BeyondDimension / BeyondDimension/SteamTools
🐛[BUG] 关于火绒报告steam++进程进行网络攻击的反馈
- Dominant language
- C#
- Stars
- 26.8k
- Forks
- 1.7k
- PR merge metrics
- No merged PRs in 30d
Description
## 请认真检查以下清单中的每一项
-
- [ ] 已经搜索过,没有发现类似的 issue
- [ ] 已经搜索过文档,没有发现相关内容
- [ ] 已经尝试使用过最新版,问题依旧存在
- [ ] 使用的是官方版本(未替换及修改过安装目录程序文件)
### 🐛 描述
### 📷 复现步骤
【1】2024-03-11 22:25:02,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止
攻击方式:Exploit/CVE-2017-10271
访问地址:172.180.46.106/wls-wsat/CoordinatorPortType
远程地址:172.180.40.21:43580
本地地址:172.180.46.106:80
防御结果:已阻止
进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
【2】2024-03-11 22:25:01,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止
攻击方式:Exploit/CVE-2019-2725
访问地址:172.180.46.106/_async/AsyncResponseService
远程地址:172.180.40.21:49516
本地地址:172.180.46.106:80
防御结果:已阻止
进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
【3】2024-03-11 22:25:00,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止
攻击方式:Exploit/CVE-2017-10271
访问地址:172.180.46.106/wls-wsat/CoordinatorPortType
远程地址:172.180.40.21:49542
本地地址:172.180.46.106:80
防御结果:已阻止
进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
【4】2024-03-11 22:24:13,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止
攻击方式:Exploit/CVE-2022-26134
访问地址:172.180.46.106/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
远程地址:172.180.40.21:49534
本地地址:172.180.46.106:80
防御结果:已阻止
进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
【5】2024-03-11 22:24:12,网络防护,Web服务保护,受到172.180.40.21的网络攻击,已阻止
攻击方式:Exploit/CVE-2022-26134
访问地址:172.180.46.106/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/
远程地址:172.180.40.21:49504
本地地址:172.180.46.106:80
防御结果:已阻止
进程ID:22924
操作进程:C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe
操作进程命令行:"C:\Program Files\WindowsApps\4651ED44255E.47979655102CE_3.0.507.0_x64__k6txddmbb6c52\modules\Accelerator\Steam++.Accelerator.exe" ipc_hssdmr19587583102 24932 Aqb___9ZAAAAQzpcVXNlcnNcMjYzNjBcQXBwRGF0YVxMb2NhbFxQYWNrYWdlc1w0NjUxRUQ0NDI1NUUuNDc5Nzk2NTUxMDJDRV9rNnR4ZGRtYmI2YzUyXExvY2FsU3RhdGWm____WQAAAEM6XFVzZXJzXDI2MzYwXEFwcERhdGFcTG9jYWxcUGFja2FnZXNcNDY1MUVENDQyNTVFLjQ3OTc5NjU1MTAyQ0VfazZ0eGRkbWJiNmM1MlxMb2NhbENhY2hl
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
### 📄 日志信息
### 🖼 截图
### 🚑 其他信息
- 处理器体系结构:X64
- 系统版本号:Windows11.22631.3155
- 下载渠道:微软商店
- 程序版本:3.0.0
- 是否包含独立运行时:
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.