---
title: "Liste des IP qui essayent d’exploiter la faille microsoft.exchange.ediscovery.exporttool.application"
url: https://www.cyber-neurones.org/2021/07/liste-des-ip-qui-essayent-dexploiter-la-faille-microsoft-exchange-ediscovery-exporttool-application/
date: 2021-07-29
modified: 2021-07-29
author: "Frederic"
description: "Un exemple de logs : 192.241.212.111 - - [29/Jul/2021:00:55:15 +0200] \"GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1\" 302 4949 \"-\" \"Mozilla/5.0 zgrab/0.x\" Liste des ip : # zgrep \"/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application\" /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g'..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 160
---

# Liste des IP qui essayent d’exploiter la faille microsoft.exchange.ediscovery.exporttool.application

Un exemple de logs :
192.241.212.111 - - [29/Jul/2021:00:55:15 +0200] "GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1" 302 4949 "-" "Mozilla/5.0 zgrab/0.x"

Liste des ip :
# zgrep "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application" /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "/usr/sbin/iptables -A INPUT -s " $1 " -j DROP "}'
/usr/sbin/iptables -A INPUT -s 192.241.197.168 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.208.45 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.209.206 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.210.112 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.210.26 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.211.59 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.211.81 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.211.83 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.212.191 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.219.62 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.221.181 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.223.182 -j DROP
/usr/sbin/iptables -A INPUT -s 192.241.223.191 -j DROP

Le nombre d'IP que j'ai blacklisté :
# cat /etc/iptables/rules.v4 | grep "DROP" | wc -l
228