---
title: "Liste des IP qui essayent d’exploiter la faille MobileIron RCE CVE-2020-15505"
url: https://www.cyber-neurones.org/2021/06/liste-des-ip-qui-essayent-dexploiter-la-faille-mobileiron-rce-cve-2020-15505/
date: 2021-06-24
modified: 2021-07-29
author: "Frederic"
description: "Pour plus d'information : https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/ Exemple d'un logs : 45.146.165.123 - - [24/Jun/2021:03:49:36 +0200] \"POST /mifs/.;/services/LogService HTTP/1.1\" 302 5371 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 122
---

# Liste des IP qui essayent d’exploiter la faille MobileIron RCE CVE-2020-15505

Pour plus d'information : [https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/](https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/)

Exemple d'un logs :
45.146.165.123 - - [24/Jun/2021:03:49:36 +0200] "POST /mifs/.;/services/LogService HTTP/1.1" 302 5371 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.146.165.123 - - [24/Jun/2021:03:49:46 +0200] "GET /user/auth/login HTTP/1.1" 200 13385 "-/mifs/.;/services/LogService" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

J'ai donc fait :
# zgrep "/mifs/." /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "iptables -A INPUT -s " $1 " -j DROP "}'
iptables -A INPUT -s 45.146.165.123 -j DROP

Vu qu'il y avait qu'une seule IP, j'ai pas fait de script:
# iptables -A INPUT -s 45.146.165.123 -j DROP
# iptables-save > /etc/iptables/rules.v4

A suivre.