Archives de catégorie : Sécurité

Scan de http://mj12bot.com/ , j’ai bloqué les IPs

Publié le par
Répondre

J’ai pu voir pas mal de scan :

# zgrep "MJ12bot" /var/log/apache2/access.*.gz  | sed 's/:/ /g' | awk '{print $2 " " $11}' | sort -n | uniq
95.91.75.28 /index.php?r=user/auth/login
95.91.75.28 /index.php?r=user/password-recovery
95.91.75.28 /robots.txt
95.91.75.28 /user/auth/login
144.76.137.254 /dashboard
144.76.137.254 /index.php?r=dashboard/dashboard
144.76.137.254 /robots.txt
144.76.137.254 /user/auth/login
144.76.137.254 /user/password-recovery
192.151.157.210 /
192.151.157.210 /robots.txt
192.151.157.210 /user/auth/login

J’ai donc supprimé les IP:

# iptables -A INPUT -s 144.76.137.254 -j DROP
# iptables -A INPUT -s 192.151.157.210 -j DRO
# iptables -A INPUT -s 95.91.75.28 -j DROP
# iptables -A INPUT -s 5.9.138.189 -j DROP
# /usr/sbin/iptables-save > /etc/iptables/rules.v4

A suivre.

IP Address Country Region City
144.76.137.254 Germany Bayern Nuremberg
ISP Organization Latitude Longitude
Hetzner Online AG Not Available 49.4478 11.0683
IP Address Country Region City
192.151.157.210 United States of America Missouri Kansas City
ISP Organization Latitude Longitude
Jacob Beneke Not Available 39.1478 -94.5689
IP Address Country Region City
95.91.75.28 Germany Thuringen Muhlhausen
ISP Organization Latitude Longitude
Vodafone Deutschland GmbH Not Available 51.2090 10.4528

Attaque via l’IP 159.223.5.5, l’ISP : DigitalOcean LLC … sans surprise.

Publié le par
Répondre

Voici quelques logs :

159.223.5.5 - - [03/Nov/2021:13:00:43 +0100] "GET /3000D00E0000FFFF3F0031313744373731343634304537353046007A7A7A7A7A7A7A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000008047A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000 HTTP/1.1" 403 443 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
159.223.5.5 - - [03/Nov/2021:13:00:46 +0100] "\xbf\xbf\xaf\xaf~" 400 0 "-" "-"
159.223.5.5 - - [03/Nov/2021:13:00:46 +0100] "POST / HTTP/1.1" 302 256 "-" "WinHttpClient"
159.223.5.5 - - [03/Nov/2021:13:00:48 +0100] "\x17\x03\x01\x01\x04e" 400 0 "-" "-"
159.223.5.5 - - [03/Nov/2021:13:00:48 +0100] "\x17\x03\x01\x01\x04e" 400 0 "-" "-"

Comme toujours c’est DigitalOcean :

IP Address Country Region City
159.223.5.5 Netherlands Noord-Holland Amsterdam
ISP Organization Latitude Longitude
DigitalOcean LLC Not Available 52.3740 4.8897

 

Bye-Bye :

iptables -A INPUT -s 159.223.5.5 -j DROP

Faille de sécurité sur /CommPilot/Login/ ?

Publié le par
Répondre

Visiblement il doit y avoir une faille car j’ai des connexions :

# grep "/CommPilot/Login/" /var/log/apache2/access.* | sed 's/:/ /g' | awk '{print $2}' | uniq 
89.248.165.73
178.239.21.201
94.189.47.234

Par exemple :

178.239.21.201 - - [02/Nov/2021 13 57 42 +0100] "GET /CommPilot/Login/ HTTP/1.1" 302 5182 "-" "Cisco/SPA303-7.4.8a"
94.189.47.234 - - [02/Nov/2021 16 17 32 +0100] "GET /CommPilot/Login/ HTTP/1.1" 302 5023 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv 92.0) Gecko/20100101 Firefox/92.0"

La localisation des IP :

IP Address Country Region City
94.189.47.234 Denmark Midtjylland Tranbjerg
ISP Organization Latitude Longitude
TDC A/S Not Available 56.0901 10.1194
IP Address Country Region City
89.248.165.73 Netherlands Zuid-Holland The Hague
ISP Organization Latitude Longitude
Incrediserve Ltd Not Available 52.0767 4.2986
IP Address Country Region City
178.239.21.201 Romania Bucuresti Bucharest
ISP Organization Latitude Longitude
Backup24 Not Available 44.4323 26.1063

 

ISP DigitalOcean LLC c’est un enfer pour la sécurité

Publié le par
Répondre

Voici encore une IP de l’ISP DigitalOcean LLC :

167.71.13.196 - - [15/Oct/2021:01:11:23 +0200] "GET / HTTP/1.1" 400 5128 "-" "-"
167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] "GET / HTTP/1.1" 302 5554 "-" "l9tcpid/v1.1.0"
167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] "GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts HTTP/1.1" 400 5636 "-" "Lkx-Apache2449TraversalPlugin/0.0.1 (+https://leakix.net/, +https://twitter.com/HaboubiAnis)"
167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] "GET /.DS_Store HTTP/1.1" 403 991 "-" "Go-http-client/1.1"
167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] "GET /.git/config HTTP/1.1" 403 991 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:24 +0200] "GET /telescope/requests HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:25 +0200] "GET /.json HTTP/1.1" 403 991 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:25 +0200] "GET / HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:25 +0200] "GET /frontend_dev.php/$ HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:25 +0200] "GET /api/search?folderIds=0 HTTP/1.1" 404 889 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:25 +0200] "GET /config.json HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:25 +0200] "GET /idx_config/ HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:26 +0200] "GET /info.php HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:26 +0200] "GET /login.action HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:26 +0200] "GET /debug/default/view?panel=config HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:26 +0200] "GET /v2/_catalog HTTP/1.1" 302 938 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:26 +0200] "GET /server-status HTTP/1.1" 403 991 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:27 +0200] "GET /.env HTTP/1.1" 403 991 "-" "l9explore/1.3.0"
167.71.13.196 - - [15/Oct/2021:01:11:27 +0200] "GET /s/lkx/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1" 302 938 "-" "l9explore/1.3.0"

Il essaye d’exploiter une liste de faille ….

Misère.