Mindestenssechszeichen...keine Panik!

Neuerlich gab es wieder einen schönen URL-Regenschauer in den Server-Logs, den ich euch natürlich nicht vorenthalten möchte.

Vorab eine Erklärung dazu: Es geht darum, einen Server anzugreifen. Um zunächst herauszufinden, welche Web-Software darauf installiert ist, kann man deren bekannte URLs auf gut Glück einfach mal aufrufen; bei Wordpress ist beispielweise die URL /wp-login.php sehr beliebt. Kommt ein 404-Fehler zurück, ist Wordpress entweder nicht installiert, liegt in einem anderen Verzeichnis oder wurde anderweitig umkonfiguriert – diese Fälle legt man einfach beiseite und konzentriert sich auf die Server, bei denen tatsächlich die Loginseite erscheint. Der zweite Schritt ist dann, die Version möglichst einzugrenzen; manchmal gibt es bestimmte Dateien nur in bestimmten Versionen der Software, oder die Rückmeldungen und Fehlerseiten weisen Unterschiede auf, oder die Metadaten sind anders, etc. – dies wiederum mittels Durchprobieren. Zum Schluss hat man eine Liste möglicher Versionen, versucht alle dazugehörigen Schwachstellen anzuwenden und kann damit womöglich in den Server eindringen. Unbedarfte Webseitenbesaitzer freuen sich hier und da über explodierende Counter.
Nun geschieht dies aber nicht von Hand; schliesslich gibt es Millionen von Servern im Internet und dazu tausende Softwarepakete – also erledigt ein Skript diese Arbeit automatisch. Auf der Gegenseite gibt es Server-Admins wie mich, die solche Zugriffe analysieren und bei Bedarf Gegenmassnahmen ergreifen können.

Hier nun also eine (bei weitem unvollständige) Liste von Aufrufen, die neulich hereinkam – womöglich nützt es ja jemandem oder beantwortet zumindest die Frage nach der Ursache:

/.config.php
/.cpanel_config.php
/.joomla.system.php
/1.php
/4005..php
/4005.php
/46456.php
/abc.php
/addons/fckeditor/editor/filemanager/connectors/uploadtest.html
/addons/theme/stv1/_static/ts2/layout.css
/addons/theme/stv2/_static/ts2/layout.css
/admin/
/admin/fckeditor/editor/filemanager/connectors/uploadtest.html
/Admin/Images/LoginImages/admin_text.gif
/Admin/Images/LoginImages/admin_top.gif
/admin/inc/xml.xslt
/admin/login.asp
/admin/login.aspx
/Admin/Login.aspx
/admin/SouthidcEditor/ButtonImage/standard/componentmenu.gif
/admin/SouthidcEditor/Dialog/dialog.js
/admin/SouthidcEditor/ewebeditor.asp?id=57&style=southidc
/admin/template/article_more/config.htm
/adminsoft/templates/images/login_bg_top.jpg
/advfile/ad12.js
/API/DW/Dwplugin/SystemLabel/SiteConfig.htm
/API/DW/Dwplugin/TemplateManage/login_site.htm
/API/DW/Dwplugin/TemplateManage/manage_site.htm
/API/DW/Dwplugin/TemplateManage/save_template.htm
/app/images/login/logo.png
/app/images/login/toplogo.gif
/app/js/source/wcmlib/WCMConstants.js
/app/login.jsp
/app/Tpl/fanwe_1/js/DD_belatedPNG_0.0.8a-min.js
/apps/admin/_static/image/login_box_bg.png
/archive/archive.css
/archiver/
/asp.net/README.txt
/assets/fckeditor/editor/filemanager/connectors/uploadtest.html
/automne/fckeditor/editor/filemanager/connectors/uploadtest.html
/back/scripts/jspxcms_choose.js
/bbs/
/blog/
/bookmark.php
/business/images/index-gg1.jpg
/cgi/index.cgi
/CHANGELOG.php
/CHANGELOG.txt
/changelog.txt
/ckeditor/ckeditor.js
/ckeditor/ckfinder/ckfinder.html
/ckeditor/ckfinder/install.txt
/ckeditor/samples/plugins/htmlwriter/outputhtml.html
/ckfinder/ckfinder.html
/ckfinder/install.txt
/clientscript/vbulletin_ajax_htmlloader.js
/common/common.js
/common/help/images/helplogo.gif
/common/help/images/helplogo_zh.gif
/configbak.php
/configuration.php
/conns.php
/console/auth/reg_newuser.jsp
/console/include/not_login.htm
/console/js/CTRSRequestParam.js
/console/js/CWCMDialogHead.js
/control/editor/filemanager/connectors/uploadtest.html
/core_main/editor/editor/filemanager/connectors/uploadtest.html
/cron.php
/css.php
/custom/SkinTemplate/skin/public/images/sys-logo-1caitong-180.jpg
/customdir/images/english_logo.jpg
/CuteSoft_Client/CuteEditor/Help/default.htm
/CuteSoft_Client/CuteEditor/ImageEditor/listfiles.aspx
/CuteSoft_Client/CuteEditor/Images/log.gif
/CuteSoft_Client/CuteEditor/Style/IE.css
/data/admin/ver.txt
/data/images/wap_logo.gif
/default/css/em_css.css
/default/images/logo.gif
/deptWebsiteAction.do
/dialog/dialog.js
/docs.css
/docs/
/docs/DOCUMENTATION.txt
/Editor.js
/editor/js/fckeditorcode_ie.js
/elements.php
/Error.aspx
/examples/file-manager.html
/examples/index.html
/examples/readonly.html
/extract.php
/extracts.php
/FCK/editor/js/fckeditorcode_ie.js
/FCK/fckeditor.js
/fckeditor.js
/fckeditor/editor/dtd/fck_dtd_test.html
/fckeditor/editor/filemanager/connectors/uploadtest.html
/fckeditor/editor/js/fckeditorcode_ie.js
/fckeditor/fckconfig.js
/fckeditor/fckeditor.js
/fckeditor/license.txt
/feed.asp
/files/fckeditor/editor/filemanager/connectors/uploadtest.html
/files/filebox/file/fileupload.html
/forum/
/forums/list.page
/gemb.php
/help/ch_gb/images/help-title.gif
/help/en/h_authenticate.html
/helpnew/faq/faq_simple_zh_CN.jsp
/history.txt
/home.bak.php
/images/2_11.gif
/images/branding/logo.gif
/images/default/post_bt.gif
/images/Default_bg_002.gif
/images/hwem.css
/Images/login/biaoti.jpg
/images/login/eyoumail.gif
/images/login/icon-up.gif
/Images/login/lefttu.jpg
/images/login/logo.gif
/Images/login/mainlogo.gif
/images/login9/login_33.jpg
/images/logo_88x31.gif
/images/logo-white.png
/images/zh-CN/logo.ico
/img/pic/login/top-left.jpg
/inc/fckeditor/editor/filemanager/connectors/uploadtest.html
/inc/Templates/rss.xslt
/include.php
/include/dedeajax2.js
/Include/EcsServerApi.js
/include/fckeditor/editor/filemanager/connectors/uploadtest.html
/includes/fckeditor/editor/filemanager/connectors/uploadtest.html
/includes/general.js
/index.cgi
/index.php
/index.php?liu=qt&fukq=t&RNv=f
/index2.php
/indexi.php
/indexs.php
/Install/logo.gif
/jcms/index.jsp
/jcms/index_jcms.jsp
/jetspeed/index.jsp
/js/ajax_x.js
/js/buttons.js
/js/fckeditor/editor/filemanager/connectors/uploadtest.html
/kindeditor.js
/kindeditor-min.js
/ks_inc/ajax.js
/lang/en.js
/lib/fckeditor/editor/filemanager/connectors/uploadtest.html
/lic.php
/licence.txt
/license.php
/License.txt
/license.txt
/license2016.php
/load-config.php
/ymail/images/index_r1_c4.jpg
/locoy.php
/login/Jeecms.do
/logo/logo_jw.png
/maintlogin.jsp
/manage/fckeditor/editor/filemanager/connectors/uploadtest.html
/manager/fckeditor/editor/filemanager/connectors/uploadtest.html
/max-templates/classic/styles/app.css
/media/com_hikashop/js/hikashop.js
/member/space/company/info.txt
/mko.php
/modx.php
/mysql.php
/new_gb/help/images/usage/3.3.gif
/next/img/logo.gif
/nicesite.php
/nobody/mobile.htm?Login=Captcha
/Ntalker/lawfirm.aspx?17
/ods.php
/old/wp-admin/
/opts.php
/phpmyadmin/
/phpmyadmin/docs.css
/phpmyadmin/themes/original/img/logo_right.png
/plugin.php
/plugins/anchor/anchor.js
/plugins/fckeditor/editor/filemanager/connectors/uploadtest.html
/plus/rssmap.html
/plus/sitemap.html
/popup-pomo.php
/post.php
/Prompt/images/P_Wrong.gif
/pub/guiedit/guiedit.js
/pub/skins/pmwiki/pmwiki.css
/public/about.html
/Public/Admin/Images/login_main_bg.jpg
/public/fckeditor/editor/filemanager/connectors/uploadtest.html
/public/js/ipb.js
/readme.html
/README.txt
/rss.aspx
/rssd.php
/sample.php
/script/valid_formdata.js
/Scripts/jquery/maticsoft.jquery.min.js
/Search.html
/security.php
/septi.php
/septii.php
/shell.php
/showthread.php
/Site/SystemThemes/7917A0869761B5458281E407AE0090F5/Images/ISBanner58px.jpg
/skin/frontend/default/modern/css/styles.css
/slic.php
/sql.php
/sql_dump.php
/static/hgicon.png
/static/images/logo/webserver_small.gif
/stats.php
/style/default/hdwiki.css
/stylesheet.css
/support.php
/sw.php
/system/editor/filemanager/connectors/uploadtest.html
/system/Login.aspx
/system/skins/default/system.login.htm
/template/1/bluewise/_files/jspxcms.css
/Template/Default/Skin/user/images/login_back.jpg
/template/home.htm
/templates/jsn_glass_pro/ext/hikashop/jsn_ext_hikashop.css
/test/wp-admin/
/themes/default/default.css
/tmp.php
/tools/rss.aspx
/tpl/login/user/images/login_bg_1.jpg
/tpl/user/tpl1/css/skins/blue.css
/User/Login.aspx
/version.php
/was/help.jsp
/was/main.html
/was5/web/index.jsp
/wcm/
/web2/login_template/1.files/Logo1.jpg
/webbuilder/script/locale/wb-lang-zh_CN.js
/webconfig.txt.php
/weblog/
/whir_system/login.aspx
/whir_system/module/security/login.aspx
/wordpress/
/wordpress/wp-admin/
/wp.php
/wp/
/wp-admin/
/wp-cache.php
/wp-check.php
/wp-checking.php
/wp-config.php
/wp-config-sample.php
/wp-content/plugins/revslider/js/rev_admin.js
/ycportal/js/wbTextBox/showimg.jsp
/wp-cron.php
/wp-data.php
/wpfoot.php
/wp-footers.php
/wp-functions.php
/wp-index.php
/wp-installation.php
/wp-lib.php
/wp-license.php
/wp-links-opml.php
/wp-login.php
/xmlrppc.php
/wp-mail.php
/wp-register.php
/wp-settings.php
/wp-signup.php
/wp-sitemap.php
/wp-sitemaps.php
/wp-tmp.php
/wp-trackback.php
/wp-up.php
/Wq_StranJF.js
/wsdl.php
/xmlrpc.php
/xmlrpc.php?rsd

All diese Aufrufe kamen übrigens innerhalb von 5 Minuten rein.

Nachtrag

Eine weitere kleine Welle, Dauer eine Minute:

/.config.php
/.cpanel_config.php
/.joomla.system.php
/_file-manager/php/connector.php
/1.php
/abc.php
/admin/imgs/version.js
/admin/uploadify/uploadify.swf
/administrator/index.php
/backup/wp-admin/setup-config.php
/bin/logo_img.php
/blog/
/blog/wp-admin/setup-config.php
/blog/wp-login.php
/blogs/wp-login.php
/bookmark.php
/changelog.php
/cms/uploadify/uploadify.swf
/cms/wp-login.php
/configbak.php
/configuration.php
/conns.php
/cron.php
/css.php
/editor/editor/filemanager/browser/default/connectors/asp/connector.asp
/editor/editor/filemanager/browser/default/connectors/aspx/connector.aspx
/editor/editor/filemanager/browser/default/connectors/php/connector.php
/editor/editor/filemanager/connectors/asp/connector.asp
/editor/editor/filemanager/connectors/aspx/connector.aspx
/editor/editor/filemanager/connectors/php/connector.php
/elements.php
/en/wp-login.php
/extracts.php
/gemb.php
/handschellen/
/home.bak.php
/images/logo_img.php
/inc/uploadify/uploadify.swf
/include.php
/includes/logo_img.php
/includes/uploadify/uploadify.swf
/index.php
/index.php?liu=qt&fukq=t&RNv=f
/index2.php
/js/uploadify/uploadify.swf
/language/en-gb/en-gb.xml
/lib/uploadify/uploadify.swf
/lic.php
/license.php
/license2016.php
/load-config.php
/locoy.php
/login.php?login=cmd
/logo_img.php
/main/wp-login.php
/media/logo_img.php
/mko.php
/modules/attributewizardpro/file_upload.php
/modules/mod_simplefileuploadv1.3/elements/udd.php
/modx.php
/mysql.php
/new/wp-login.php
/news/wp-login.php
/nextcloud/status.php
/nicesite.php
/oc/status.php
/oc-shib/status.php
/ods.php
/owncloud/status.php
/plugin.php
/plugins/uploadify/uploadify.swf
/popup-pomo.php
/post.php
/rssd.php
/sample.php
/security.php
/shell.php
/showthread.php
/site/
/site/wp-login.php
/sitemap.xml
/sites/default/files/up.php
/slic.php
/sql.php
/stats.php
/status.php
/sw.php
/test/wp-login.php
/tmp.php
/udd.php
/up.php
/up.php?up=hous
/update.php
/upload.php
/uploadify/uploadify.swf
/version.php
/wall_login.php?login=cmd
/webconfig.txt.php
/wordpress/
/wordpress/wp-login.php
/wp.php
/wp/
/wp/wp-admin/setup-config.php
/wp/wp-login.php
/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
/wp-check.php
/wp-checking.php
/wp-config-sample.php
/wp-content/plugins/ubh/up.php
/wp-content/upgrade/theme-compat/popup-pomo.php
/wp-content/uploads/foot.php
/wp-cron.php
/wp-footers.php
/wp-installation.php
/wp-lib.php
/wp-license.php
/wp-links-opml.php
/wp-login.php
/wp-mail.php
/wp-register.php
/wp-settings.php
/wp-signup.php
/wp-sitemap.php
/wp-sitemaps.php
/wp-tmp.php
/wp-up.php
/wsdl.php
/xmlrpc.php
/xmlrpc.php?rsd
/xmlrppc.php

Nachtrag 2

Offenbar sind nun auch OwnCloud, NextCloud und die Datei uploadify.swf beliebte Angriffsziele, was auf kürzlich gefundene Lücken hindeutet. Generell sind Datei-Uploader immer ein lohnendes Ziel. Die Zugriffsversuche laufen auf die Subomains "oc", "cloud", "owncloud", "files" und natürlich "www", mit folgenden Pfaden:

/.git
/admin.php
/admin/
/admin/imgs/version.js
/admin/index.php?route=common/login
/admin/uploadify/uploadify.swf
/administrator/
/administrator/index.php
/blog/
/cms/uploadify/uploadify.swf
/inc/uploadify/uploadify.swf
/includes/uploadify/uploadify.swf
/index.php/admin/
/js/uploadify/uploadify.swf
/lib/uploadify/uploadify.swf
/nextcloud/status.php
/oc/status.php
/oc-shib/status.php
/owncloud/status.php
/plugins/uploadify/uploadify.swf
/site/
/sitemap.xml
/sitemap_index.xml
/status.php
/uploadify/uploadify.swf