Pour mémoire : https://securityaffairs.co/wordpress/71987/hacking/gpon-home-routers-hack.html

Analyzing the firmware of the GPON home routers, the experts found two different critical vulnerabilities (CVE-2018-10561 & CVE-2018-10562) that could be chained to allow complete control of the vulnerable device and therefore the network. The first vulnerability exploits the authentication mechanism of the device, it could be exploited by an attacker to bypass all authentication.

Voici donc le script que j’ai fait :

# zgrep "GponForm/diag_F" /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "iptables -A INPUT -s " $1 " -j DROP "}'
iptables -A INPUT -s 23.95.132.55 -j DROP 
iptables -A INPUT -s 23.95.191.212 -j DROP 
iptables -A INPUT -s 27.40.100.96 -j DROP 
iptables -A INPUT -s 42.235.98.126 -j DROP 
iptables -A INPUT -s 42.237.215.13 -j DROP 
iptables -A INPUT -s 45.229.54.120 -j DROP 
iptables -A INPUT -s 59.99.47.115 -j DROP 
iptables -A INPUT -s 115.50.246.211 -j DROP 
iptables -A INPUT -s 178.175.102.79 -j DROP 
iptables -A INPUT -s 180.188.249.125 -j DROP 
iptables -A INPUT -s 198.23.172.233 -j DROP 
iptables -A INPUT -s 221.15.171.118 -j DROP 
iptables -A INPUT -s 222.97.172.100 -j DROP
# zgrep "GponForm/diag_F" /var/log/apache2/access.humhub.log.*gz | sed 's/:/ /g' | awk '{print $2}' | sort -n | uniq | awk '{print "iptables -A INPUT -s " $1 " -j DROP "}' > script_filter_scan_gpon.bash
# echo "iptables-save > /etc/iptables/rules.v4"  >> script_filter_scan_gpon.bash
# chmod +x script_filter_scan_gpon.bash
# ./script_filter_scan_gpon.bash

J’ai donc fait un script :

# zgrep ".well-known" /var/log/apache2/error.humhub.log.*gz | sed 's/:/ /g' | awk '{print $14}' | sort -n | uniq | awk '{print "iptables -A INPUT -s " $1 " -j DROP "}'
iptables -A INPUT -s 80.82.77.139 -j DROP 
iptables -A INPUT -s 80.82.77.33 -j DROP 
iptables -A INPUT -s 125.64.94.138 -j DROP 
iptables -A INPUT -s 185.142.236.35 -j DROP 
iptables -A INPUT -s 185.142.236.40 -j DROP 
iptables -A INPUT -s 185.142.236.43 -j DROP
# zgrep ".well-known" /var/log/apache2/error.humhub.log.*gz | sed 's/:/ /g' | awk '{print $14}' | sort -n | uniq | awk '{print "iptables -A INPUT -s " $1 " -j DROP "}' > script_filter_scan_well-know.bash
# echo "iptables-save > /etc/iptables/rules.v4" >> script_filter_scan_well-know.bash
# chmod +x script_filter_scan_well-know.bash
# ./script_filter_scan_well-know.bash

Et voila 6 nouvelles IP qui sont filtrés … quasiment tout venant des Pays-Bas …. Misère.

Facile il sufit de faire la commande :

# cat /etc/iptables/rules.v4 | grep "DROP" | awk '{print $4}' | sed 's/\// /g' | awk '{print $1}' | xargs -n 1 geoiplookup { } | sort | uniq -c | sort -n | sed -r 's/ GeoIP Country Edition://g'
      1 AT, Austria
      1 BR, Brazil
      1 CZ, Czech Republic
      1 GR, Greece
      1 IE, Ireland
      1 JP, Japan
      1 PH, Philippines
      1 TT, Trinidad and Tobago
      1 UG, Uganda
      2 ID, Indonesia
      2 IR, Iran, Islamic Republic of
      2 IT, Italy
      2 MX, Mexico
      2 MY, Malaysia
      2 SG, Singapore
      2 TR, Turkey
      2 TW, Taiwan
      3 CA, Canada
      3 GB, United Kingdom
      3 NL, Netherlands
      3 VN, Vietnam
      4 DE, Germany
      4 EG, Egypt
      4 FR, France
      4 KR, Korea, Republic of
      5 RU, Russian Federation
      9 IN, India
     11 IP Address not found
     28 CN, China
     43 US, United States

En tête les US …. Misère. A noter qu’il y a des IP en France que je filtre :

Voici la commande et la liste des IP qui font un scan sur .env :

# zgrep ".env" /var/log/apache2/error.humhub.log.*gz | sed 's/:/ /g' | awk '{print $14}' | sort -n | uniq -c
      1 2.57.122.53    
      2 3.19.213.88
      3 20.199.123.240
      2 20.68.241.118
      2 23.101.199.109
      1 35.202.212.64
      2 40.121.11.29
      1 40.87.87.96
      1 40.89.150.92
      1 45.77.214.38
      1 51.141.166.84
      2 51.210.137.28
      2 52.149.128.42
      1 52.175.210.216
      1 52.249.196.150
      1 80.241.212.242
      2 104.154.217.152
      2 104.198.135.4
      2 108.59.10.20
      1 115.78.14.240
      1 118.101.194.141
      1 128.31.0.13
      2 134.119.189.155
      1 144.202.53.77
      1 148.64.121.254
      2 149.28.84.31
      1 157.245.77.151
      1 172.93.128.215
      1 178.128.104.205
      1 189.203.106.65
      1 190.83.155.186
      1 192.46.223.53
      2 193.111.76.162
      1 194.116.73.192
      1 199.117.154.162
      1 210.66.16.184
      1 212.154.7.246

# zgrep ".env" /var/log/apache2/error.humhub.log.*gz | sed 's/:/ /g' | awk '{print $14}' | sort -n | uniq | awk '{print "iptables -A INPUT -s " $1 " -j DROP "}' > script_filter_scan_env.bash
# echo "iptables-save > /etc/iptables/rules.v4" >> script_filter_scan_env.bash
# chmod +x script_filter_scan_env.bash
# ./script_filter_scan_env.bash