GeneralInformation

Hostnames	onmarketer.net
Domains	onmarketer.net
Country	Viet Nam
City	Hanoi
Organization	Viettel Group
ISP	Viettel Group
ASN	AS7552

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

CVE-2023-46118	RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
CVE-2022-31008	RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.
CVE-2021-32719	3.5RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the `rabbitmq_federation_management` plugin and use [CLI tools](https://www.rabbitmq.com/cli.html) instead.
CVE-2021-32718	3.5RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

OpenPorts

22 80 443 5672 9100 9101

-209539503 | 2024-04-21T06:47:53.254720

22 / tcp

SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.6
Key type: ssh-rsa
Key: AAAAB3NzaC1yc2EAAAADAQABAAABAQDSjo5zQNODw4xsRH+MIVBkeMQsuEHKWweDbuU7hWhYCpg9
eGGrgfEK0Q+x6JpbImUJPsIqundZ7iTakLwGgbELe0p3m41hMuM/Gtuf182kxpvOif7viiLFL+5V
IhbX6tG3XgIivu6qyuAlPpw2wWCcwsWNDRUOZ6fmzXQ4nz92Qa6mwpIPZImP2ojRl+Ghf4YEF6YW
0tPfNtZNsjbcZJc6yonXYia1ZwbTVsa2s/MNfK1MXJX3Gsvhn5CgCL74GmtoZl1viKjBa/EcnZzk
ASpKCrLay1L38VEcSwIF4oZD5fys+j4lJQAEUCsuwVQPDq1Fsjxz4MwQWpqWdrqm32Dz
Fingerprint: a0:a6:78:e2:96:2d:ec:c5:96:e9:f7:5e:d6:0d:1a:2e

Kex Algorithms:
	curve25519-sha256@libssh.org
	ecdh-sha2-nistp256
	ecdh-sha2-nistp384
	ecdh-sha2-nistp521
	diffie-hellman-group-exchange-sha256
	diffie-hellman-group14-sha1

Server Host Key Algorithms:
	ssh-rsa
	rsa-sha2-512
	rsa-sha2-256
	ecdsa-sha2-nistp256
	ssh-ed25519

Encryption Algorithms:
	chacha20-poly1305@openssh.com
	aes128-ctr
	aes192-ctr
	aes256-ctr
	aes128-gcm@openssh.com
	aes256-gcm@openssh.com

MAC Algorithms:
	umac-64-etm@openssh.com
	umac-128-etm@openssh.com
	hmac-sha2-256-etm@openssh.com
	hmac-sha2-512-etm@openssh.com
	hmac-sha1-etm@openssh.com
	umac-64@openssh.com
	umac-128@openssh.com
	hmac-sha2-256
	hmac-sha2-512
	hmac-sha1

Compression Algorithms:
	none
	zlib@openssh.com

-1972326615 | 2024-04-20T20:24:46.831276

80 / tcp

HTTP/1.0 503 Service Unavailable
Cache-Control: no-cache
Connection: close
Content-Type: text/html

-1972326615 | 2024-04-24T13:07:04.883379

443 / tcp

HTTP/1.0 503 Service Unavailable
Cache-Control: no-cache
Connection: close
Content-Type: text/html

SSL Certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            03:f4:2d:40:02:ee:88:eb:8a:13:f3:c3:af:75:89:08:2c:72
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Let's Encrypt, CN=R3
        Validity
            Not Before: Feb 24 18:04:22 2024 GMT
            Not After : May 24 18:04:21 2024 GMT
        Subject: CN=onmarketer.net
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:d8:cc:ae:f9:c3:7b:11:bb:cf:7a:a3:f8:7d:55:
                    1d:46:b6:90:81:30:ba:f0:cc:37:a5:49:96:10:4e:
                    32:ea:e1:85:74:31:1c:85:8f:5c:ed:49:9c:3e:e3:
                    2d:7c:ca:38:45:14:ec:66:60:fd:0a:8f:66:e6:5d:
                    8a:55:22:3c:ab:d2:51:f3:77:d5:da:8d:5e:88:6b:
                    9e:28:62:be:4c:22:0c:06:2a:91:c6:c5:c5:4c:df:
                    31:d8:60:57:8f:98:38:13:ce:23:f3:75:39:eb:58:
                    d8:e2:0b:5e:f8:37:14:87:e7:72:83:d1:79:65:81:
                    07:31:0c:7b:f6:bd:ed:95:c3:26:32:4f:d2:12:da:
                    15:e5:63:30:86:23:e5:03:81:14:4f:78:28:0e:1e:
                    2e:a4:ff:f9:5b:ac:22:50:52:61:65:1a:66:e1:4b:
                    55:4c:f5:f5:67:03:04:e8:32:c1:35:55:9f:76:b0:
                    85:b3:d8:aa:f7:a6:d1:a4:14:5d:ef:68:5b:e9:23:
                    4f:a0:34:c2:2c:c2:c4:50:6f:cc:d4:6b:ed:37:c9:
                    39:1b:78:f0:08:b1:bf:54:6c:9d:a0:a4:75:fb:b3:
                    5d:98:df:19:7d:42:1f:78:b7:7d:b1:84:f5:f5:99:
                    49:fc:69:12:a5:3d:07:e0:42:a4:fe:4d:81:11:5f:
                    10:25
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                45:46:C1:69:CE:B8:8B:AA:29:5A:65:53:FD:C1:B7:9D:E0:08:F2:55
            X509v3 Authority Key Identifier: 
                14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6
            Authority Information Access: 
                OCSP - URI:http://r3.o.lencr.org
                CA Issuers - URI:http://r3.i.lencr.org/
            X509v3 Subject Alternative Name: 
                DNS:*.onmarketer.net, DNS:onmarketer.net
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : A2:E2:BF:D6:1E:DE:2F:2F:07:A0:D6:4E:6D:37:A7:DC:
                                65:43:B0:C6:B5:2E:A2:DA:B7:8A:F8:9A:6D:F5:17:D8
                    Timestamp : Feb 24 19:04:22.716 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:38:C5:47:DB:B6:F3:40:6E:CB:0D:1B:B1:
                                0A:F3:72:7B:3C:D5:03:8A:FE:2E:09:7F:EA:13:A7:65:
                                82:1E:C1:EA:02:20:22:04:9E:1F:F8:4E:1E:BA:A1:AB:
                                FF:D2:D8:3D:37:2A:8A:50:4E:4F:9C:67:76:8A:B4:6F:
                                9C:5F:82:11:B2:AA
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : 76:FF:88:3F:0A:B6:FB:95:51:C2:61:CC:F5:87:BA:34:
                                B4:A4:CD:BB:29:DC:68:42:0A:9F:E6:67:4C:5A:3A:74
                    Timestamp : Feb 24 19:04:22.788 2024 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:45:02:20:13:B4:95:78:BD:9B:77:DE:3D:2E:59:60:
                                C4:B4:FB:FF:AA:48:78:FE:0B:82:83:CE:1B:54:A0:D6:
                                2F:EF:03:FA:02:21:00:CD:8E:4C:B0:4A:2E:90:65:E3:
                                BE:74:94:43:B5:4F:B4:8B:C5:D3:26:C2:3C:3A:19:A8:
                                6B:E0:DA:7B:66:DC:A2
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        56:3c:fe:44:e9:e1:ea:0b:3d:39:e6:51:1c:48:8f:5c:76:01:
        b2:bd:5a:b9:a1:c7:6c:64:9e:64:d6:38:d5:80:95:61:f6:22:
        d6:25:e8:cb:ea:7f:fa:73:03:17:d2:dd:ba:be:03:67:06:6d:
        4f:3e:ce:09:af:a9:6b:02:11:21:e9:6f:2a:60:a3:f5:24:2a:
        ef:cd:da:57:d8:48:be:a4:01:9c:3c:18:9c:42:56:b7:b0:0a:
        d5:ff:c0:8f:80:ef:ad:21:8d:ed:ef:16:9a:ab:96:9f:b2:e2:
        ad:f5:70:cb:3a:80:ed:b0:61:c9:a1:d4:37:fc:15:27:48:e4:
        bd:76:f0:1a:25:71:9c:1d:92:88:77:6d:81:fd:87:5f:56:7f:
        2f:dd:14:fb:f0:35:23:9c:e7:f3:4d:9f:03:16:e9:30:1c:1b:
        87:c2:50:e5:e7:d8:4c:18:10:a8:c3:a2:de:f9:8e:07:c4:94:
        8e:a2:bf:bb:b8:29:01:9d:6a:6b:42:fa:8e:97:25:3e:64:f6:
        e1:c3:1b:a6:89:68:2c:f8:a6:5d:4d:d4:d9:c8:80:c8:d6:10:
        42:96:06:ac:0a:62:9d:c2:88:62:2a:c0:2a:46:d0:ce:c3:64:
        95:25:37:2d:25:07:a2:6d:15:bd:78:56:b3:95:0f:be:42:a4:
        19:cf:4e:53

1849931924 | 2024-03-27T08:33:09.113247

5672 / tcp

AMQP:
  Protocol Version: 0-9
  Product: RabbitMQ
  Product Version: 3.8.16
  Platform: Erlang/OTP 23.3
  Capabilities:
    Exchange Exchange Bindings: True
    Connection.blocked: True
    Authentication Failure Close: True
    Direct Reply To: True
    Basic.nack: True
    Per Consumer Qos: True
    Consumer Priorities: True
    Consumer Cancel Notify: True
    Publisher Confirms: True

-318672333 | 2024-04-19T12:06:04.332252

9100 / tcp

HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=utf-8
Connection: close

400 Bad Request
Prometheus Node Exporter:
  node_exporter_build_info:
    branch: HEAD
    goversion: go1.19.1
    revision: 7da1321761b3b8dfc9e496e1a60e6a476fec6018
    version: 1.4.0
  node_os_info:
    id: ubuntu
    id_like: debian
    name: Ubuntu
    pretty_name: Ubuntu 16.04.5 LTS
    version: 16.04.5 LTS (Xenial Xerus)
    version_codename: xenial
    version_id: 16.04
  node_uname_info:
    domainname: (none)
    machine: x86_64
    nodename: autha-master
    release: 4.4.0-116-generic
    sysname: Linux
    version: #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018
  node_dmi_info:
    bios_date: 04/05/2016
    bios_vendor: Phoenix Technologies LTD
    bios_version: 6.00
    board_name: 440BX Desktop Reference Platform
    board_serial: None
    board_vendor: Intel Corporation
    board_version: None
    chassis_asset_tag: No Asset Tag
    chassis_serial: None
    chassis_vendor: No Enclosure
    chassis_version: N/A
    product_name: VMware Virtual Platform
    product_serial: VMware-42 2b d8 64 94 2c a4 23-65 05 61 7a 80 f6 bf 81
    product_uuid: 64D82B42-2C94-23A4-6505-617A80F6BF81
    product_version: None
    system_vendor: VMware, Inc.
  node_network_info:
    lo:
      address: 00:00:00:00:00:00
      broadcast: 00:00:00:00:00:00
      device: lo
      operstate: unknown
    ens192:
      address: 00:50:56:ab:0d:90
      broadcast: ff:ff:ff:ff:ff:ff
      device: ens192
      duplex: full
      operstate: up
    ens160:
      address: 00:50:56:ab:e4:e5
      broadcast: ff:ff:ff:ff:ff:ff
      device: ens160
      duplex: full
      operstate: up

1394336226 | 2024-04-17T12:55:21.037914

9101 / tcp

HTTP/1.1 200 OK
Date: Wed, 17 Apr 2024 12:55:20 GMT
Content-Length: 216
Content-Type: text/html; charset=utf-8

171.244.15.40

Last Seen: 2024-04-24

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

-209539503 | 2024-04-21T06:47:53.254720
22 / tcp

OpenSSH7.2p2 Ubuntu-4ubuntu2.6

-1972326615 | 2024-04-20T20:24:46.831276
80 / tcp

-1972326615 | 2024-04-24T13:07:04.883379
443 / tcp

1849931924 | 2024-03-27T08:33:09.113247
5672 / tcp

RabbitMQ3.8.16

-318672333 | 2024-04-19T12:06:04.332252
9100 / tcp

Prometheus Node Exporter1.4.0

1394336226 | 2024-04-17T12:55:21.037914
9101 / tcp

Products

Pricing

Contact Us

171.244.15.40

Last Seen: 2024-04-24

Tags:

GeneralInformation

Vulnerabilities

OpenPorts

-209539503 | 2024-04-21T06:47:53.254720 22 / tcp

OpenSSH7.2p2 Ubuntu-4ubuntu2.6

-1972326615 | 2024-04-20T20:24:46.831276 80 / tcp

-1972326615 | 2024-04-24T13:07:04.883379 443 / tcp

1849931924 | 2024-03-27T08:33:09.113247 5672 / tcp

RabbitMQ3.8.16

-318672333 | 2024-04-19T12:06:04.332252 9100 / tcp

Prometheus Node Exporter1.4.0

1394336226 | 2024-04-17T12:55:21.037914 9101 / tcp

Products

Pricing

Contact Us

-209539503 | 2024-04-21T06:47:53.254720
22 / tcp

-1972326615 | 2024-04-20T20:24:46.831276
80 / tcp

-1972326615 | 2024-04-24T13:07:04.883379
443 / tcp

1849931924 | 2024-03-27T08:33:09.113247
5672 / tcp

-318672333 | 2024-04-19T12:06:04.332252
9100 / tcp

1394336226 | 2024-04-17T12:55:21.037914
9101 / tcp