What should I do if the website is infected with a WebShell Trojan? Use these methods to solve the problem quickly.

2、 How does WebShell invade the system?

1. Upload the WebShell script by using the upload business on the system front end. The uploaded directory often has executable permissions. In places where images and data files are uploaded on the web, the complete URL information of the uploaded files is usually returned to the client after uploading. Sometimes there is no feedback. We can also guess that under the common image, upload and other directories, if the web does not strictly control the access permissions of the website or folder directory, it may be used for webshell attacks, Attackers can use the upload function to upload a script file, then access the script through the url, and the script will be executed. Then the hacker can upload the webshell to any directory of the website, thus obtaining the administrator control permission of the website.

(Shangpin China website construction)

2. The customer obtains the administrator's background password, logs in to the background system, uses the background management tool to write the WebShell Trojan to the configuration file, or the hacker adds the upload type privately, allowing the script program to upload files in the format of asp and php.

3. Use the database backup and recovery function to obtain the webshell. For example, change the suffix of the backup file to asp during backup. Or there is MySQL data query function in the background, and hackers can execute select In To outfile queries the output php file, and then inserts the code into mysql, resulting in the generation of a webshell trojan.

4. Other sites of the system are attacked, or the ftp server is also installed on the server. The ftp server is attacked, and then it is injected into the webshell trojan, and then the website system is also infected.

5. The hacker directly attacks the web server system, and the web server may also have loopholes at the system level. If the hacker attacks the server system by using its loopholes, the hacker can upload webshell files in the web server directory after obtaining its permissions.

4、 What are the important reasons why WebShell can be rampant?

1. WebShell can be injected to a large extent because of the win2003 IIS 6.0 environment. In the IIS 6.0 environment, we upload a test. asp It is found that the jpg shell file can be uploaded successfully when it is uploaded, because the image file monitored as jpg is executed as a dynamic web page file of asp when it is parsed by iis6.0. So we know the common features of webshell trojans: x.asp png,x.php;. txt...

2. The malicious script of the WebShell is mixed with the normal web page file. At the same time, the server controlled by the hacker and the remote host transmit data through port 80, which will not be intercepted by the firewall, and generally will not leave a record in the system log. It has strong concealment and is generally not easy to be killed.