{"id":88,"date":"2021-04-21T15:56:16","date_gmt":"2021-04-21T06:56:16","guid":{"rendered":"https:\/\/rfsec.ddns.net\/db\/?page_id=88"},"modified":"2021-05-27T16:04:36","modified_gmt":"2021-05-27T07:04:36","slug":"access","status":"publish","type":"page","link":"https:\/\/rfsec.ddns.net\/db\/?page_id=88","title":{"rendered":"\u65e5\u3005\u306e\u602a\u3057\u3052\u306a\u30a2\u30af\u30bb\u30b9\u5143\u30c8\u30c3\u30d7\uff15"},"content":{"rendered":"\n<p><a href=\"https:\/\/rfsec.ddns.net\/log.php\"><strong>\u30ed\u30b0\u8868\u793a<\/strong><\/a><\/p>\n\n\n\n<p>apache\u306e\u30a2\u30af\u30bb\u30b9\u30ed\u30b0(\/var\/log\/apache2\/access.log.*)\u3092\u89e3\u6790\u3057\u3001\u5b58\u5728\u3057\u306a\u3044\u30d5\u30a1\u30a4\u30eb\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a66\u307f\u308b\u30a2\u30af\u30bb\u30b9\u5143\u306eIP\u3068\u30a2\u30af\u30bb\u30b9\u306eRequest\u306a\u3069\u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<p>\u30b9\u30c6\u30c3\u30d7\uff11\uff1a\u4e00\u6b21\u51e6\u7406\u3002\u5b9a\u671f\u7684\u306b\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3057\u3066\u4e0d\u5be9\u306a\u30a2\u30af\u30bb\u30b9\u5143\u306e\u30c8\u30c3\u30d7\uff15\u3092\u51fa\u529b\u3059\u308b\u3002\uff08\u30a2\u30af\u30bb\u30b9\u56de\u6570\u3001\u30a2\u30af\u30bb\u30b9\u5143IP\u3001\u56fd\u30b3\u30fc\u30c9\uff09<\/p>\n\n\n\n<p>\u30b9\u30c6\u30c3\u30d7\uff12\uff1a\u30d6\u30b5\u30a6\u30b6\u30fc\u304b\u3089\u306e\u300c\u30ed\u30b0\u8868\u793a\u300d\u306e\u8981\u6c42\u306b\u3057\u305f\u304c\u3063\u3066\u3001\u904e\u53bb\uff17\u65e5\u5206\u306e\u8868\u3092\u8868\u793a\u3059\u308b\u3002\u8868\u4e2d\u306e\u30a2\u30af\u30bb\u30b9\u5143IP\u3092\u30af\u30ea\u30c3\u30af\u3057\u305f\u3089\u3001\u751f\u30ed\u30b0(\/var\/log\/apache2\/access.log*)\u304b\u3089R\u8a72\u5f53\u3059\u308b\u884c\u3092\u8868\u793a\u3059\u308b\u3002<\/p>\n\n\n\n<p><strong>cat \/var\/log\/apache2\/access.log \/var\/log\/apache2\/access.log.1 | \/usr\/bin\/php \/root\/apt.php<\/strong><\/p>\n\n\n\n<p><strong>\u30b9\u30c6\u30c3\u30d7\uff11\uff1aapt.php\u306e\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9<\/strong><\/p>\n\n\n\n<div class=\"hcb_wrap\"><pre class=\"prism line-numbers lang-php\" data-lang=\"PHP\"><code>#!\/usr\/bin\/php\n&lt;?php\n$TOP=5;\n$PATH=&quot;\/var\/www\/html\/log&quot;; \u3000\/\/ 1\u6b21\u51e6\u7406\u7d50\u679c\u306e\u4fdd\u5b58\u5148\n$mDB=array(&#39;Jan&#39;,&#39;Feb&#39;,&#39;Mar&#39;,&#39;Apr&#39;,&#39;May&#39;,&#39;Jun&#39;,&#39;Jly&#39;,&#39;Aug&#39;,&#39;Sep&#39;,&#39;Oct&#39;,&#39;Nov&#39;,&#39;Dec&#39;);\n\n$fp=fopen(&quot;php:\/\/stdin&quot;,&quot;r&quot;);\nwhile($in=fgets($fp)){\n        $t=explode(&#39; &#39;,$in);\n        $ip=$t[0];\n        $tmp=substr($t[3],1);\n        $s=explode(&#39;\/&#39;,$tmp);\n        $day=$s[0];\n        $year=substr($s[2],0,4);\n        $mo=array_search($s[1],$mDB)+1;\n        if($mo&lt;10) $mo=&#39;0&#39;.$mo;\n        $date=$year.$mo.$day;\n        #echo &quot;$ip,$year$mo$day\\n&quot;;\n        if(strpos($in,&#39; 404 &#39;)&gt;0){\n                @$buf[$date][$ip]++;\n        }\n}\nfclose($fp);\narsort($buf);\nforeach($buf as $date =&gt;$ip_array){\n        arsort($ip_array);\n        echo &quot;---$PATH\/$date---\\n&quot;;\n        $fw=fopen(&quot;$PATH\/$date.txt&quot;,&quot;w&quot;);\n        $n=0;\n        foreach($ip_array as $ip =&gt;$count){\n        \/\/      echo &quot;$ip,$count\\n&quot;;\n           if(substr($ip,0,10)!=&#39;192.168.68&#39; &amp;&amp; $ip!=&#39;::1&#39;){\n                try{\n                $country=geoip_country_code_by_name($ip);\n                if(trim($country)==&quot;&quot;) $country=`whois $ip | grep -m1 country | awk &#39;{print $2}&#39;`;\n                } catch (Exception $e ) {\n                        $country=`whois $ip | grep -m1 country | awk &#39;{print $2}&#39;`;\n                        if($country=&quot;&quot;) $country=&quot;??&quot;;\n                }\n                $country=trim($country);\n                $msg= &quot;$count $ip $country\\n&quot;;\n                fwrite($fw,$msg);\n                $n++;\n                if($n&gt;$TOP) break;\n           }\n        }\n        fclose($fw);\n}\n?&gt;<\/code><\/pre><\/div>\n\n\n\n<p><strong>apt.php\u30b9\u30af\u30ea\u30d7\u30c8\u51fa\u529b\u306e\u4e00\u4f8b<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>968 43.243.222.44 HK\n61 92.63.196.29 RU\n25 45.155.205.27 RU\n16 104.131.73.21 US\n6 121.196.182.183 CN\n<\/code><\/pre>\n\n\n\n<p><strong>\u30ed\u30b0\u8868\u793a\u306e\u305f\u3081\u306b\u30d6\u30e9\u30a6\u30b6\u30fc\u304b\u3089\u30a2\u30af\u30bb\u30b9\u3059\u308bPHP\u30d5\u30a1\u30a4\u30eb<\/strong><\/p>\n\n\n\n<div class=\"hcb_wrap\"><pre class=\"prism line-numbers lang-php\" data-lang=\"PHP\"><code>&lt;HTML&gt;\n&lt;head&gt;\n&lt;link rel=&quot;stylesheet&quot; type=&quot;text\/css&quot; href=&quot;\/st1.css&quot;&gt;\n&lt;\/head&gt;\n&lt;?php\n$TOP=5;\n\necho &quot;&lt;H3&gt;\u602a\u3057\u3044\u30a2\u30af\u30bb\u30b9\u5143\u30c8\u30c3\u30d7\uff15&lt;\/H3&gt;\\n&quot;;\n\nfor($i=0;$i&lt;=7;$i++){\n        $date=date(&quot;Ymd&quot;,time()- $i * 60 * 60 * 24);    \/\/ $i days ago\n        $file=&quot;log\/$date.txt&quot;;\n        if(file_exists($file)){\n                $data=file($file);\n              $msg=&quot;&lt;H3&gt;$date2&lt;\/H3&gt;\\n&quot;;\n                if( $i % 2 ==1 ){\n                        $msg=&quot;&lt;TABLE width=400 border=1&gt;&lt;CAPTION&gt;&lt;B&gt;$date&lt;\/B&gt;&lt;\/CAPTION&gt;&lt;TR&gt;&quot;;\n                } else {\n                        $msg=&quot;&lt;TABLE border=1&gt;&lt;TD valign=\\&quot;top\\&quot;&gt;\\n&lt;TABLE width=400 border=1&gt;&lt;CAPTION&gt;&lt;B&gt;$date&lt;\/B&gt;&lt;\/CAPTION&gt;&lt;TR&gt;&quot;;\n                }\n                $n=1;\n                foreach($data as $line){\n                        $tmp=trim($line);\n                        $t=explode(&#39; &#39;,$tmp);\n                        for($m=0;$m&lt;3;$m++){\n                                if($m==1){\n                                        $ip=$t[$m];\n                                        $ref=&quot;&lt;a href=proc.php?date=$date&amp;ip=$ip&gt;$ip&lt;\/a&gt;&quot;;\n                                        $msg.=&quot;&lt;TD&gt;$ref&lt;\/TD&gt;&quot;;\n                                } else {\n                                        $msg.=&quot;&lt;TD&gt;$t[$m]&lt;\/TD&gt;&quot;;\n                                }\n                        }\n                        $msg.=&quot;&lt;\/TR&gt;&quot;;\n                }\n                        if( ($i % 2 ) == 1 ){\n                                $msg.=&quot;&lt;\/TR&gt;&lt;\/TABLE&gt;&lt;\/TD&gt;&lt;\/TABLE&gt;\\n&quot;;\n                        } else {\n                                $msg.=&quot;&lt;\/TR&gt;&lt;\/TABLE&gt;&lt;\/TD&gt;&lt;TD valign=\\&quot;top\\&quot;&gt;&quot;;\n                        }\n                echo &quot;$msg\\n&quot;;\n\/\/              print_r($data);\n        }\n}\n?&gt;\n&lt;\/HTML&gt;<\/code><\/pre><\/div>\n\n\n\n<p>\u751f\u30ed\u30b0\u304b\u3089\u8a72\u5f53\u7b87\u6240\u3092\u62bd\u51fa\u3059\u308b\u30b9\u30af\u30ea\u30d7\u30c8<\/p>\n\n\n\n<div class=\"hcb_wrap\"><pre class=\"prism line-numbers lang-php\" data-lang=\"PHP\"><code>&lt;?php\nif (isset($argv)){\n        $date  =$argv[1];\n        $ip    =$argv[2];\n} else {\n        $date  = htmlspecialchars($_GET[&quot;date&quot;]);\n        $ip    = htmlspecialchars($_GET[&quot;ip&quot;]);\n}\n$mDB=array(&#39;Jan&#39;,&#39;Feb&#39;,&#39;Mar&#39;,&#39;Apr&#39;,&#39;May&#39;,&#39;Jun&#39;,&#39;Jly&#39;,&#39;Aug&#39;,&#39;Sep&#39;,&#39;Oct&#39;,&#39;Nov&#39;,&#39;Dec&#39;);\n$year=substr($date,0,4);\n$day=substr($date,6,2);\n$mo =$mDB[(int)(substr($date,4,2))-1];\n$dateS= $day.&quot;\/&quot;.$mo.&quot;\/&quot;.$year;\n$name=&quot;\/var\/log\/apache2\/$f_name&quot;;\necho &quot;&lt;H3&gt;DATE:$date  IP:$ip&lt;\/H3&gt;&quot;;\necho &quot;\\n&quot;;\n$today    = date(&quot;Ymd&quot;);\n$tmp      = mktime(0, 0, 0, date(&quot;m&quot;)  , date(&quot;d&quot;)-1, date(&quot;Y&quot;));\n$yesterday= date(&#39;Ymd&#39;,$tmp);\n\nfunction proc_msg($in,$date,$ip){\n        $msg=&quot;&quot;;\n        if(strpos($in,$ip)===0 &amp;&amp; strpos($in,$date)&gt;0){\n                $in=str_replace(&#39; - - &#39;,&#39;&#39;,$in);\n                $in=str_replace(&#39; +0900&#39;,&#39;&#39;,$in);\n                $t=explode(&quot;\\&quot;&quot;,$in);\n                $s=explode(&#39;:&#39;,$t[0]);\n                $time=&quot;$s[1]:$s[2]:$s[3]&quot;;\n                $time=str_replace(&#39;]&#39;,&#39;&#39;,$time);\n                $msg= &quot;&lt;TR&gt;&lt;TD&gt;$time&lt;\/TD&gt;&lt;TD&gt;$t[1]&lt;\/TD&gt;&lt;TD&gt;$t[2]&lt;\/TD&gt;&lt;\/TR&gt;\\n&quot;;\n        }\n        return $msg;\n}\n\nfunction proc($fp,$date,$ip){\n        $msg= &quot;&lt;table&gt;&lt;TR BGCOLOR=lightblue&gt;&lt;TD&gt;Time&lt;\/TD&gt;&lt;TD&gt;Request&lt;\/TD&gt;&lt;TD&gt;Result&lt;\/TD&gt;&lt;\/TR&gt;\\n&quot;;\n        $n=strlen($msg);\n        while ($in=fgets($fp)){\n                $msg.=proc_msg($in,$date,$ip);\n        }\n        if(strlen($msg)&gt;$n){\n                $msg.=&quot;&lt;\/TABLE&gt;&quot;;\n                echo $msg;\n        }\n        fclose($fp);\n}\n\nfunction procGZ($fp,$date,$ip){\n        $msg= &quot;&lt;table&gt;&lt;TR BGCOLOR=lightblue&gt;&lt;TD&gt;Time&lt;\/TD&gt;&lt;TD&gt;Request&lt;\/TD&gt;&lt;TD&gt;Result&lt;\/TD&gt;&lt;\/TR&gt;\\n&quot;;\n        $n=strlen($msg);\n        while ($in=gzgets($fp)){\n                $msg.=proc_msg($in,$date,$ip);\n        }\n        if(strlen($msg)&gt;$n){\n                $msg.=&quot;&lt;\/TABLE&gt;&quot;;\n                echo $msg;\n        }\n        fclose($fp);\n}\n\n\/\/echo &quot;$date,$today,$yesterday&lt;BR&gt;&quot;;\n$off=(int)$today - (int)$date;\nif($off&lt;=2){\n        $fp1=fopen(&quot;\/var\/log\/apache2\/access.log&quot;,&quot;r&quot;);\n        proc($fp1,$dateS,$ip);\n        $fp2=fopen(&quot;\/var\/log\/apache2\/access.log.1&quot;,&quot;r&quot;);\n        proc($fp2,$dateS,$ip);\n} else {\n        $off--;\n        $gz_file=&quot;\/var\/log\/apache2\/access.log.$off.gz&quot;;\n        echo &quot;$gz_file&lt;BR&gt;\\n&quot;;\n        $fp3=gzopen($gz_file,&quot;r&quot;);\n        procGZ($fp3,$dateS,$ip);\n}\n?&gt;<\/code><\/pre><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u30ed\u30b0\u8868\u793a apache\u306e\u30a2\u30af\u30bb\u30b9\u30ed\u30b0(\/var\/log\/apache2\/access.log.*)\u3092\u89e3\u6790\u3057\u3001\u5b58\u5728\u3057\u306a\u3044\u30d5\u30a1\u30a4\u30eb\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a66\u307f\u308b\u30a2\u30af\u30bb\u30b9\u5143\u306eIP\u3068\u30a2\u30af\u30bb\u30b9\u306eRequest\u306a\u3069\u3092\u8868\u793a\u3057\u307e\u3059\u3002 \u30b9\u30c6\u30c3\u30d7\uff11\uff1a\u4e00 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-88","page","type-page","status-publish","hentry"],"featured_image_src":null,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=\/wp\/v2\/pages\/88","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=88"}],"version-history":[{"count":8,"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=\/wp\/v2\/pages\/88\/revisions"}],"predecessor-version":[{"id":207,"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=\/wp\/v2\/pages\/88\/revisions\/207"}],"wp:attachment":[{"href":"https:\/\/rfsec.ddns.net\/db\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=88"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}