公開しているwebサーバのログから通常のアクセスではない通信について分析しました。
多かったリクエスト
PHPUnitの脆弱性
//vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
WordPress関連
ログイン画面の調査
/post/wp-login.php
/wp-login.php
File Managerの脆弱性をつく通信
/wp-content/plugins/wp-file-manager/readme.txt
MobileIron Core および Connector における脆弱性
/mifs/.;/services/LogService
thinkPHPの脆弱性を利用した攻撃
/index.php?s=/Index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21
Laravel(ignition)の脆弱性
Laravelと一緒に使われるignitionというライブラリにリモートから認証なしでOSコマンド実行が可能な脆弱性があるようです。
/_ignition/execute-solution
参考情報
WordPress 用プラグイン File Manager の脆弱性について
JVNDB-2020-007560 - JVN iPedia - 脆弱性対策情報データベース
CVE Spotlight: MobileIron RCE CVE-2020-15505 | Perch Security
laravelのヤバい脆弱性をついたkinsing(kdevtmpfsi)というマルウェアに感染した話 CVE-2021-3129 - Qiita
Laravel(ignition)の脆弱性「CVE-2021-3129」再現と分析と注意喚起 - Nickブログ
不審な通信の一覧
| uri | count | percent |
|---|---|---|
| //vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 96 | 2.831023 |
| /sellers.json | 82 | 2.418166 |
| /post/wp-login.php | 73 | 2.152757 |
| /wp-login.php | 72 | 2.123267 |
| /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 70 | 2.064288 |
| /config/getuser?index=0 | 53 | 1.562961 |
| /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application | 47 | 1.386022 |
| /wp-content/plugins/wp-file-manager/readme.txt | 35 | 1.032144 |
| /mifs/.;/services/LogService | 35 | 1.032144 |
| /api/jsonws/invoke | 34 | 1.002654 |
| /.env | 34 | 1.002654 |
| /index.php?s=/Index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 | 33 | 0.973164 |
| /Autodiscover/Autodiscover.xml | 33 | 0.973164 |
| /console/ | 32 | 0.943674 |
| /ads.txt | 30 | 0.884695 |
| /_ignition/execute-solution | 30 | 0.884695 |
| /index.xml | 26 | 0.766735 |
| /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f | 25 | 0.737246 |
| /actuator/health | 25 | 0.737246 |
| /owa/auth/x.js | 21 | 0.619286 |
| /owa/auth/logon.aspx | 21 | 0.619286 |
| mstshash=Administr | 19 | 0.560307 |
| //css/style.css | 17 | 0.501327 |
| //a2billing/customer/templates/default/footer.tpl | 15 | 0.442347 |
| ///remote/fgt_lang?lang=/../../../..//////////dev/ | 15 | 0.442347 |
| //.env | 15 | 0.442347 |
| //css/reset.css | 12 | 0.353878 |
| /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ | 11 | 0.324388 |
| /pages/createpage-entervariables.action?SpaceKey=x | 11 | 0.324388 |
| /system_api.php | 10 | 0.294898 |
| /streaming/clients_live.php | 10 | 0.294898 |
| /stream/live.php | 10 | 0.294898 |
| /stalker_portal/c/version.js | 10 | 0.294898 |
| /flu/403.html | 10 | 0.294898 |
| /c/version.js | 10 | 0.294898 |
| /.well-known/security.txt | 10 | 0.294898 |
| http://passport.baidu.com/ | 9 | 0.265408 |
| /login | 7 | 0.206429 |
| /bag2 | 7 | 0.206429 |
| /about | 7 | 0.206429 |
| http://fuwu.sogou.com/404/index.html | 6 | 0.176939 |
| /sdk | 6 | 0.176939 |
| /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession | 6 | 0.176939 |
| /autodiscover/autodiscover.json?@evil.corp/ews/exchange.asmx?&Email=autodiscover/autodiscover.json%3F@evil.corp | 6 | 0.176939 |
| /admin/config.php | 5 | 0.147449 |
| /_asterisk/ | 5 | 0.147449 |
| /.git/config | 5 | 0.147449 |
| 7 | 4 | 0.117959 |
| /web_shell_cmd.gch | 4 | 0.117959 |
| /recordings/theme/main.css | 4 | 0.117959 |
| /manager/html | 4 | 0.117959 |
| /evox/about | 4 | 0.117959 |
| /archives | 4 | 0.117959 |
| /aab9 | 4 | 0.117959 |
| /aaa9 | 4 | 0.117959 |
| /ReportServer | 4 | 0.117959 |
| /HNAP1 | 4 | 0.117959 |
| /.well-known/assetlinks.json | 4 | 0.117959 |
| /.well-known/apple-app-site-association | 4 | 0.117959 |
| /security.txt | 3 | 0.088469 |
| /mgmt/tm/util/bash | 3 | 0.088469 |
| /manager/text/list | 3 | 0.088469 |
| /admin/.env | 3 | 0.088469 |
| /.well-known/gpc.json | 3 | 0.088469 |
| * | 3 | 0.088469 |
| secure/Dashboard.jspa | 2 | 0.058980 |
| http://5.188.210.227/echo.php | 2 | 0.058980 |
| \xF9\xCD\x03v\x00\x00\x008yY\x7F\xF7\x7F\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFE\xFF\xFF\xFF\x01 | 2 | 0.058980 |
| 85.206.160.115:80 | 2 | 0.058980 |
| /wp-content/plugins/wp-automatic/process_form.php | 2 | 0.058980 |
| /vendor/.env | 2 | 0.058980 |
| /scripts/WPnBr.dll | 2 | 0.058980 |
| /remote/login | 2 | 0.058980 |
| /index.php?xml_sitemap=params= | 2 | 0.058980 |
