou@wsfdupload.lxdns.com
#1371715240
cd
#1371767235
unset LANG; lsb_release -a; uname -a; 
#1371853636
unset LANG; lsb_release -a; uname -a; 
#1371709913
clustat 
#1371711427
top
#1371940041
unset LANG; lsb_release -a; uname -a; 
#1372026423
unset LANG; lsb_release -a; uname -a; 
#1372078340
w
#1372078349
cd /search/nginx/logs/
#1372078359
cd /search/nginx/logs/
#1372078360
ll
#1372078365
cd latest/
#1372078366
ll
#1372078374
tail nginx.lat.log.20130624205
#1372078376
tail nginx.lat.log.201306242051
#1372078389
cd /search/
#1372078390
ll
#1372078401
rm -f 123* nginx.la* skin.ie*
#1372078401
ll
#1372078504
w
#1372078677
w
#1372078680
w
#1372078681
nload
#1372078709
w
#1372078863
w
#1372078864
ll
#1372078868
cd nginx/logs/
#1372078877
tail 123.sogou.com_access_log 
#1372079100
w
#1372079104
w
#1372079105
nload
#1372079187
w
#1372079189
top
#1372079471
nload
#1372079831
w
#1372079835
w
#1372079982
w
#1372080132
w
#1372080235
w
#1372080434
grep "175.5.18.23" 123.sogou.com_access_log |less
#1372081121
nload
#1372081273
ll
#1372081280
ll
#1372081286
cd /etc/sysconfig/
#1372081289
cat iptables
#1372081303
ll
#1372081451
iptables -F
#1372081457
cat /etc/sysconfig/iptables
#1372081473
iptables -Ln
#1372081479
iptables -ln
#1372082504
w
#1372082506
clustat 
#1372112817
unset LANG; lsb_release -a; uname -a; 
#1372199224
unset LANG; lsb_release -a; uname -a; 
#1372222628
w
#1372222755
w
#1372222759
w
#1372230219
vi /etc/hosts
#1372230274
service nginx reload
#1372230293
ps aux |grep nginx
#1372230487
ll
#1372230489
df -h
#1372230491
cd /var/
#1372230491
ll
#1372230494
du -sh *
#1372230497
cd account/
#1372230497
ll
#1372230507
> pacct
#1372230509
ll
#1372230515
rm -f pacct.*
#1372230517
l
#1372230518
ll
#1372230522
ll -h
#1372230536
ll
#1372230537
cd ..
#1372230538
ll
#1372230542
df -h
#1372230834
ll
#1372230836
free
#1372230844
ll
#1372230847
crontab -l
#1372230850
ll
#1372230853
w
#1372240721
vi /etc/hosts
#1372240742
host bbs01.ie.cnc.vm
#1372240768
service nginx reload
#1372285620
unset LANG; lsb_release -a; uname -a; 
#1372312211
curl -H "Host: extention.ie.sogou.com" "http://localhost/se_plugin/getfile?key=8f3db89aa260989bbd315c8a26764933" -I -v
#1372312223
curl -H "Host: extention.ie.sogou.com" "http://localhost/se_plugin/getfile?key=8f3db89aa260989bbd315c8a26764933" -I -v
#1372312360
curl -H "Host: extention.ie.sogou.com" "http://localhost/se_plugin/getfile?key=8f3db89aa260989bbd315c8a26764933" -I -v
#1372315257
cd /var/log/acpid 
#1372315259
cd /var/account/
#1372315261
ll
#1372315264
ll -h
#1372315283
/etc/init.d/psacct stop
#1372315285
ll
#1372315287
cd ..
#1372315287
ll
#1372315291
rm -rf account/
#1372315297
mkdir /search/account
#1372315300
df -h
#1372315317
mv /search/account/ /opt/
#1372315324
ln -s /opt/account/ account
#1372315325
ll
#1372315333
/etc/init.d/psacct start
#1372315338
ll
#1372315339
cd account/
#1372315340
ll
#1372315343
ll
#1372315345
cd /opt/
#1372315345
ll
#1372315347
cd account/
#1372315348
ll
#1372315351
crontab -l
#1372315355
ll
#1372331100
w
#1372332658
w
#1372332661
w
#1372332663
w
#1372332669
cd /search/nginx/logs/latest/
#1372332670
ll
#1372332678
w
#1372332680
ccd
#1372332689
cd /search/
#1372332690
ll
#1372332699
rm -f nginx.lat.log.201306251430
#1372332701
ll
#1372332708
crontab -l
#1372332730
ll
#1372332733
w
#1372332736
clustat 
#1372332743
w
#1372332791
w
#1372332794
ll
#1372332799
cd ac
#1372332800
ll
#1372332806
tail qul
#1372332816
iptables -l
#1372332821
iptables -L
#1372333014
ip addr
#1372333017
clustat 
#1372333067
ll
#1372333078
tail qudb
#1372333081
ll
#1372333085
quota.log
#1372333090
tail qlog
#1372333110
cat qlog
#1372333118
cat qdb
#1372333130
cat qres
#1372333250
ll
#1372333252
cat so
#1372333257
ll
#1372333262
tail qre
#1372333267
cat qres
#1372333621
ll
#1372333625
cat qres
#1372334372
cd
#1372334398
ll
#1372334400
cd /search/
#1372334401
ll
#1372334431
rsync -avz rsync.proxy01.ha.djt::search/acmilan /search/
#1372334454
rsync -avz rsync.proxy01.ha.djt::search/acmilan /search/
#1372334456
ll
#1372334486
echo "* * * * * cd /search/acmilan; ./sogou-quake" >> /var/spool/cron/root 
#1372334488
crontab -l
#1372334495
cd
#1372334501
cd /search/acmilan/
#1372334502
ll
#1372334503
crontab -l
#1372334548
w
#1372334554
crontab -l
#1372334602
iptables -L
#1372334627
iptables -L
#1372334629
iptables -L
#1372334718
w
#1372334722
iptables -Ln
#1372334724
iptables -L
#1372334744
iptables -L
#1372334810
iptables -L
#1372334813
iptables -L
#1372334841
ll
#1372334846
cat quake.res
#1372335010
cat quake.res
#1372335565
w
#1372335573
top
#1372335632
cat quake.res 
#1372335641
iptables -L
#1372372041
unset LANG; lsb_release -a; uname -a; 
#1372387345
w
#1372387353
w
#1372387354
w
#1372387355
w
#1372387356
w
#1372397372
cd /search/nginx/logs/
#1372397372
ll
#1372397374
cd /search/
#1372397375
ll
#1372397377
cd acmilan/
#1372397377
ll
#1372397411
vi sogou-quake 
#1372397447
ll
#1372397451
ll
#1372397470
cat test
#1372397471
ll
#1372397474
cat sogou-quake 
#1372397475
ll
#1372397596
ll
#1372397605
cat xxx
#1372397609
rm -f xxx
#1372397609
ll
#1372397619
rm -f 1
#1372397620
ll
#1372397626
df -h
#1372397640
cat /opt/sogou-pack/observer/conf/ob_nginx_cnc.cfg 
#1372397647
ll
#1372397653
iptables -L
#1372397681
iptables -L
#1372397697
ll
#1372397705
ll
#1372397822
rsync -avz 10.136.120.65::search/acmilan/sogou-quake /search/acmilan/
#1372397828
ll
#1372397835
ll
#1372397840
iptables -F
#1372397841
ll
#1372397848
cat quake.db
#1372397853
ll
#1372397854
ll
#1372397857
cat quake.res
#1372397865
iptables -L
#1372397873
vi sogou-quake 
#1372397886
ll
#1372397889
cd snapshot/
#1372397890
ll
#1372397896
cd ..
#1372397897
ll
#1372397902
vi sogou-quake 
#1372397931
vi sogou-quake 
#1372397935
ll
#1372397939
iptables -F
#1372397940
ll
#1372397942
ll
#1372397947
cat quake.db
#1372397969
iptables -L
#1372397980
ll
#1372397984
cat quake.log 
#1372398178
ll
#1372398180
ll -h
#1372398183
ll
#1372398187
iptables -L
#1372398205
ll
#1372398206
w
#1372398209
iptables -L
#1372398213
ll
#1372398216
cat quake.res
#1372145935
top
#1372145981
clustat 
#1372403107
ll rescue_nginx.sh
#1372403116
sogou-host 
#1372403142
ll
#1372403166
cp rescue_nginx.sh  /search/
#1372403183
clear
#1372403237
rsync odin@rsync.proxy01.ha.djt::search/rescue_nginx.sh ./
#1372403250
vi rescue_nginx.sh 
#1372405767
cd /sae
#1372405768
cd /search/
#1372405769
ll
#1372405770
cd tmp/
#1372405771
ll
#1372405774
history |grep ftp
#1372405778
lftp sogou@wsfdupload.lxdns.com
#1372407769
lftp sogou_ime@125.39.17.8
#1372407843
lftp sogou@125.39.17.8
#1372407924
lftp sogou_ime@125.39.17.8
#1372412161
cd
#1372458454
unset LANG; lsb_release -a; uname -a; 
#1372544838
unset LANG; lsb_release -a; uname -a;

漏洞证明：

df -h
#1366626326
cd /search/nginx/script/
#1366626331
vi zabbix_ob.sh 
#1366626355
./zabbix_ob.sh Req
#1366669640
unset LANG; lsb_release -a; uname -a; 
#1366756042
unset LANG; lsb_release -a; uname -a; 
#1366770959
w
#1366770966
clustat 
#1366771739
clustat 
#1366771744
nload 
#1366771825
cd /search/nginx/logs/
#1366771825
ll
#1366771838
cd /search/nginx/logs/
#1366771838
ll
#1366772145
cd /search/nginx/logs
#1366772146
ll
#1366772150
ll | grep error
#1366772154
ll | grep error
#1366772162
nload
#1366772192
ps aux | grep nginx
#1366772435
ll
#1366772444
ll | grep news
#1366772450
ll | grep news
#1366772457
tail news
#1366772464
ll | grep error.log 
#1366772467
cd history/nginx
#1366772467
ll
#1366772481
head error.log.2013042409
#1366772494
grep "news" error.log.2013042409
#1366772513
grep "news" error.log.2013042409 | grep "09:44"
#1366772525
grep "news" error.log.2013042409 | grep "09:44" | wc -l
#1366772538
grep "news" error.log.2013042409 | grep "09:44" | less
#1366772555
ll /usr/local/nginx/conf/vhosts/| grep news
#1366772563
grep "news.sogou.com" error.log.2013042409 | grep "09:44" | less
#1366772594
grep "news.sogou.com" error.log.2013042409 | grep "09:44" 
#1366772625
grep "server: news.sogou.com" error.log.2013042409 | grep "09:4" 
#1366772627
grep "server: news.sogou.com" error.log.2013042409 | grep "09:4" 
#1366842431
unset LANG; lsb_release -a; uname -a; 
#1366854343
cd /etc/cluster/
#1366854344
ll
#1366854359
vi cluster.conf 
#1366854428
clear
#1366854429
pwd
#1366854434
clear
#1366854436
vi cluster.conf 
#1366854578
sogou-host -a
#1366854579
clear
#1366854581
sogou-host 
#1366855885
vi cluster.conf 
#1366875534
cd /etc/cluster/
#1366875566
ll
#1366875570
vi cluster.conf 
#1366875576
clear
#1366875586
cd /usr/lib/nagios/plugins/
#1366875587
ll
#1366875613
rsync odin@10.12.143.107::search/sumiao/script/check_ilo ./
#1366875638
ll -rt
#1366875648
./check_ilo 
#1366875814
clear
#1366875821
cd /etc/nagios/
#1366875822
ll
#1366875823
vi external_command.cfg 
#1366875847
vi external_command.cfg 
#1366875961
ll /usr/lib/nagios/plugins/check_ilo
#1366876034
service nrpe restart
#1366878996
cd /etc/cluster/
#1366928852
unset LANG; lsb_release -a; uname -a; 
#1366949921
cd /usr/local/nginx/conf/vhosts/
#1366949927
vi proxy.sogou.com.conf 
#1366949959
cd /search/nginx/html/
#1366949960
ll
#1366949964
cd VPN
#1366949967
ll [B
#1366949971
vi index.html
#1366950063
vi index.html
#1366950077
ll
#1366950087
mr -f vpn_for_*
#1366950088
LL
#1366950090
ll
#1366950099
rm -rf vpn_for_*
#1366950100
ll
#1366950103
rm -f SOGOU\ VPN配置手册.docx 
#1366950103
ll
#1366950106
ll
#1366950163
ll
#1366950165
vi index.html 
#1366950237
vi index.html 
#1366956323
cd /search/nginx/logs/
#1366956323
ll
#1366956326
cd ../html/
#1366956326
ll
#1366956330
cd VPN
#1366956330
ll
#1366956344
rm -f index.html 
#1366957375
rm -f SOGOU\ VPN配置手册.docx 
#1366957436
ll
#1366972024
cd /usr/local/nginx/html/
#1366972025
ll
#1366972037
vi index.html 
#1366973652
w
#1366973652
top
#1366973802
free
#1366973816
w
#1366973818
top
#1366979561
host cloud.pinyin.sogou.com
#1366993458
cd /usr/local/nginx/logs/
#1366993459
ll
#1366993462
cd history/prox
#1366993464
pwd
#1366993472
cd /usr/local/nginx/logs/history/proxy.sogou.com
#1366993473
ll
#1366993506
cat  proxy.sogou.com_access_log* |> /search/`sogou-host|grep -v rsync`.log
#1366993511
cd /search/
#1366993511
ll
#1366993519
cd -
#1366993526
cat  proxy.sogou.com_access_log* > /search/`sogou-host|grep -v rsync`.log
#1366993529
cd /search/
#1366993530
ll
#1366993535
less proxy07.ha.cnc.log 
#1366993541
ll
#1366993611
rsync -avz *.log 10.12.143.107::search/odin/apache/test/
#1366993637
rm -f *.log
#1366993638
ll
#1367101663
unset LANG; lsb_release -a; uname -a; 
#1367188057
unset LANG; lsb_release -a; uname -a; 
#1367274462
unset LANG; lsb_release -a; uname -a; 
#1367336724
unset LANG; lsb_release -a; uname -a; 
#1367360855
unset LANG; lsb_release -a; uname -a; 
#1367387192
unset LANG; lsb_release -a; uname -a; 
#1367395869
unset LANG; lsb_release -a; uname -a; 
#1367447164
unset LANG; lsb_release -a; uname -a; 
#1367533574
unset LANG; lsb_release -a; uname -a; 
#1367619968
unset LANG; lsb_release -a; uname -a; 
#1367706371
unset LANG; lsb_release -a; uname -a; 
#1367792771
unset LANG; lsb_release -a; uname -a; 
#1367824195
clustat 
#1367824196
nload 
#1367824354
ll
#1367824358
cd /search/nginx/
#1367824359
ll
#1367824366
cd /usr/local/nginx/conf/vhosts/
#1367824367
ll
#1367824368
ll -rt
#1367824374
vi bobo.sogou.com.conf
#1367824452
/usr/local/nginx/sbin/nginx -t 
#1367824610
service nginx reload
#1367824630
curl -H "Host: bobo.sogou.com" http://localhost/
#1367824700
curl -H "Host: bobo.sogou.com" http://localhost/
#1367827572
exit
#1367879175
unset LANG; lsb_release -a; uname -a; 
#1367831909
curl -H "Host: search.waibao.sogou-inc.com" http://localhost/
#1367898474
sogou-host 
#1367922435
cd /search/nginx/logs/
#1367922435
ll
#1367922483
cd /usr/local/nginx/conf/vhosts/
#1367922484
ll
#1367922489
rm -f waibao.sogou-inc.com.conf 
#1367922499
/usr/local/nginx/sbin/nginx -t
#1367965580
unset LANG; lsb_release -a; uname -a; 
#1368052141
unset LANG; lsb_release -a; uname -a; 
#1368138560
unset LANG; lsb_release -a; uname -a; 
#1368224970
unset LANG; lsb_release -a; uname -a; 
#1368311349
unset LANG; lsb_release -a; uname -a; 
#1368397719
unset LANG; lsb_release -a; uname -a; 
#1368484164
unset LANG; lsb_release -a; uname -a; 
#1368513153
cd /search/nginx/logs/
#1368513153
ll
#1368513156
cd history/
#1368513157
ll
#1368513161
cd sto
#1368513161
ll
#1368513214
ll st41*
#1368513437
clear
#1368513470
ll -rt
#1368517945
cd /search/nginx/logs
#1368517953
tail -f jobsogou| grep hr
#1368517970
tail -f jobsogou| grep "hr.sogou.com"
#1368570546
unset LANG; lsb_release -a; uname -a; 
#1368607620
ping 10.132.3.2
#1368656929
unset LANG; lsb_release -a; uname -a; 
#1368678312
cd /search/nginx/logs/
#1368678326
tail -f account.sogou.com_access_log 
#1368708197
if  id smarton > /dev/null ; then echo ok;  setfacl -R -x u:smarton /var ; fi
#1368717769
cd /usr/local/nginx/conf/vhosts/
#1368717770
ll
#1368717774
cd /search/g
#1368717776
cd /search/nginx/
#1368717777
ll
#1368717779
cd logs/
#1368717780
ll
#1368717783
cat /etc/rc.local 
#1368717791
cat /etc/passwd
#1368743350
unset LANG; lsb_release -a; uname -a; 
#1368761942
cd /search/nginx/html/
#1368761942
ll
#1368762182
ll
#1368762186
rsync -avz apache01.profile.cnc.dt.nop.vm
#1368762186
apache02.profile.cnc.dt.nop.vm
#1368762186
apache01.profile.djt.dt.nop.vm
#1368762187
apache02.profile.djt.dt.nop.vm
#1368762187
apache03.profile.djt.dt.nop.vm
#1368762187
apache04.profile.djt.dt.nop.vm
#1368762187
apache05.profile.djt.dt.nop.vm
#1368762189
ll
#1368762226
rsync -avz rsync.repos01.cdn.djt::search/deploy/repos/cdn.sogou.com/* ./
#1368762238
ll
#1368762273
rm -rf monitor update test
#1368762276
ll
#1368762288
rm -f del_path_list
#1368762291
ll
#1368829738
unset LANG; lsb_release -a; uname -a; 
#1368916145
unset LANG; lsb_release -a; uname -a; 
#1369002536
unset LANG; lsb_release -a; uname -a; 
#1369013643
w
#1369013654
curl localhost
#1369013671
top
#1369013682
cd /search/nginx/logs/
#1369013683
ll
#1369013692
ll -h error.log 
#1369013700
> error.log 
#1369013703
ll
#1369013704
cd history/
#1369013705
ll
#1369013708
cd nginx
#1369013708
ll
#1369013711
ll -h error.log.201305
#1369013717
ll -h error.log.201305*
#1369013722
cd ../
#1369013723
cd ..
#1369013724
ll
#1369013725
tail error.log 
#1369014670
w
#1369014685
w
#1369014688
> error.log 
#1369015221
> error.log 
#1369015225
ll
#1369015228
cd history/nginx
#1369015229
ll
#1369015242
>  error.log.2013052009
#1369088965
unset LANG; lsb_release -a; uname -a; 
#1369175340
unset LANG; lsb_release -a; uname -a; 
#1369206655
ip addr
#1369231887
df -h
#1369231890
w
#1369231902
cd /search/nginx/logs/
#1369231902
ll
#1369231915
cat  status.proxy.sogou.com_access_log|grep nagios|less
#1369261747
unset LANG; lsb_release -a; uname -a; 
#1369277542
sogou-host
#1369304082
ip addr |grep "115.25.216.36"
#1369304088
ip addr
#1369304093
clustat 
#1369347978
unset LANG; lsb_release -a; uname -a; 
#1369434370
unset LANG; lsb_release -a; uname -a; 
#1369520778
unset LANG; lsb_release -a; uname -a; 
#1369607181
unset LANG; lsb_release -a; uname -a; 
#1369693573
unset LANG; lsb_release -a; uname -a; 
#1369725260
cd /usr/local/nginx/conf/vhosts/
#1369725261
ll
#1369779983
unset LANG; lsb_release -a; uname -a; 
#1369866380
unset LANG; lsb_release -a; uname -a; 
#1369952778
unset LANG; lsb_release -a; uname -a; 
#1369971204
cd /usr/local/nginx/sbin/
#1369971205
ll
#1369971216
rm -f spawn-php.sh
#1369971217
ll
#1369973269
df -h
#1369976441
ll
#1369976452
cp nginx nginx.20130531
#1369976452
ll
#1369977465
w
#1369979644
w
#1369979655
w
#1369980466
ll
#1370039197
unset LANG; lsb_release -a; uname -a; 
#1370125580
unset LANG; lsb_release -a; uname -a; 
#1370211982
unset LANG; lsb_release -a; uname -a; 
#1370254095
w
#1370254099
w
#1370254100
w
#1370254101
top
#1370254130
curl localhost
#1370254132
curl localhost
#1370254132
curl localhost
#1370254133
curl localhost
#1370254134
curl localhost
#1370254134
curl localhost
#1370254135
w
#1370254141
free
#1370254143
top
#1370277337
cd /search/nginx/html/
#1370277337
ll
#1370277354
rsync -avz 10.12.133.3::search/nginx/html/* /search/nginx/html/
#1370277360
ll
#1370277377
ll
#1370277380
cat index.html 
#1370277389
cat index.html 
#1370277404
vi index.html 
#1370298388
unset LANG; lsb_release -a; uname -a; 
#1370343560
w
#1370343563
w
#1370343563
w
#1370343565
w
#1370343570
w
#1370343571
w
#1370343572
top
#1370343582
ps aux |grep nginx
#1370343586
curl localhost
#1370343587
curl localhost
#1370343588
curl localhost
#1370343589
curl localhost
#1370343589
curl localhost
#1370343590
curl localhost
#1370343591
curl localhost
#1370343591
curl localhost
#1370343592
curl localhost
#1370343592
curl localhost
#1370343593
curl localhost
#1370343593
curl localhost
#1370343594
curl localhost
#1370343595
w
#1370343610
w
#1370343611
w
#1370343611
w
#1370343618
iostat -kx 1
#1370343625
/search/nginx/script/zabbix_ob.sh Req
#1370343631
/search/nginx/script/zabbix_ob.sh Req
#1370343642
/search/nginx/script/zabbix_ob.sh Req
#1370343644
cd /search/nginx/logs/
#1370343645
ll
#1370343648
cd latest/
#1370343648
ll
#1370343650
ll
#1370343654
ll
#1370343655
ll
#1370343656
ll
#1370343699
w
#1370343700
w
#1370384790
unset LANG; lsb_release -a; uname -a; 
#1370418393
cd /usr/local/nginx/sbin/
#1370418393
ll
#1370418421
yum clean all
#1370418435
cd /usr/local/nginx/c
#1370418436
cd /usr/local/nginx/
#1370418437
ll
#1370418440
mv conf conf.bak
#1370418441
ll
#1370418446
yum update nginx-sogou
#1370418579
ll
#1370418583
rm -rf conf
#1370418589
ll
#1370418594
mv conf.bak conf
#1370418595
ll
#1370418599
w
#1370418602
cd /search/nginx/data
#1370418603
ll
#1370418616
cp ip2location.dat.sample ip2location.dat
#1370418618
ll
#1370418622
/usr/local/nginx/sbin/nginx-t
#1370418624
/usr/local/nginx/sbin/nginx -t
#1370418635
service nginx smoothupdate
#1370418651
cd /usr/local/nginx/sbin/
#1370418651
ll
#1370418662
kill -QUIT `cat nginx.pid.oldbin`
#1370418666
ps aux |grep nginx
#1370418673
top
#1370418696
/usr/local/nginx/sbin/nginx -V
#1370418706
top
#1370419116
ps aux |grep nginx
#1370419325
w
#1370429096
w
#1370429108
w
#1370471189
unset LANG; lsb_release -a; uname -a; 
#1370427019
cd /var/log/sogou-resource-util/
#1370427020
ll
#1370427076
vi message.log.20130605 
#1370427135
cd /var/log
#1370427135
ll
#1370427139
cd sogou-resource-util/
#1370427140
ll
#1370427149
tail message.log.20130605 
#1370509980
w
#1370509985
curl localhost
#1370509992
curl localhost
#1370509993
curl localhost
#1370509995
w
#1370509995
w
#1370509996
top
#1370510042
top
#1370510050
cd /search/nginx/logs
#1370510050
ll
#1370510058
ll | grep error
#1370510060
ll | grep error
#1370510261
nload
#1370510703
nload
#1370510803
sogou-host
#1370510825
history | tail
#1370510830
history |less
#1370510894
sogou-host
#1370513191
cd /search/nginx/logs
#1370513191
ll
#1370513200
grep "config.zhushou" error.log 
#1370513213
grep "zhushou" error.log  | less
#1370557580
unset LANG; lsb_release -a; uname -a; 
#1370572557
w
#1370572566
curl localhost
#1370573525
w
#1370573527
curl localhost
#1370573532
clustat 
#1370573771
w
#1370573896
w
#1370588496
clustat 
#1370588534
sogou-host 
#1370588543
exit
#1370589275
cd /opt/sogou-pack/
#1370589276
ll
#1370589278
cd resource-util/
#1370589279
ll
#1370589281
vi ru.cfg 
#1370591916
ll
#1370596217
cd /search/nginx/logs/history/
#1370596218
ll
#1370596232
cd union.sogou.com/
#1370596233
ll
#1370596248
cat union.sogou.com_access_log.2013060711 |grep "2013-06-07 11:50:20"
#1370596259
head  union.sogou.com_access_log.2013060711 
#1370596270
cat union.sogou.com_access_log.2013060711 |grep "11:50:20"
#1370596326
cat union.sogou.com_access_log.2013060711 |grep "10.14.140.205"
#1370596364
cat union.sogou.com_access_log.2013060711 |grep "10.14.140.205"|grep "10.13.198.194"
#1370596369
cat union.sogou.com_access_log.2013060711 |grep "10.14.140.205"|grep "10.13.198.194"
#1370596819
cd /search/nginx/logs/
#1370596829
cd history/union.sogou.com
#1370596836
ll
#1370596841
ll
#1370596855
cat union.sogou.com_access_log.2013060711|grep "59.53.170.8"
#1370644003
unset LANG; lsb_release -a; uname -a; 
#1370597731
cd /opt/sogou-pack/resource-util/
#1370597731
ll
#1370597746
sogou-host
#1370598440
ll
#1370598452
cd /var/log/sogou-resource-util/
#1370598453
ll
#1370598459
tail -f message.log.20130607
#1370702459
w
#1370702684
curl localhost
#1370702685
curl localhost
#1370702694
w
#1370730405
unset LANG; lsb_release -a; uname -a; 
#1370702416
top
#1370702457
nload
#1370702536
top
#1370702667
cd /search/nginx/logs
#1370702668
ll
#1370702672
cd latest
#1370702673
ll
#1370702784
ll
#1370702792
tail nginx.lat.log.201306082245
#1370703035
ll
#1370703329
uptime
#1370761961
cd /usr/local/nginx/
#1370761961
ll
#1370761969
cp -r conf conf.20130609
#1370761970
ll
#1370763400
cd /search/
#1370763401
ll
#1370763404
rm -f *.rpm
#1370763405
ll
#1370763410
cd logs
#1370763411
ll
#1370763412
cd log
#1370763412
ll
#1370763418
cd /search/
#1370763419
ll
#1370763421
rm -rf log
#1370763422
ll
#1370763692
ll
#1370763712
rsync -avz rsync.proxy07.ha.djt::search/conf.tar /usr/local/nginx/
#1370763721
cd /usr/local/nginx/
#1370763722
ll
#1370763728
rm -rf conf
#1370763732
tar -xvf conf.tar
#1370763734
ll
#1370763740
rm -f conf.tar
#1370763741
ll
#1370763748
cat conf/nginx.conf 
#1370763761
/usr/local/nginx/sbin/nginx -t
#1370763775
service nginx reload
#1370763787
cd
#1370763790
cd /usr/local/nginx/
#1370763790
ll
#1370763792
cd /search/
#1370763793
ll
#1370763797
rm -f conf.tar
#1370763798
ll
#1370763825
cd /usr/local/nginx/html/
#1370763825
ll
#1370763827
vi index.html 
#1370763843
ll
#1370763858
vi index.html 
#1370763877
chattr +i index.html 
#1370763878
ll
#1370763907
rsync -avz odin@rsync.proxy01.ha.djt::search/nginx/html/* /search/nginx/html/
#1370763915
ll
#1370763916
ll
#1370763917
cd ..
#1370763918
ll
#1370763927
cd /search/nginx/
#1370763928
ll
#1370763932
cd data
#1370763932
ll
#1370763936
cd ..
#1370763937
ll
#1370763938
df -h
#1370763941
ll
#1370763948
rm -f nginx_fail.log
#1370763949
ll
#1370763954
cd /usr/local/nginx/
#1370763954
ll
#1370763955
cd sbin/
#1370763956
ll
#1370763966
rm -f nginx.20130531
#1370763967
ll
#1370763975
ps aux
#1370763977
ps aux|grep nginx
#1370764029
ll
#1370764031
ll
#1370816826
unset LANG; lsb_release -a; uname -a; 
#1370903214
unset LANG; lsb_release -a; uname -a; 
#1370917719
w
#1370917731
curl localhost
#1370918317
curl localhost
#1370918319
curl localhost
#1370918322
ll
#1370918328
cd /search/nginx/logs/latest/
#1370918329
ll
#1370918501
ip addr
#1370989623
unset LANG; lsb_release -a; uname -a; 
#1371076015
unset LANG; lsb_release -a; uname -a; 
#1371106063
unset LANG; lsb_release -a; uname -a; 
#1371162423
unset LANG; lsb_release -a; uname -a; 
#1371248833
unset LANG; lsb_release -a; uname -a; 
#1371335228
unset LANG; lsb_release -a; uname -a; 
#1371421619
unset LANG; lsb_release -a; uname -a; 
#1371508036
unset LANG; lsb_release -a; uname -a; 
#1371522005
cd /search/nginx/logs/
#1371522006
ll
#1371522012
cd /search/nginx/
#1371522013
cd ..
#1371522014
ll
#1371522026
rm -f nginx.err* nginx.lat*
#1371522027
ll
#1371522031
ll
#1371522060
rm -rf tmp_log hostlist.txt proxy_deploy.sh zls rescue_nginx.sh
#1371522062
ll
#1371522089
rm -rf home  proxy_1.sh monitor lost+found 
#1371522092
ll
#1371522103
ll
#1371522104
ll
#1371522106
df -h
#1371522109
ll
#1371522110
cd nginx/
#1371522111
ll
#1371522113
cd logs/
#1371522113
ll
#1371522115
cd ..
#1371522115
ll
#1371522127
chown -R odin.odin .
#1371522135
cd /usr/local/nginx/conf
#1371522135
ll
#1371522147
chown -R root.root .
#1371522224
ll
#1371522226
cd
#1371522228
cd /search/
#1371522229
ll
#1371529375
w
#1371529378
cd /search/nginx/logs/
#1371529378
ll
#1371529381
ll
#1371529385
cd ..
#1371529386
ll
#1371529395
chown -R nobody.nobody .
#1371529397
ll
#1371529399
cd logs/
#1371529400
ll
#1371529405
ll -h logs
#1371529410
ll -h error.log 
#1371529415
> error.log 
#1371529422
tail -f error.log 
#1371529441
ll
#1371529821
cd /usr/local/nginx/
#1371529821
ll
#1371529827
rm -rf conf.20130609
#1371529828
ll
#1371529829
cd sbin
#1371529830
ll
#1371529968
w
#1371594431
unset LANG; lsb_release -a; uname -a; 
#1371637514
cd /search/
#1371637515
ll
#1371637517
mkdir tmp
#1371637517
ll
#1371637519
cd tmp/
#1371637526
ftp ftp://proxy.wsfdupload.lxdns.com
#1371637545
lftp sogou@proxy.wsfdupload.lxdns.com
#1371637658
ll
#1371637662
rm -f *
#1371637668
lftp sogou@wsfdupload.lxdns.com
#1371637995
ll
#1371638000
wget -R "http://files.sogou.com/test/"
#1371638004
man wget
#1371638010
wget -r "http://files.sogou.com/test/"
#1371638017
man wget
#1371638084
wget -nd "http://files.sogou.com/test/"
#1371638094
ll
#1371638096
ll -h
#1371638097
ll
#1371638098
w
#1371638100
top
#1371638115
ll
#1371638116
cd ,,
#1371638117
cd ..
#1371638117
ll
#1371638125
cp url  url2
#1371638127
vi url2 
#1371638146
mkdir tmp2
#1371638148
cd tmp2/
#1371638173
for i in `cat ../url2`;do wget -r -nd "$i" ; done
#1371638183
ll
#1371638184
ll
#1371638186
cd ..
#1371638187
ll
#1371638194
rm -rf url2 tmp2/
#1371638194
ll
#1371638199
cd tmp/
#1371638199
ll
#1371638842
host android2.cdn.sogou.com
#1371638845
cd
#1371638854
cd /search/
#1371638854
ll
#1371638856
du -sh tmp/
#1371648980
cd /search/tmp/
#1371648980
ll
#1371648983
ll |wc -l
#1371648986
ll|less
#1371648991
ll|head
#1371649157
ll|head
#1371649221
ll
#1371649225
ll|head
#1371649226
ll|head
#1371649226
ll|head
#1371649227
ll|head
#1371649227
ll|head
#1371649227
ll|head
#1371649228
ll|head
#1371649228
ll|head
#1371649228
ll|head
#1371649237
ll |grep 130619
#1371649241
ll |grep 130619
#1371649242
ll |grep 130619
#1371649242
ll |grep 130619
#1371649243
ll |grep 130619
#1371649243
ll |grep 130619
#1371649243
ll |grep 130619
#1371649244
ll |grep 130619
#1371649246
ll |grep 130619
#1371649246
ll |grep 130619
#1371649247
ll |grep 130619
#1371649247
ll |grep 130619
#1371649455
ll |grep 130619
#1371649456
ll |grep 130619
#1371649457
ll |grep 130619
#1371649458
ll |grep 130619
#1371649458
ll |grep 130619
#1371649459
ll |grep 130619
#1371649984
wget files2.sogou.com/sogou_explorer_silent_2.0.0.891_2180.exe
#1371649996
ll sogou_explorer_silent_2.0.0.891_2180.exe*
#1371650008
ll sogou_explorer_silent_2.0.0.891_2180.exe*
#1371650012
ll sogou_explorer_silent_2.0.0.891_2180.exe.1
#1371650019
rm -f sogou_explorer_silent_2.0.0.891_2180.exe.1
#1371650020
ll
#1371650042
cd ..
#1371650042
ll
#1371650045
grep sogou_explorer_silent_2.0.0.891_2180.exe url 
#1371650059
cd tmp/
#1371650059
ll
#1371650061
ll
#1371650099
ll|head
#1371680835
unset LANG; lsb_release -a; uname -a; 
#1371703743
cd /search/nginx/logs/latest/
#1371703743
ll
#1371649169
cd /search/tmp/
#1371649169
ll
#1371649180
lftp sogou@ftp://125.39.17.8
#1371649192
lftp sogou@125.39.17.8
#1371637581
cd /search/tmp/
#1371637582
ll
#1371637583
ll
#1371637616
ll
#1371637618
ll
#1371637740
lftp sogou@wsfdupload.lxdns.com
#1371637905
ll
#1371637907
rm -rf *
#1371637908
cd ..
#1371637909
ll
#1371637912
vi tmp
#1371637916
vi txt
#1371637936
awk '{print "http://files2.sogou.com/"$NF}'
#1371637940
awk '{print "http://files2.sogou.com/"$NF}' txt
#1371637946
awk '{print "http://files2.sogou.com/"$NF}' txt >> url
#1371637946
ll
#1371637950
rm -f txt
#1371637952
cat url 
#1371637953
ll
#1371637955
cd tmp/
#1371637973
for i in `cat ../url` ;do wget "$i" ;done
#1371648915
ll
#1371648918
du -sh .
#1371648929
lftp sogou@wsfdupload.lxdns.com
#1371649288
ll
#1371649318
rm -f PreUpdater130619.exe 
#1371649323
wget files2.sogou.com/PreUpdater130619.exe 
#1371649328
lftp sogou@wsfdupload.lxdns.com
#1371651076
ll
#1371654433
lftp sogou@wsfdupload.lxdns.com
#1371715240
cd
#1371767235
unset LANG; lsb_release -a; uname -a; 
#1371853636
unset LANG; lsb_release -a; uname -a; 
#1371709913
clustat 
#1371711427
top
#1371940041
unset LANG; lsb_release -a; uname -a; 
#1372026423
unset LANG; lsb_release -a; uname -a; 
#1372078340
w
#1372078349
cd /search/nginx/logs/
#1372078359
cd /search/nginx/logs/
#1372078360
ll
#1372078365
cd latest/
#1372078366
ll
#1372078374
tail nginx.lat.log.20130624205
#1372078376
tail nginx.lat.log.201306242051
#1372078389
cd /search/
#1372078390
ll
#1372078401
rm -f 123* nginx.la* skin.ie*
#1372078401
ll
#1372078504
w
#1372078677
w
#1372078680
w
#1372078681
nload
#1372078709
w
#1372078863
w
#1372078864
ll
#1372078868
cd nginx/logs/
#1372078877
tail 123.sogou.com_access_log 
#1372079100
w
#1372079104
w
#1372079105
nload
#1372079187
w
#1372079189
top
#1372079471
nload
#1372079831
w
#1372079835
w
#1372079982
w
#1372080132
w
#1372080235
w
#1372080434
grep "175.5.18.23" 123.sogou.com_access_log |less
#1372081121
nload
#1372081273
ll
#1372081280
ll
#1372081286
cd /etc/sysconfig/
#1372081289
cat iptables
#1372081303
ll
#1372081451
iptables -F
#1372081457
cat /etc/sysconfig/iptables
#1372081473
iptables -Ln
#1372081479
iptables -ln
#1372082504
w
#1372082506
clustat 
#1372112817
unset LANG; lsb_release -a; uname -a; 
#1372199224
unset LANG; lsb_release -a; uname -a; 
#1372222628
w
#1372222755
w
#1372222759
w
#1372230219
vi /etc/hosts
#1372230274
service nginx reload
#1372230293
ps aux |grep nginx
#1372230487
ll
#1372230489
df -h
#1372230491
cd /var/
#1372230491
ll
#1372230494
du -sh *
#1372230497
cd account/
#1372230497
ll
#1372230507
> pacct
#1372230509
ll
#1372230515
rm -f pacct.*
#1372230517
l
#1372230518
ll
#1372230522
ll -h
#1372230536
ll
#1372230537
cd ..
#1372230538
ll
#1372230542
df -h
#1372230834
ll
#1372230836
free
#1372230844
ll
#1372230847
crontab -l
#1372230850
ll
#1372230853
w
#1372240721
vi /etc/hosts
#1372240742
host bbs01.ie.cnc.vm
#1372240768
service nginx reload
#1372285620
unset LANG; lsb_release -a; uname -a; 
#1372312211
curl -H "Host: extention.ie.sogou.com" "http://localhost/se_plugin/getfile?key=8f3db89aa260989bbd315c8a26764933" -I -v
#1372312223
curl -H "Host: extention.ie.sogou.com" "http://localhost/se_plugin/getfile?key=8f3db89aa260989bbd315c8a26764933" -I -v
#1372312360
curl -H "Host: extention.ie.sogou.com" "http://localhost/se_plugin/getfile?key=8f3db89aa260989bbd315c8a26764933" -I -v
#1372315257
cd /var/log/acpid 
#1372315259
cd /var/account/
#1372315261
ll
#1372315264
ll -h
#1372315283
/etc/init.d/psacct stop
#1372315285
ll
#1372315287
cd ..
#1372315287
ll
#1372315291
rm -rf account/
#1372315297
mkdir /search/account
#1372315300
df -h
#1372315317
mv /search/account/ /opt/
#1372315324
ln -s /opt/account/ account
#1372315325
ll
#1372315333
/etc/init.d/psacct start
#1372315338
ll
#1372315339
cd account/
#1372315340
ll
#1372315343
ll
#1372315345
cd /opt/
#1372315345
ll
#1372315347
cd account/
#1372315348
ll
#1372315351
crontab -l
#1372315355
ll
#1372331100
w
#1372332658
w
#1372332661
w
#1372332663
w
#1372332669
cd /search/nginx/logs/latest/
#1372332670
ll
#1372332678
w
#1372332680
ccd
#1372332689
cd /search/
#1372332690
ll
#1372332699
rm -f nginx.lat.log.201306251430
#1372332701
ll
#1372332708
crontab -l
#1372332730
ll
#1372332733
w
#1372332736
clustat 
#1372332743
w
#1372332791
w
#1372332794
ll
#1372332799
cd ac
#1372332800
ll
#1372332806
tail qul
#1372332816
iptables -l
#1372332821
iptables -L
#1372333014
ip addr
#1372333017
clustat 
#1372333067
ll
#1372333078
tail qudb
#1372333081
ll
#1372333085
quota.log
#1372333090
tail qlog
#1372333110
cat qlog
#1372333118
cat qdb
#1372333130
cat qres
#1372333250
ll
#1372333252
cat so
#1372333257
ll
#1372333262
tail qre
#1372333267
cat qres
#1372333621
ll
#1372333625
cat qres
#1372334372
cd
#1372334398
ll
#1372334400
cd /search/
#1372334401
ll
#1372334431
rsync -avz rsync.proxy01.ha.djt::search/acmilan /search/
#1372334454
rsync -avz rsync.proxy01.ha.djt::search/acmilan /search/
#1372334456
ll
#1372334486
echo "* * * * * cd /search/acmilan; ./sogou-quake" >> /var/spool/cron/root 
#1372334488
crontab -l
#1372334495
cd
#1372334501
cd /search/acmilan/
#1372334502
ll
#1372334503
crontab -l
#1372334548
w
#1372334554
crontab -l
#1372334602
iptables -L
#1372334627
iptables -L
#1372334629
iptables -L
#1372334718
w
#1372334722
iptables -Ln
#1372334724
iptables -L
#1372334744
iptables -L
#1372334810
iptables -L
#1372334813
iptables -L
#1372334841
ll
#1372334846
cat quake.res
#1372335010
cat quake.res
#1372335565
w
#1372335573
top
#1372335632
cat quake.res 
#1372335641
iptables -L
#1372372041
unset LANG; lsb_release -a; uname -a; 
#1372387345
w
#1372387353
w
#1372387354
w
#1372387355
w
#1372387356
w
#1372397372
cd /search/nginx/logs/
#1372397372
ll
#1372397374
cd /search/
#1372397375
ll
#1372397377
cd acmilan/
#1372397377
ll
#1372397411
vi sogou-quake 
#1372397447
ll
#1372397451
ll
#1372397470
cat test
#1372397471
ll
#1372397474
cat sogou-quake 
#1372397475
ll
#1372397596
ll
#1372397605
cat xxx
#1372397609
rm -f xxx
#1372397609
ll
#1372397619
rm -f 1
#1372397620
ll
#1372397626
df -h
#1372397640
cat /opt/sogou-pack/observer/conf/ob_nginx_cnc.cfg 
#1372397647
ll
#1372397653
iptables -L
#1372397681
iptables -L
#1372397697
ll
#1372397705
ll
#1372397822
rsync -avz 10.136.120.65::search/acmilan/sogou-quake /search/acmilan/
#1372397828
ll
#1372397835
ll
#1372397840
iptables -F
#1372397841
ll
#1372397848
cat quake.db
#1372397853
ll
#1372397854
ll
#1372397857
cat quake.res
#1372397865
iptables -L
#1372397873
vi sogou-quake 
#1372397886
ll
#1372397889
cd snapshot/
#1372397890
ll
#1372397896
cd ..
#1372397897
ll
#1372397902
vi sogou-quake 
#1372397931
vi sogou-quake 
#1372397935
ll
#1372397939
iptables -F
#1372397940
ll
#1372397942
ll
#1372397947
cat quake.db
#1372397969
iptables -L
#1372397980
ll
#1372397984
cat quake.log 
#1372398178
ll
#1372398180
ll -h
#1372398183
ll
#1372398187
iptables -L
#1372398205
ll
#1372398206
w
#1372398209
iptables -L
#1372398213
ll
#1372398216
cat quake.res
#1372145935
top
#1372145981
clustat 
#1372403107
ll rescue_nginx.sh
#1372403116
sogou-host 
#1372403142
ll
#1372403166
cp rescue_nginx.sh  /search/
#1372403183
clear
#1372403237
rsync odin@rsync.proxy01.ha.djt::search/rescue_nginx.sh ./
#1372403250
vi rescue_nginx.sh 
#1372405767
cd /sae
#1372405768
cd /search/
#1372405769
ll
#1372405770
cd tmp/
#1372405771
ll
#1372405774
history |grep ftp
#1372405778
lftp sogou@wsfdupload.lxdns.com
#1372407769
lftp sogou_ime@125.39.17.8
#1372407843
lftp sogou@125.39.17.8
#1372407924
lftp sogou_ime@125.39.17.8
#1372412161
cd
#1372458454
unset LANG; lsb_release -a; uname -a; 
#1372544838
unset LANG; lsb_release -a; uname -a;

修复方案：

.bash_history保存了最近使用过的一些命令。
建议删除。

版权声明：转载请注明来源 m1x7e1@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2014-02-16 17:08

厂商回复：

感谢提供

最新状态：

暂无