@SelFree #15 波动很大，这是最好的一次：
```
Connecting to host ping-90ms.online.net, port 5200
[ 5] local 192.168.31.111 port 36944 connected to 51.158.1.19 port 5200
[ 7] local 192.168.31.111 port 36945 connected to 51.158.1.19 port 5200
[ 9] local 192.168.31.111 port 36946 connected to 51.158.1.19 port 5200
[ 11] local 192.168.31.111 port 36947 connected to 51.158.1.19 port 5200
[ ID] Interval Transfer Bitrate
[ 5] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[ 7] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[ 9] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[ 11] 0.00-1.01 sec 256 KBytes 2.09 Mbits/sec
[SUM] 0.00-1.01 sec 1.00 MBytes 8.34 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ 5] 1.01-2.00 sec 128 KBytes 1.05 Mbits/sec
[ 7] 1.01-2.00 sec 128 KBytes 1.05 Mbits/sec
[ 9] 1.01-2.00 sec 128 KBytes 1.05 Mbits/sec
[ 11] 1.01-2.00 sec 128 KBytes 1.05 Mbits/sec
[SUM] 1.01-2.00 sec 512 KBytes 4.22 Mbits/sec
...
...
...
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate
[ 5] 0.00-10.01 sec 15.9 MBytes 13.3 Mbits/sec sender
[ 5] 0.00-10.34 sec 14.6 MBytes 11.8 Mbits/sec receiver
[ 7] 0.00-10.01 sec 2.25 MBytes 1.89 Mbits/sec sender
[ 7] 0.00-10.34 sec 1.27 MBytes 1.03 Mbits/sec receiver
[ 9] 0.00-10.01 sec 26.4 MBytes 22.1 Mbits/sec sender
[ 9] 0.00-10.34 sec 25.7 MBytes 20.9 Mbits/sec receiver
[ 11] 0.00-10.01 sec 19.1 MBytes 16.0 Mbits/sec sender
[ 11] 0.00-10.34 sec 18.1 MBytes 14.7 Mbits/sec receiver
[SUM] 0.00-10.01 sec 63.6 MBytes 53.3 Mbits/sec sender
[SUM] 0.00-10.34 sec 59.7 MBytes 48.5 Mbits/sec receiver

iperf Done.
```

更糟糕的情况：

```
[ ID] Interval Transfer Bitrate
[ 5] 0.00-10.01 sec 1.00 MBytes 838 Kbits/sec sender
[ 5] 0.00-10.05 sec 875 KBytes 714 Kbits/sec receiver
[ 7] 0.00-10.01 sec 1.12 MBytes 943 Kbits/sec sender
[ 7] 0.00-10.05 sec 934 KBytes 762 Kbits/sec receiver
[ 9] 0.00-10.01 sec 1.12 MBytes 943 Kbits/sec sender
[ 9] 0.00-10.05 sec 976 KBytes 796 Kbits/sec receiver
[ 11] 0.00-10.01 sec 1.25 MBytes 1.05 Mbits/sec sender
[ 11] 0.00-10.05 sec 1.06 MBytes 884 Kbits/sec receiver
[SUM] 0.00-10.01 sec 4.50 MBytes 3.77 Mbits/sec sender
[SUM] 0.00-10.05 sec 3.78 MBytes 3.16 Mbits/sec receiver
```

用阿里云 ECS 搭建 iperf3 服务器，也一样的效果。但实际 scp 上传速度 5.5MB/s (44Mbps)左右，宽带签约速率是 300Mbps 下行+50Mbps 上行。

转发

https://imgur.com/a/Ieu2mCY

@raysonlu
昨天下午有台“蜜罐”被攻击，搜了下 payload，就找到了这个帖子。应该是批量攻击的，所以 IP 一样。
这个漏洞我没有仔细研究，也许能在服务器上找到图片，也许解析过程中就执行了命令，并没有将图片写到磁盘。有兴趣的话你可以研究下，这儿有篇漏洞复现的文章： https://www.cnblogs.com/ybit/p/14918949.html 。
最重要的是关闭注册功能，升级 Gitlab 。

https://github.com/offensive-security/exploitdb/blob/1dc98b3b8ebb65274139f4c988efb20c6eccbb3a/exploits/ruby/webapps/49951.py

结案

@woorz 似乎云听已经修复了，这个软件利用了云听的网站的“漏洞”，在 activityId 的值前添加 0(其中一个 activityId 为 33，修改后的值为 033 、0033 、00033…)服务器认为是不同的活动，就可以叠加了。0 太多的时候还是会报错。

➜ ~ curl baddest.design -I
HTTP/1.1 302 Moved Temporarily
Server: openresty/1.13.6.2
Date: Thu, 23 May 2019 14:23:04 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Location: https://h5.m.taobao.com/bcec/downloadTaobao.html

LoveLanguageConfig.a = new String[]{"asshole", "bitch", "damn you", "fuck", "go to hell", "shit", "爆菊", "碧莲", "婊子", "草泥马", "尼玛", "丢你老母", "法克鱿", "狗屁", "滚蛋", "绿茶婊", "去你大爷", "去你妈的", "我去你妹", "死胖子", "日你妈", "弱智", "他妈的", "王八蛋", "我靠", "猪一样", "fatty", "idiot", "菊花残", "没屁眼", "臭婊砸", "贱逼", "该死的", "操你", "去死吧", "白痴", "傻瓜", "痴线", "傻屌", "傻逼", "吃屎", "捅你菊花", "插你菊花", "屁眼交易", "卧槽", "我操", "丢雷老母", "狗屎", "混蛋", "操蛋", "妈蛋", "老不死", "你妈逼", "干你妹的", "操你妹的", "表要脸", "去他喵的", "龟儿子", "老王八", "龟孙", "我日", "狗日的", "猪脑", "猪头", "心机婊", "我草", "脑残"};

厉害了，我的国