BeyondDimension / BeyondDimension/SteamTools

🐛[BUG] 关于火绒报告steam++进程进行网络攻击的反馈

Open
#3,257 0 comments 0 reactions 0 assignees View on GitHub
bug cannot-reproduce
Dominant language
C#
Stars
26.8k
Forks
1.7k
PR merge metrics
No merged PRs in 30d

Description

## 请认真检查以下清单中的每一项
-

- [ ] 已经搜索过,没有发现类似的 issue
- [ ] 已经搜索过文档,没有发现相关内容
- [ ] 已经尝试使用过最新版,问题依旧存在
- [ ] 使用的是官方版本(未替换及修改过安装目录程序文件)

### 🐛 描述

### 📷 复现步骤

【1】2024-03-11 22:25:02,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止

攻击方式:Exploit/CVE-2017-10271
访问地址:172.180.46.106/wls-wsat/CoordinatorPortType
远程地址:172.180.40.21:43580
本地地址:172.180.46.106:80
防御结果:已阻止

进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【2】2024-03-11 22:25:01,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止

攻击方式:Exploit/CVE-2019-2725
访问地址:172.180.46.106/_async/AsyncResponseService
远程地址:172.180.40.21:49516
本地地址:172.180.46.106:80
防御结果:已阻止

进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【3】2024-03-11 22:25:00,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止

攻击方式:Exploit/CVE-2017-10271
访问地址:172.180.46.106/wls-wsat/CoordinatorPortType
远程地址:172.180.40.21:49542
本地地址:172.180.46.106:80
防御结果:已阻止

进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【4】2024-03-11 22:24:13,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止

攻击方式:Exploit/CVE-2022-26134
访问地址:172.180.46.106/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
远程地址:172.180.40.21:49534
本地地址:172.180.46.106:80
防御结果:已阻止

进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

【5】2024-03-11 22:24:12,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止

攻击方式:Exploit/CVE-2022-26134
访问地址:172.180.46.106/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
远程地址:172.180.40.21:49504
本地地址:172.180.46.106:80
防御结果:已阻止

进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
### 📄 日志信息

### 🖼 截图

### 🚑 其他信息

- 处理器体系结构:X64
- 系统版本号:Windows11.22631.3155
- 下载渠道:微软商店
- 程序版本:3.0.0
- 是否包含独立运行时:

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.