---
title: "Faille securité : malware surnommé « THE MOON » sur Linksys."
url: https://www.cyber-neurones.org/2021/10/faille-securite-malware-surnomme-the-moon-sur-linksys/
date: 2021-10-14
modified: 2021-10-14
author: "Frederic"
description: "Voici un exemple de trace sur mon serveur : 50.31.21.6 - - [14/Oct/2021:02:02:15 +0200] \"GET / HTTP/1.0\" 302 5156 \"-\" \"-\" 50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] \"HEAD / HTTP/1.1\" 302..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 303
---

# Faille securité : malware surnommé « THE MOON » sur Linksys.

Voici un exemple de trace sur mon serveur :
50.31.21.6 - - [14/Oct/2021:02:02:15 +0200] "GET / HTTP/1.0" 302 5156 "-" "-"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "HEAD / HTTP/1.1" 302 4938 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "GET /nmaplowercheck1634169768 HTTP/1.1" 302 5145 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "POST /sdk HTTP/1.1" 302 4957 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "GET / HTTP/1.0" 302 5156 "-" "-"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] **"GET /HNAP1 HTTP/1.1" **302 5145 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "GET / HTTP/1.1" 302 5126 "-" "-"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "HEAD /user/auth/login HTTP/1.1" 200 6095 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "GET /evox/about HTTP/1.1" 302 5145 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "GET /user/auth/login HTTP/1.1" 200 29756 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"

La signature c'est surtout : **"GET /HNAP1 HTTP/1.1"**

Mon action :
# iptables -A INPUT -s 50.31.21.6 -j DROP
# /usr/sbin/iptables-save > /etc/iptables/rules.v4

Plus d'information sur l'IP :

| IP Address | Country | Region | City |
| ---------- | ------- | ------ | ---- |
| 50.31.21.6 | United States of America ![](https://www.iplocation.net/assets/images/flags/us.gif) | Illinois | Chicago |
| ISP | Organization | Latitude | Longitude |
| SteadFast | Not Available | 41.8761 | -87.6521 |

A noter que c'est visiblement pas la première attaque du type :
134.255.233.173 - - [13/Oct/2021:18:55:13 +0200] "POST /HNAP1/ HTTP/1.1" 302 255 "-" "Mozila/5.0"
192.168.1.153 - - [13/Oct/2021:21:25:40 +0200] "GET /HNAP1/ HTTP/1.1" 302 404 "-" "Avast Antivirus"
112.27.124.140 - - [30/Oct/2020:22:40:00 +0100] "POST /HNAP1/ HTTP/1.0" 408 484 "-" "-"
45.6.195.248 - - [31/Oct/2020:00:23:21 +0100] "POST /HNAP1/ HTTP/1.0" 408 484 "-" "-"

Misère.