{"id":30310,"date":"2019-10-31T21:34:48","date_gmt":"2019-10-31T18:34:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ya-proskaniroval-ukrainu\/"},"modified":"2019-10-31T21:34:48","modified_gmt":"2019-10-31T18:34:48","slug":"ya-proskaniroval-ukrainu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/ya-proskaniroval-ukrainu","title":{"rendered":"Es apmekl\u0113ju Ukrainu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Febru\u0101r\u012b Austrij\u0101 dz\u012bvojo\u0161ais Kristians Ha\u0161eks sav\u0101 blog\u0101 public\u0113ja interesantu rakstu ar nosaukumu \u201eEs izskan\u0113ju visu Austriju\u201c<\/a><\/noindex>. Protams, mani ieinteres\u0113ja, kas notiktu, ja veiktu l\u012bdz\u012bgu p\u0113t\u012bjumu, bet attiec\u012bb\u0101 uz Ukrainu. P\u0101ris ned\u0113\u013cas, v\u0101cot inform\u0101ciju bez apst\u0101jas, v\u0113l p\u0101ris dienu, lai sagatavotu rakstu, un \u0161\u012b p\u0113t\u012bjuma laik\u0101 sarunas ar da\u017e\u0101diem m\u016bsu sabiedr\u012bbas p\u0101rst\u0101vjiem, lai noskaidrotu un uzzin\u0101tu vair\u0101k. L\u016bdzu, turpiniet...
\n<\/a><\/noindex><\/p>\n

TL;DR<\/h2>\n

\nInform\u0101cijas v\u0101k\u0161anai tika izmantoti nek\u0101di speci\u0101li l\u012bdzek\u013ci (lai ar\u012b da\u017ei cilv\u0113ki ieteica izmanto OpenVAS, lai padar\u012btu p\u0113t\u012bjumu detaliz\u0113t\u0101ku un informat\u012bv\u0101ku). Saist\u012bb\u0101 ar Ukrainai piedero\u0161iem IP, situ\u0101cija, manupr\u0101t, ir diezgan slikta (un noteikti slikt\u0101ka nek\u0101 Austrij\u0101). Nav veikti un nav pl\u0101noti m\u0113\u0123in\u0101jumi izmantot atkl\u0101t\u0101s serveru ievainojam\u012bbas.<\/p>\n

Pirmk\u0101rt: k\u0101 var ieg\u016bt visus IP adreses, kas pieder noteiktai valstij?<\/h2>\n

\nTas paties\u012bb\u0101 ir \u013coti vienk\u0101r\u0161i. IP adreses pa\u0161i valsts \u0123ener\u0113, bet pie\u0161\u0137ir t\u0101s. T\u0101p\u0113c ir pieejams saraksts (un tas ir publisks) ar vis\u0101m valst\u012bm un vis\u0101m IP, kas t\u0101m pieder.<\/p>\n

Ikviens var to lejupiel\u0101d\u0113t<\/a><\/noindex>, un p\u0113c tam filtr\u0113t to, izmantojot grep Ukraine IP2LOCATION-LITE-DB1.CSV > ukraine.csv<\/p>\n

Vienk\u0101r\u0161s skripts, ko izveidojis Kristians<\/a><\/noindex>, \u013cauj p\u0101rveidot sarakstu lieto\u0161anai piem\u0113rot\u0101k\u0101 form\u0101t\u0101.<\/p>\n

Ukrainai pieder gandr\u012bz tikpat daudz IPv4 adreses k\u0101 Austrijai, vair\u0101k nek\u0101 11 miljoni. Prec\u012bz\u0101k, 11 640 409 (sal\u012bdzin\u0101jumam Austrij\u0101 \u2014 11 170 487).<\/p>\n

Ja nev\u0113laties pats sp\u0113l\u0113ties ar IP adres\u0113m (un to nevajag dar\u012bt!), Var izmantot pakalpojumu Shodan.io<\/a><\/noindex>.<\/p>\n

Vai Ukrain\u0101 ir nepiesegt\u0101s Windows ma\u0161\u012bnas, kur\u0101m ir tie\u0161a piek\u013cuve internetam?<\/h2>\n

\nProtams, neviens apzin\u012bgs ukrainis neatv\u0113rs \u0161\u0101du piek\u013cuvi saviem datoriem. Vai varb\u016bt tom\u0113r?<\/p>\n

masscan -p445 --rate 300 -iL ukraine.ips -oG ukraine.445.scan && cat ukraine.445.scan | wc -l<\/code><\/pre>\n
\nAtrastas 5669 Windows iek\u0101rtas ar tie\u0161u piek\u013cuvi t\u012bklam (Austrij\u0101 t\u0101das ir tikai 1273, bet ar\u012b tas ir daudz).<\/p>\n
Oho. Vai ir starp tiem t\u0101di, ko var\u0113tu apdraud\u0113t ar ETHERNALBLUE eksploit\u0101ciju, kas ir zin\u0101ma kop\u0161 2017. gada? Austrij\u0101 nebija nevienas \u0161\u0101das ma\u0161\u012bnas, un es cer\u0113ju, ka ar\u012b Ukrain\u0101 t\u0101s netiks atrastas. Diem\u017e\u0113l tas ir bezj\u0113dz\u012bgi. Atrasti 198 IP adreses, kuras nav aizv\u0113ru\u0161as \u0161o \"caurumu\".<\/p>\n
DNS, DDoS un tru\u0161a alas dzi\u013cums<\/h2>\n
\nPietiek par Windows. Apskat\u012bsim, kas mums ir ar DNS serveriem, kas ir open-resolvers un var tikt izmantoti DDoS uzbrukumiem.<\/p>\n
Tas darbojas apm\u0113ram t\u0101. Uzbruc\u0113js nos\u016bta mazu DNS piepras\u012bjumu, un neaizsarg\u0101tais serveris atbild upurim ar paketi, kas ir 100 reizes liel\u0101ka. Bum! Korporat\u012bv\u0101s t\u012bklos \u0161\u0101ds datu apjoms var \u0101tri novest pie sabrukuma, un uzbrukumam ir nepiecie\u0161ama joslas platuma jauda, ko sp\u0113j nodro\u0161in\u0101t m\u016bsdien\u012bgs viedt\u0101lrunis. Un t\u0101di uzbrukumi bija neparasti<\/a><\/noindex> pat GitHub.<\/p>\n
Paskat\u012bsimies, vai Ukrain\u0101 ir \u0161\u0101di serveri.<\/p>\n
masscan -pU 53 -iL ukraine.ips -oG ukraine.53.scan && cat ukraine.53.scan | wc -l<\/code><\/pre>\n
\nPirmais solis ir atrast tos, kam ir atv\u0113rta 53. porte. Rezult\u0101t\u0101 ieg\u016bstam 58 730 IP adreses, ta\u010du tas v\u0113l nenoz\u012bm\u0113, ka t\u0101s visas var izmantot DDoS uzbrukumam. Ir j\u0101izpild\u0101s otrajam nosac\u012bjumam, proti, t\u0101m j\u0101b\u016bt open-resolver.<\/p>\n
Tam var izmantot vienk\u0101r\u0161u dig komandu un redz\u0113t, ko m\u0113s varam \"izrak\u0146\u0101t\" dig +short test.openresolver.com TXT @ip.of.dns.server. Ja serveris atbild ar open-resolver-detected, tad to var uzskat\u012bt par potenci\u0101lu uzbrukuma objektu. Open resolver veido aptuveni 25%, kas ir sal\u012bdzin\u0101ms ar Austriju. Attiec\u012bb\u0101 uz kop\u0113jo skaitu tas ir apm\u0113ram 0,02% no vis\u0101m Ukrainas IP.<\/p>\n
Ko v\u0113l var atrast Ukrain\u0101?<\/h2>\n
\nPriec\u0101jos, ka jaut\u0101j\u0101t. Viegli (un pats interesant\u0101kais man person\u012bgi) ir apskat\u012bt IP ar atv\u0113rtu 80. portu un to, kas uz t\u0101 \"darbojas\".<\/p>\n
webserveri<\/h3>\n
\n260 849 Ukrainas IP atbild uz 80. portu (http). 125 444 adreses pozit\u012bvi atbild\u0113ja (200 statuss) uz vienk\u0101r\u0161u GET piepras\u012bjumu, kuru var\u0113tu nos\u016bt\u012bt j\u016bsu p\u0101rl\u016bks. P\u0101r\u0113jie izdeva da\u017e\u0101das k\u013c\u016bdas. Interesanti, ka 853 serveri izdeva 500 statusu, bet ret\u0101kie statusi bija 407 (piepras\u012bjums par proxy autoriz\u0101ciju) un absol\u016bti nestandarta 602 (IP nav \"balto sarakstu\") ar vienu atbildi.<\/p>\n
Apache domin\u0113 absol\u016bti \u2014 114 544 serveri izmanto tie\u0161i to. Vec\u0101kais variants, ko atradu Ukrain\u0101, ir 1.3.29, kas izn\u0101ca 2003. gada 29. oktobr\u012b (!!!).  Nginx ir otraj\u0101 viet\u0101 ar 61 659 serveriem.<\/p>\n
11 serveri izmanto WinCE, kas tika izlaists 1996. gad\u0101 un p\u0113d\u0113jo reizi tika atjaunin\u0101ts 2013. gad\u0101 (Austrij\u0101 t\u0101di ir tikai 4).<\/p>\n
Protokols HTTP\/2 izmanto 5 144 serverus, HTTP\/1.1 \u2014 256 836, HTTP\/1 \u2014 13 491.<\/p>\n
Printeri\u2026 jo\u2026 k\u0101p\u0113c gan n\u0113?<\/h3>\n
\n2 HP, 5 Epson un 4 Canon, kas ir pieejami no t\u012bkla, da\u017ei no tiem bez jebk\u0101das autoriz\u0101cijas.<\/p>\n
\"Es
\n <\/p>\n
webkameras<\/h3>\n
\nNav nosl\u0113pums, ka Ukrain\u0101 ir \u013bOTI daudz webkameru, kas straum\u0113 sevi internet\u0101, kas apkopotas da\u017e\u0101dos resursos. Vismaz 75 kameras straum\u0113 sevi internet\u0101 bez jebk\u0101das aizsardz\u012bbas. Skat\u012bt t\u0101s var \u0161eit<\/a><\/noindex>.<\/p>\n
\"Es
\n <\/p>\n
Kas t\u0101l\u0101k?<\/h2>\n
\nUkraina ir neliela valsts, t\u0101pat k\u0101 Austrija, ta\u010du tai ir t\u0101s pa\u0161as probl\u0113mas k\u0101 liel\u0101m valst\u012bm IT jom\u0101. Mums ir nepiecie\u0161ams izstr\u0101d\u0101t lab\u0101ku izpratni par to, kas ir dro\u0161s, kas ir b\u012bstams, un ra\u017eot\u0101jiem j\u0101nodro\u0161ina dro\u0161a s\u0101kotn\u0113j\u0101 konfigur\u0101cija savam apr\u012bkojumam.<\/p>\n
Turkl\u0101t es v\u0101cu partneru uz\u0146\u0113mumus (b\u016bt partnerim<\/a><\/noindex>), kuri var pal\u012bdz\u0113t jums nodro\u0161in\u0101t j\u016bsu IT infrastrukt\u016bras neskaram\u012bbu. N\u0101kamais solis pl\u0101noju veikt Ukrainas m\u0101jaslapu dro\u0161\u012bbas p\u0101rskatu. Nepalaidiet gar\u0101m!
\n
Avots: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e \u0410\u0432\u0441\u0442\u0440\u0438\u044e\u00bb. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043c\u043d\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442, \u0435\u0441\u043b\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u044d\u0442\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u0443\u0436\u0435 \u0441 \u0423\u043a\u0440\u0430\u0438\u043d\u043e\u0439. \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0435\u043b\u044c \u043a\u0440\u0443\u0433\u043b\u043e\u0441\u0443\u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0435\u0449\u0435 \u043f\u0430\u0440\u0443 \u0434\u043d\u0435\u0439 \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0444\u043e\u0440\u043c\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u044c\u044e, \u0430 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0441\u0435\u0434\u044b \u0441 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30310","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Es esmu sken\u0113jusi Ukrainu | ProHoster","description":"Febru\u0101r\u012b Austrij\u0101 dz\u012bvojo\u0161ais Christian Haschek sav\u0101 emu\u0101r\u0101 public\u0113ja interesantu rakstu ar nosaukumu \u201eEs nosken\u0113ju visu.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/ya-proskaniroval-ukrainu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0423\u043a\u0440\u0430\u0438\u043d\u0443 | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u0430\u0432\u0441\u0442\u0440\u0438\u0435\u0446 Christian Haschek \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u00ab\u042f \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u0441\u044e.","og:url":"https:\/\/prohoster.info\/lv\/blog\/ya-proskaniroval-ukrainu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:48+00:00","article:modified_time":"2019-10-31T18:34:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30310","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/30310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=30310"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/30310\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=30310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=30310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=30310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}