网站骇客攻击手法：病毒蠕虫、后门危险文件清单

如果你是管理 WordPress、Joomla、Drupal 等 CMS 内容网站、论坛或自架网站的 IT 技术管理者，建议定期检查网站目录是否有不明来源或名称可疑的陌生文件。

如果在网站目录或子目录中发现不明来源的文件，很有可能是黑帽骇客（Black Hat，又称网络犯罪者（Cybercriminal））使用的攻击工具，如病毒蠕虫或后门。他们甚至可能会利用你的网站进行攻击，攻击其他网站。

笔者先前写过一篇《资安漏洞：WordPress 11 种外挂 Plugins 和布景主题 Themes 安全性问题》2介绍 WordPress 网站经常遇到的危险。

但是现代骇客的攻击手法时常变动，我们特别将比较常见的危险文件名称整理于本文章，并且随时更新以后市面上常见的最新信息，让大家在检查自家网站的目录时，可以有个参考样本。

危险文件名称列表

网站根目录

• Sisi.php
• user.php
• seter.php
• ivjzx.php
• zkuhj.php
• yt.php
• wp-config.original
• 1ndex.php

网站子目录

• /plus/flink.php
• /plus/moon.php
• /plus/download.php
• /plus/mytag_js.php
• /admin/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php
• /editor/editor/filemanager/connectors/aspx/connector.aspx
• /assets/modules/evogallery/js/uploadify/uploadify.php
• /modules/vtemskitter/uploadimage.php
• /modules/verticalmegamenus/VerticalMegaMenusUploadImage.php
• /modules/groupcategory/GroupCategoryUploadImage.php
• /不特定目录/wlwmanifest.xml

WordPress Plugins 外挂

• /wp-content/plugins/wp-symposium/server/php/index.php
• /wp-content/plugins/mac-dock-gallery/macdownload.php
• /wp-content/plugins/dzs-zoomsounds/admin/upload.php
• /wp-content/plugins/reflex-gallery/admin/scripts/FileUploader/php.php
• /wp-content/plugins/cherry-plugin/admin/import-export/upload.php
• /wp-content/plugins/Tevolution/tmplconnector/monetize/templatic-custom_fields
• /wp-content/plugins/wp-property/third-party/uploadify/uploadify.php
• /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php
• /wp-content/plugins/dzs-videogallery/admin/upload.php
• /wp-content/plugins/barclaycart/uploadify/uploadify.php
• /wp-content/plugins/sexy-contact-form/includes/fileupload/index.php
• /wp-content/plugins/pitchprint/uploader/
• /wp-content/plugins/cnhk-slideshow/uploadify/uploadify.php
• /wp-content/plugins/custom-background/uploadify/uploadify.php
• /wp-content/plugins/asset-manager/upload.php
• /wp-content/plugins/wordpress-member-private-conversation/doupload.php
• /wp-content/plugins/flipbook/php.php
• /wp-content/plugins/wpstorecart/php/upload.php
• /wp-content/plugins/wpshop/includes/ajax.php?elementCode=ajaxUpload
• /wp-content/plugins/wp-symposium/js/uploadify/uploadify.php
• /wp-content/plugins/formcraft/file-upload/server/php/
• /wp-content/plugins/pica-photo-gallery/picaPhotosResize.php
• /wp-content/plugins/wp-copysafe-pdf/lib/uploadify/uploadify.php
• /wp-content/plugins/woocommerce-custom-t-shirt-designer/includes/templates/
• /wp-content/plugins/acf-frontend-display/js/blueimp-jQuery-File-Upload-d45deb1
• /wp-content/plugins/omni-secure-files/plupload/examples/upload.php
• /wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php
• /wp-content/plugins/wordpress-member-private-conversation/doupload.php
• /wp-content/plugins/wp-checkout/vendors/uploadify/upload.php
• /wp-content/plugins/logosware-suite-uploader/lw-suite-uploader.php
• /wp-content/plugins/viral-optins/api/uploader/file-uploader.php
• /wp-content/themes/purevision/scripts/admin/uploadify/uploadify.php

WordPress Theme 布景主题

• /wp-content/themes/evolve/js/back-end/libraries/fileuploader/upload_handler.php
• /wp-content/themes/satoshi/functions/upload-handler.php
• /wp-content/themes/multimedia1/server/php/
• /wp-content/themes/betheme/muffin-options/fields/upload/field_upload.php
• /wp-content/themes/u-design/scripts/admin/uploadify/uploadify.php
• /wp-content/themes/dandelion/functions/upload-handler.php
• /wp-content/themes/highlight/lib/utils/upload-handler.php
• /wp-content/themes/dance-studio/core/libs/imperavi/tests/file_upload.php
• /wp-content/themes/ithemes2/themify/themify-ajax.php?upload=1
• /wp-content/themes/amplus/functions/upload-handler.php
• /wp-content/themes/AdvanceImage5/header.php
• /wp-content/themes/konzept/includes/uploadify/upload.php
• /wp-content/themes/RightNow/includes/uploadify/upload_settings_image.php
• /wp-content/themes/cubed_v1.2/functions/upload-handler.php
• /wp-content/themes/MoneyTheme/uploads/upload.php
• /wp-content/themes/eptonic/functions/jwpanel/scripts/valums_uploader/php.php
• /wp-content/themes/pinboard/themify/themify-ajax.php?upload=1

Joomla、Drupal、论坛网站

• empty

参考文献

1. WordPress 根目录检查 wp-config.??? 不明文件｜网络安全漏洞
2. 资安漏洞：WordPress 11 种外挂 Plugins 和布景主题 Themes 安全性问题