可达鸭-解锁专用文件 - Verion 0.2 2024-10-12

当前系统用户: | 当前脚本所有者: hotlider

当前操作系统: Linux web15.fvds.ru 6.1.0-45-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.170-1 (2026-04-30) x86_64
当前服务器 IP 地址: 127.0.0.1
当前 PHP 版本: 7.0.33
服务器当前时间: 2026-09-04 20:37:31
当前没有使用 PHP-FPM。

正在运行的 PHP 进程:

root         696  0.0  0.0 222004  2188 ?        Ss   Aug26   1:14 php-fpm: master process (/opt/php74/etc/php-fpm.conf)
root         697  0.0  0.0 264460  2000 ?        Ss   Aug26   1:12 php-fpm: master process (/etc/php/8.2/fpm/php-fpm.conf)
www-data     955  0.0  0.0 264452   976 ?        S    Aug26   0:00 php-fpm: pool www-data
www-data     956  0.0  0.0 264452     0 ?        S    Aug26   0:00 php-fpm: pool www
www-data     957  0.0  0.0 264452     0 ?        S    Aug26   0:00 php-fpm: pool www
root         965  0.0  0.0 158360  2672 ?        Ss   Aug26   1:42 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data  938371  0.0  0.0 158432  3200 ?        S    19:46   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1160726  0.0  0.0 158432  3200 ?        S    20:12   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1261802  0.0  0.0 158432  3200 ?        S    20:25   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344701  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344839  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344840  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344841  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344961  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344963  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344965  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
hotlider 1365231  0.0  0.1 158704 15156 ?        S    20:37   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
hotlider 1365232  0.0  0.0   2584   944 ?        S    20:37   0:00 sh -c ps aux | grep php
hotlider 1365234  0.0  0.0   3332  1676 ?        S    20:37   0:00 grep php

加载的PHP扩展: Core, date, libxml, openssl, pcre, sqlite3, zlib, bz2, calendar, ctype, hash, fileinfo, filter, ftp, gettext, gmp, SPL, iconv, Reflection, session, standard, shmop, SimpleXML, sockets, mbstring, tokenizer, xml, apache2handler, mysqlnd, PDO, curl, dom, gd, intl, json, exif, mcrypt, memcache, memcached, mysqli, pdo_mysql, Phar, soap, sodium, xmlreader, xmlrpc, xmlwriter, zip, Zend OPcache

正在运行的 PHP 进程:

Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format
Invalid process data format

当前PHP脚本的进程ID: 1365231

开始kill PHP进程...

696 ? 00:01:14 php-fpm 进程 696 已 Kill.⚔️
697 ? 00:01:12 php-fpm8.2 进程 697 已 Kill.⚔️
955 ? 00:00:00 php-fpm8.2 进程 955 已 Kill.⚔️
956 ? 00:00:00 php-fpm8.2 进程 956 已 Kill.⚔️
957 ? 00:00:00 php-fpm8.2 进程 957 已 Kill.⚔️
112524 ? 00:54:12 BnAudisp.php 进程 112524 已 Kill.⚔️
共终止PHP进程数: 6

检查定时任务

内容来自 /etc/crontab

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *	* * *	root	cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }
47 6	* * 7	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }
52 6	1 * *	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; }
#

内容来自 /var/spool/cron/crontabs/

内容来自 /etc/cron.d/

/etc/cron.d/atopPATH=/bin:/usr/bin:/sbin:/usr/sbin

# daily restart of atop at midnight
0 0 * * * root [ -d "/run/systemd/system" ] || /usr/share/atop/atop.daily&
/etc/cron.d/awstatsMAILTO=root

*/10 * * * * www-data [ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh

# Generate static reports:
10 03 * * * www-data [ -x /usr/share/awstats/tools/buildstatic.sh ] && /usr/share/awstats/tools/buildstatic.sh
/etc/cron.d/e2scrub_all30 3 * * 0 root test -e /run/systemd/system || SERVICE_MODE=1 /usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron
10 3 * * * root test -e /run/systemd/system || SERVICE_MODE=1 /sbin/e2scrub_all -A -r
/etc/cron.d/php# /etc/cron.d/php@PHP_VERSION@: crontab fragment for PHP
#  This purges session files in session.save_path older than X,
#  where X is defined in seconds as the largest value of
#  session.gc_maxlifetime from all your SAPI php.ini files
#  or 24 minutes if not defined.  The script triggers only
#  when session.save_handler=files.
#
#  WARNING: The scripts tries hard to honour all relevant
#  session PHP options, but if you do something unusual
#  you have to disable this script and take care of your
#  sessions yourself.

# Look for and purge old sessions every 30 minutes
09,39 *     * * *     root   [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi
/etc/cron.d/roundcube-core# Note: This is a no-op when PID1 is systemd
#
# Database cleaning: remove old records that were marked as deleted
0 5 * * * www-data test -d /run/systemd/system || /usr/share/roundcube/bin/cleandb.sh >/dev/null

# Purge expired sessions, caches and tempfiles
* 5 * * * www-data test -d /run/systemd/system || /usr/share/roundcube/bin/gc.sh

文件路径: /var/www/hotlider/data/www/hotlider.ru/index.php
index.php 文件有读取权限。
文件最后修改时间: 2026-05-22 17:09:01
🚩index.php 文件没有被锁🔓 (有写权限 0644)
👉通过大马，人工修改 index.php 并上挟持修改看看，改成功的话，查杀所有大小马。持续观测几分钟，几小时看看还在不在，不在的话说明有其他备马或者漏洞
至于上锁继续用ww上锁工具和ww小火车守护试试，同时观测是否有争抢行为

该站点不是 WordPress 站点。

输入指定单文件路径

unLocker

执行环境检测 - 执行函数检查

exec: Enabled
passthru: Enabled
system: Enabled
shell_exec: Enabled

输入php代码开始执行

Output:

root         696  0.0  0.0 222004  2188 ?        Ss   Aug26   1:14 php-fpm: master process (/opt/php74/etc/php-fpm.conf)
root         697  0.0  0.0 264460  2000 ?        Ss   Aug26   1:12 php-fpm: master process (/etc/php/8.2/fpm/php-fpm.conf)
www-data     955  0.0  0.0 264452   976 ?        S    Aug26   0:00 php-fpm: pool www-data
www-data     956  0.0  0.0 264452     0 ?        S    Aug26   0:00 php-fpm: pool www
www-data     957  0.0  0.0 264452     0 ?        S    Aug26   0:00 php-fpm: pool www
root         965  0.0  0.0 158360  2672 ?        Ss   Aug26   1:42 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data  938371  0.0  0.0 158432  3200 ?        S    19:46   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1160726  0.0  0.0 158432  3200 ?        S    20:12   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1261802  0.0  0.0 158432  3200 ?        S    20:25   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344701  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344839  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344840  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344841  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344961  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344963  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
www-data 1344965  0.0  0.0 158432  3360 ?        S    20:34   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
hotlider 1365231  0.0  0.1 158704 15156 ?        S    20:37   0:00 /usr/sbin/apache2 -d /etc/apache2-isp-php70 -k start
hotlider 1365232  0.0  0.0   2584   944 ?        S    20:37   0:00 sh -c ps aux | grep php
hotlider 1365234  0.0  0.0   3332  1676 ?        S    20:37   0:00 grep php