The SpiderLabs Research Team has identified an extensive scanning campaign which aims to enumerate the "setup.php" pages from a vast number of blogging and CMS applications. Below are the probes that we saw on our web honeypots today:
GET /3rdparty/phpMyAdmin/scripts/setup.php HTTP/1.1 GET /admin/mysql/scripts/setup.php HTTP/1.1 GET //admin/phpmyadmin/scripts/setup.php HTTP/1.1 GET //admin/pma/scripts/setup.php HTTP/1.1 GET /admin/pma/scripts/setup.php HTTP/1.1 GET /_admin/scripts/setup.php HTTP/1.1 GET //admin/scripts/setup.php HTTP/1.1 GET /admin/scripts/setup.php HTTP/1.1 GET admin/scripts/setup.php HTTP/1.1 GET //admm/scripts/setup.php HTTP/1.1 GET /admm/scripts/setup.php HTTP/1.1 GET //admn/scripts/setup.php HTTP/1.1 GET /admn/scripts/setup.php HTTP/1.1 GET /backup/phpmyadmin/scripts/setup.php HTTP/1.1 GET /backup/phpMyAdmin/scripts/setup.php HTTP/1.1 GET /bkup/phpmyadmin/scripts/setup.php HTTP/1.1 GET /bkup/phpMyAdmin/scripts/setup.php HTTP/1.1 GET /cpadmindb/scripts/setup.php HTTP/1.1 GET /cpadmin/scripts/setup.php HTTP/1.1 GET /cpanelmysql/scripts/setup.php HTTP/1.1 GET /cpdbadmin/scripts/setup.php HTTP/1.1 GET /cpphpmyadmin/scripts/setup.php HTTP/1.1 GET //databaseadmin/scripts/setup.php HTTP/1.1 GET /databaseadmin/scripts/setup.php HTTP/1.1 GET //dbadmin/scripts/setup.php HTTP/1.1 GET /dbadmin/scripts/setup.php HTTP/1.1 GET //db/scripts/setup.php HTTP/1.1 GET /db/scripts/setup.php HTTP/1.1 GET //myadmin/scripts/setup.php HTTP/1.1 GET /myadmin/scripts/setup.php HTTP/1.1 GET /MyAdmin/scripts/setup.php HTTP/1.1 GET /mysqladminconfig/scripts/setup.php HTTP/1.1 GET //mysql-admin/scripts/setup.php HTTP/1.1 GET //mysqladmin/scripts/setup.php HTTP/1.1 GET /mysql-admin/scripts/setup.php HTTP/1.1 GET /mysqladmin/scripts/setup.php HTTP/1.1 GET /MySQLAdmin/scripts/setup.php HTTP/1.1 GET //mysqlmanager/scripts/setup.php HTTP/1.1 GET /mysqlmanager/scripts/setup.php HTTP/1.1 GET //mysql/scripts/setup.php HTTP/1.1 GET //phpadmin/scripts/setup.php HTTP/1.1 GET /phpadmin/scripts/setup.php HTTP/1.1 GET //phpmanager/scripts/setup.php HTTP/1.1 GET /phpmanager/scripts/setup.php HTTP/1.1 GET /phpm/scripts/setup.php HTTP/1.1 GET /phpmyadmin/%0Dscripts/setup.php HTTP/1.1 GET //phpmyadmin1/scripts/setup.php HTTP/1.1 GET /phpmyadmin1/scripts/setup.php HTTP/1.1 GET /phpMyAdmin1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.2.3/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.2.6/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.4/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.5-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.5-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.5-rc2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.5/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.6-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.6-rc2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.6/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.7-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.5.7/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-alpha2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-alpha/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-beta1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-beta2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-pl2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-pl3/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-rc2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0-rc3/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.0/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.1-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.1-pl2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.1-pl3/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.1-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.1-rc2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.2-beta1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.2-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.2-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.3-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.3-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.3/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.4-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.4-pl2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.4-pl3/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.4-pl4/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.4-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.6.4/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.7.0-beta1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.7.0-pl1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.7.0-pl2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.7.0-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.7.0/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0.1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0.2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0.3/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0.4/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0-beta1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0-rc2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.0/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.1-rc1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.1/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2.8.2/scripts/setup.php HTTP/1.1 GET //phpmyadmin2/scripts/setup.php HTTP/1.1 GET //phpMyAdmin-2/scripts/setup.php HTTP/1.1 GET /_phpmyadmin/scripts/setup.php HTTP/1.1 GET //php-my-admin/scripts/setup.php HTTP/1.1 GET //php-myadmin/scripts/setup.php HTTP/1.1 GET //phpmy-admin/scripts/setup.php HTTP/1.1 GET //phpmyadmin/scripts/setup.php HTTP/1.1 GET /php-my-admin/scripts/setup.php HTTP/1.1 GET /php-myadmin/scripts/setup.php HTTP/1.1 GET /phpmy-admin/scripts/setup.php HTTP/1.1 GET /phpmyadmin/scripts/setup.php HTTP/1.1 GET /_phpMyAdmin/scripts/setup.php HTTP/1.1 GET //phpMyAdmin/scripts/setup.php HTTP/1.1 GET /phpMyAdmin/scripts/setup.php HTTP/1.1 GET /pHpMyAdMiN/scripts/setup.php HTTP/1.1 GET /PHPMYADMIN/scripts/setup.php HTTP/1.1 GET /phpMyAdmi/scripts/setup.php HTTP/1.1 GET /phpmyad/scripts/setup.php HTTP/1.1 GET /phpMyAds/scripts/setup.php HTTP/1.1 GET /phpmyad-sys/scripts/setup.php HTTP/1.1 GET /phpmya/scripts/setup.php HTTP/1.1 GET /phpMyA/scripts/setup.php HTTP/1.1 GET /phpmy/scripts/setup.php HTTP/1.1 GET /php/scripts/setup.php HTTP/1.1 GET //pma2005/scripts/setup.php HTTP/1.1 GET /pma2005/scripts/setup.php HTTP/1.1 GET //PMA2005/scripts/setup.php HTTP/1.1 GET /PMA2005/scripts/setup.php HTTP/1.1 GET //p/m/a/scripts/setup.php HTTP/1.1 GET //pma/scripts/setup.php HTTP/1.1 GET /p/m/a/scripts/setup.php HTTP/1.1 GET /pma/scripts/setup.php HTTP/1.1 GET /~/PMA/scripts/setup.php HTTP/1.1 GET /PMA/scripts/setup.php HTTP/1.1 GET /roundcube/scripts/setup.php HTTP/1.1 GET //scripts/setup.php HTTP/1.1 GET /scripts/setup.php HTTP/1.1 GET /sl2/data/scripts/setup.php HTTP/1.1 GET /sqladmin/scripts/setup.php HTTP/1.1 GET //sqlmanager/scripts/setup.php HTTP/1.1 GET /sqlmanager/scripts/setup.php HTTP/1.1 GET /sql/scripts/setup.php HTTP/1.1 GET //sqlweb/scripts/setup.php HTTP/1.1 GET /sqlweb/scripts/setup.php HTTP/1.1 GET /SSLMySQLAdmin/scripts/setup.php HTTP/1.1 GET //typo3/phpmyadmin/scripts/setup.php HTTP/1.1 GET /typo3/phpmyadmin/scripts/setup.php HTTP/1.1 GET /vhcs2/tools/pma/scripts/setup.php HTTP/1.1 GET //webadmin/scripts/setup.php HTTP/1.1 GET /webadmin/scripts/setup.php HTTP/1.1 GET //webdb/scripts/setup.php HTTP/1.1 GET /webdb/scripts/setup.php HTTP/1.1 GET /web/phpmyadmin/scripts/setup.php HTTP/1.1 GET //web/phpMyAdmin/scripts/setup.php HTTP/1.1 GET /web/phpMyAdmin/scripts/setup.php HTTP/1.1 GET //web/scripts/setup.php HTTP/1.1 GET /web/scripts/setup.php HTTP/1.1 GET //websql/scripts/setup.php HTTP/1.1 GET /websql/scripts/setup.php HTTP/1.1 GET /wp-content/plugins/wp-phpmyadmin/wp-phpmyadmin/phpmyadmin/scripts/setup.php HTTP/1.1 GET /wp-phpmyadmin/scripts/setup.php HTTP/1.1 GET //xampp/phpmyadmin/scripts/setup.php HTTP/1.1 GET /xampp/phpmyadmin/scripts/setup.php HTTP/1.1
Here are the two different User-Agent strings used in the probes:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en] User-Agent: Opera
There were no follow-up exploit attempts with this scanning which leads us to believe either:
- Since all of these requests resulted in 404 Not Found status codes, the target application was not present so an actual attack was not executed, or
- This is merely an enumeration scanning exercise where the attacker(s) are mapping out possible future targets. When a new vulnerability is found within one of these application in the future, the attacker can simplly consult their own list of possible targets.