ืืขืฆืืข ืืืึธื ืงืึธืืืขืจืกืึทื ื , ืึทื "ืื ืงืืืขื ื ืืึทืกืขืก ืคืื ืกืืจืื ืืื ืืื ืกืึธื ื ืฆืขื ืืขืจ ืืขื ืขื ืืขืืืขื ืืื ืื ืฆืืืืจ ืคืขืื," ืึธืืขืจ ืืื ืคืึทืงื ืึทืืฅ ืืื ืคืื ืขืจืืขืจ ืืื ืืืึธืก ืืื ืืขืฉืจืืื ืืื ืืขื ืึทืจืืืงื.
ืืื ืืึธืื ืฉืืื ืืืจืืืขืงืึธืื ืึท ืืืืืืื ืืขืื ืืฉ ืึทื ืึทืืืกืืก ืคืื ืืขื ืจืื ืขื. , ืืขืจืืืขืจ ืืืขืื ืืืจ ืืึธ ืืืืขืจืืืื ืืืืื ืื ืืืืคึผื ืคืื ืงืื.
ะะธัะบะปะตะนะผะตั: ะฒัั ะธะฝัะพัะผะฐัะธั ะฝะธะถะต ะฟัะฑะปะธะบัะตััั ะธัะบะปััะธัะตะปัะฝะพ ะฒ ะพะฑัะฐะทะพะฒะฐัะตะปัะฝัั
ัะตะปัั
. ะะฒัะพั ะฝะต ะฟะพะปััะฐะป ะดะพัััะฟะฐ ะบ ะฟะตััะพะฝะฐะปัะฝัะผ ะดะฐะฝะฝัะผ ััะตััะธั
ะปะธั ะธ ะบะพะผะฟะฐะฝะธะน. ะะฝัะพัะผะฐัะธั ะฒะทััะฐ ะปะธะฑะพ ะธะท ะพัะบััััั
ะธััะพัะฝะธะบะพะฒ, ะปะธะฑะพ ะฑัะปะฐ ะฟัะตะดะพััะฐะฒะปะตะฝะฐ ะฐะฒัะพัั ะฐะฝะพะฝะธะผะฝัะผะธ ะดะพะฑัะพะถะตะปะฐัะตะปัะผะธ.ืื ืื ืืขืจ Elasticsearch ืกืขืจืืืขืจ ืืื ืื ืืขืงืกืื ืืื ืืขืืืขื ืคืจืื ืื ืืืฆื:
- graylog2_0
- ืจืขืึทืืืข
- unauth_text
- ืืืืคึผ:
- graylog2_1
ะ graylog2_0 ืงืึทื ืืืื ื ืืึธืืก ืคืื 16.11.2018 ื ืืืืขืืืขืจ 2019 ืฆื ืืขืจืฅ XNUMX, ืืื ืืื graylog2_1 - ืืึธืืก ืคืื ืืขืจืฅ 2019 ืฆื 04.06.2019/XNUMX/XNUMX. ืืื ืึทืงืกืขืก ืฆื Elasticsearch ืืื ืคืืจืืืื, ืื ื ืืืขืจ ืคืื ืจืขืงืึธืจืืก ืืื graylog2_1 ืืขืืืืงืกื.
ืืืื ืื Shodan ืืืื ืืึธืืึธืจ, ืืขื Elasticsearch ืืื ืคืจืื ืื ืืืฆื ืืื ื ื ืืืืขืืืขืจ 12.11.2018, 16.11.2018 (ืืื ืืขืฉืจืืื ืืืืื, ืื ืขืจืฉืืขืจ ืืืื ืกื ืืื ืื ืืึธืืก ืืขื ืขื ืืืืืื XNUMX ื ืืืืขืืืขืจ XNUMX).
ืืื ืื ืืึธืืก, ืืื ืื ืคืขืื gl2_remote_ip IP ืึทืืจืขืกืขืก 185.156.178.58 ืืื 185.156.178.62 ืืขื ืขื ืกืคึผืขืกืืคืืขื ืืื ืื ืก ื ืขืืขื srv2.inventive.ru ะธ srv3.inventive.ru:
ืืื ืืื ืืขืืจืขื ืื ืื ืืืขื ืืืื ืจืขืืึทืื ืืจืืคืข (www.inventive.ru) ืืืขืื ืืขื ืคึผืจืึธืืืขื ืืืืฃ 04.06.2019/18/25 ืืืึท 22:30 (ืืึธืกืงืืืข ืฆืืื) ืืื ืืืจื XNUMX:XNUMX ืื ืกืขืจืืืขืจ "ืฉืืื" ืคืึทืจืฉืืืื ืื ืคืื ืฆืืืืจ ืึทืงืกืขืก.
ืื ืืึธืืก ืงืึทื ืืืื ื (ืึทืืข ืืึทืื ืืขื ืขื ืขืกืืึทืืึทืฅ, ืืืคึผืืืงืึทืื ืืขื ืขื ื ืืฉื ืึทืืืขืงืืขื ืืืขื ืคืื ืื ืืฉืืื ืืช, ืึทืืื ืืขืจ ืืึทื ื ืคืื ืคืึทืงืืืฉ ืืืงื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืืืกืืึธืืข ืืืืื ืืงืขืจ):
- ืืขืจ ืืื 3 E- ืืจืืื ืึทืืจืขืกื ืคืื ืงืึทืกืืึทืืขืจื ืคึฟืื ืจื: ืกืืึธืจ, ืกืึทืืกืื ื, ืกืืจืื ืืื ืืื ืืขืืึธ ืกืืึธืจื
- ืืขืจ ืืื 7 ืืขืืขืคืึธื ื ืืืขืจื ืคืื ืงืึทืกืืึทืืขืจื ืคึฟืื ืจื: ืกืืึธืจ, ืกืึธื ื, ื ืืงืข, ืกืืจืื ืืื ืืื ืืขืืึธ ืกืืึธืจื
- ืืขืจ ืืื 21 ืืืืื ื ืืึธืืื / ืคึผืึทืจืึธื ืคึผืขืจื ืคึฟืื ืคืขืจืืขื ืืขืืข ืึทืงืึทืื ืฅ ืคืื ืืืืขืจืก ืคืื ืกืึธื ื ืืื ืกืืจืื ืืื ืกืืึธืจื.
- ืจืืึฟ ืจืขืงืึธืจืืก ืืื ืืขืืขืคืึธื ื ืืืขืจื ืืื ืืืืฆืคึผืึธืกื ืืืื ืงืึทื ืืืื ื ืคืื ื ืขืืขื (ืึธืคื ืืื ืืึทืืืึทื) ืืื ืืืืึทืืื ืงืึธืจื ื ืืืขืจื.
ืืืึทืฉืคึผืื ืคืื ืื ืงืืึธืฅ ืฉืืึทืืืช ืฆื ืื Nike ืงืจืึธื ืงืืืขื ื (ืึทืืข ืฉืคึผืืจืขืืืืืง ืืึทืื ืจืืคึผืืืืกื ืืื "X" ืืืชืืืช):
"message": "{"MESSAGE":"[URI] /personal/profile/[ะะะขะะ ะะะะ ะะกะ] contact[ะะะะะซะ POST] Arrayn(n [contact[phone]] => +7985026XXXXn [contact[email]] => [email protected] [contact[channel]] => n [contact[subscription]] => 0n)n[ะะะะะซะ GET] Arrayn(n [digital_id] => 27008290n [brand] => NIKEn)n[ะะขะะะข ะกะะ ะะะ ะ] ะะพะด ะพัะฒะตัะฐ - 200[ะะขะะะข ะกะะ ะะะ ะ] stdClass Objectn(n [result] => successn [contact] => stdClass Objectn (n [phone] => +7985026XXXXn [email] => [email protected] [channel] => 0n [subscription] => 0n )nn)n","DATE":"31.03.2019 12:52:51"}",ืืื ืืึธ ืืื ืึท ืืืืฉืคึผืื ืคืื ืืื ืืึธืืื ืก ืืื ืคึผืึทืกืืืขืจืื ืคืื ืคึผืขืจืืขื ืืขื ืึทืงืึทืื ืฅ ืคืื ืืืืขืจืก ืืืืฃ ืืืขืืกืืืขืก ืืขื ืขื ืกืืึธืจื sc-store.ru ะธ street-beat.ru:
"message":"{"MESSAGE":"[URI]/action.php?a=login&sessid=93164e2632d9bd47baa4e51d23ac0260&login=XXX%40gmail.com&password=XXX&remember=Y[ะะะขะะ ะะะะ ะะกะ] personal[ะะะะะซะ GET] Arrayn(n [digital_id] => 26725117n [brand]=> SONYn)n[ะะขะะะข ะกะะ ะะะ ะ] ะะพะด ะพัะฒะตัะฐ - [ะะขะะะข ะกะะ ะะะ ะ] ","DATE":"22.04.2019 21:29:09"}"ืื ืืึทืึทืืืขืจ IRG ืืขืจืงืืขืจืื ื ืืืืฃ ืืขื ืืื ืฆืืืขื ื ืงืขื ืขื ืืืื ืืืืขื ืขื , ืืืืกืฆืื ืืขืจืคืื:
ืืืจ ืงืขื ื ืืฉื ืืืื ืึธืจืืจื ืืขื ืคืื ื ืืื ืืฉืืื ืืืฉื ืื ืคึผืึทืกืืืขืจืื ืฆื ืงืืืืึทื ืฅ 'ืคืขืจืืขื ืืขืืข ืึทืงืึทืื ืฅ ืฆื ืฆืืึทืืืืืึทืืืง ืึธื ืขืก, ืืื ืกืืจ ืฆื ืืืกืืืืื ืื ืืขืืืขื ื ืืฆื ืคืื ืืึทืื ืคืื ืคึผืขืจืืขื ืืขื ืึทืงืึทืื ืฅ ืคึฟืึทืจ ืคืจืึธืืืฉืึทืืึทื ื ืฆืืืขืงื. ืื ืคืืจืืข ืืื ื ืืฉื ืืึทืฉืืขืืืงื ืืืงืก ืคืื ืคึผืขืจืืขื ืืขื ืืึทืื ืคืื street-beat.ru ืงืืืืึทื ืฅ. ืึทืืข ืคึผืจืึทืืืฉืขืงืก ืคืื ืื ืืืขื ืืืื ืจืขืืึทืื ืืจืืคืข ืืขื ืขื ืืืื ืึธืคึผืืขืฉืืขืื. ืงืืื ืืจืขืฅ ืฆื ืื ืคึผืขืจืืขื ืืขื ืืึทืื ืคืื ืงืืืืึทื ืฅ ืืขื ืขื ืืืืขืงืืึทื.
ืขืก ืืื ืฉืืขืื ืึทื IRG ืงืขื ื ืืฉื ืจืขืืขื ืขื ืืืึธืก ืืื ืืืงื ืืื ืืืึธืก ืืื ื ืืฉื. ืืึธ ืืื ืึท ืืืืฉืคึผืื ืคืื ืื ืงืืึธืฅ ืฉืืึทืืืช ืฆื ืื ืกืืจืื ืืื ืงืจืึธื ืงืืืขื ื:
"message": "{"MESSAGE":"'DATA' => ['URI' => /local/components/multisite/order/ajax.php,'ะะะขะะ ะะะะ ะะกะ' = contact,'ะะะะะซะ POST' = Arrayn(n [contact[phone]] => 7915545XXXXn)n,'ะะะะะซะ GET' =nttArrayn(n [digital_id] => 27016686n [brand] => STREETBEATn)n,'ะะขะะะข ะกะะ ะะะ ะ' = 'ะะพะด ะพัะฒะตัะฐ - '200,'RESPONCE' = stdClass Objectn(n [result] => successn [contact] => stdClass Objectn (n [phone] => +7915545XXXXn [email] => [email protected]","ะะฐัะฐ":"01.04.2019 08:33:48"}",ืึธืืขืจ, ืืึธืืืจ ืืืื ืฆื ืื ืืึทืงืข ืฉืืขืื ื ืืึทืขืก ืืื ืืขืจืงืืขืจื ืืืึธืก ืืึธืก ืืื ืึท ืจืื ืขื ืคืื ืคืขืจืืขื ืืขืืข ืืึทืื ืคืื IRG ืงืืืืึทื ืฅ.
ืืืื ืืืจ ืงืืง ืขื ื ืืื ืื ืื ืืขืงืกืื ืคืื ืืขื ืคืจืื ืื ืืืฆื Elasticsearch, ืืืจ ืืืขื ืืึทืืขืจืงื ืฆืืืื ื ืขืืขื ืืื ืืื: ืจืขืึทืืืข ะธ unauth_text. ืืึธืก ืืื ืึท ืืึทืจืึทืงืืขืจืืกืืืฉ ืฆืืืื ืคืื ืืืื ืขืจ ืคืื ืื ืคืืืข ืจืึทื ืกืึธืืืืึทืจืข ืกืงืจืืคึผืก. ืขืก ืึทืคืขืงืืึทื ืืขืจ ืืื 4 ืืืืื ื Elasticsearch ืกืขืจืืืขืจืก ืึทืจืื ืื ืืืขืื. ืืื ืืึทืื ืจืขืึทืืืข ืงืืงื ืืื ืืึธืก:
"ALL YOUR INDEX AND ELASTICSEARCH DATA HAVE BEEN BACKED UP AT OUR SERVERS, TO RESTORE SEND 0.1 BTC TO THIS BITCOIN ADDRESS 14ARsVT9vbK4uJzi78cSWh1NKyiA2fFJf3 THEN SEND AN EMAIL WITH YOUR SERVER IP, DO NOT WORRY, WE CAN NEGOCIATE IF CAN NOT PAY"ืืฉืขืช ืืขืจ ืกืขืจืืืขืจ ืืื IRG ืืึธืืก ืืื ืืขืืืขื ืคืจืืื ืฆืืืจืืืืขื, ืึท ืจืึทื ืกืึธืืืืึทืจืข ืฉืจืืคื ืืืฉืืืื ืืึทืื ืขื ืึทืงืกืขืก ืฆื ืื ืงืืืืึทื ืฅ 'ืืื ืคึฟืึธืจืืึทืฆืืข ืืื, ืืืื ืื ืึธื ืืึธื ืขืก ืืื ืงืก, ืื ืืึทืื ืืขื ืขื ืืึทืื ืืึธืืืื.
ืืื ืืขืจืฆื, ืืื ืืึธืื ืงืืื ืฆืืืืืคื ืึทื ืื ืืึทืืึทืืืืก ืืื ืืขืคืื ืขื ืคึฟืึทืจ ืืืจ ืืื ืืื ืฉืืื ืืึทืื ืืึธืืืื. ืืื ืืืืื ืืคืืื ืืขืืืื ืื ืืื ืืื ืืืืขืจ ืืขืจืคืื. ืขืก ืืื ืงืืื ืกืื ืึทื ืึทืืึท ืึธืคึฟื ืืึทืืึทืืืืกืื ืืขื ืขื ืคึผืขืจืคึผืึทืกืคืึทืื ืืขืืืื ืืื ืคึผืึทืืคึผื ืืืืก.
ื ืืึทืขืก ืืืขืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืงืก ืืื ืื ืกืืืขืจื ืงืขื ืขื ืฉืืขื ืืืง ืืืื ืืขืคึฟืื ืขื ืืืืฃ ืืืื ืืขืืขืืจืึทื ืงืึทื ืึทื "' .
ืืงืืจ: www.habr.com