SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
Single SSH session used default credentials test/123456 with SSH-2.0-Go. Attacker ran basic host rec ...
show moreSingle SSH session used default credentials test/123456 with SSH-2.0-Go. Attacker ran basic host recon: uname -a, cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and searched writable locations by looping through /dev/shm /tmp /var/run /mnt /root /. They attempted persistence in cron by reading crontab and checking for an @reboot entry referencing /tmp/w.sh, then prepared a payload dropper with cd "/tmp" && if [ ! -f "w.sh" ]; then cat > "w.sh" && chmod +x w.sh; fi. Observed payload/persistence target was /tmp/w.sh, with cron string including "/tmp/w.sh "astats" "netai" "kstats" "ssh 2 az"". No download, lateral movement, or additional artifacts were observed.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
Single SSH session used credentials admin/TCGA$tI7-m0uO$_ and ran Linux recon plus persistence setup ...
show moreSingle SSH session used credentials admin/TCGA$tI7-m0uO$_ and ran Linux recon plus persistence setup. Observed commands checked CPU count, kernel version, running processes, and writable working dirs. Attacker wrote /tmp/w.sh (script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28), made it executable, and attempted persistence in two ways: added an @reboot crontab entry invoking /tmp/w.sh with args "astats" "netai" "kstats" and also created ~/.config/systemd/user/watcher-netai.service, then ran systemctl --user daemon-reload and enable --now. No lateral movement, port forwarding, or additional downloads were observed.
show less
Single SSH session using admin/TCGA$tI7-m0uO$_ from SSH-2.0-Go. Activity focused on host survey and ...
show moreSingle SSH session using admin/TCGA$tI7-m0uO$_ from SSH-2.0-Go. Activity focused on host survey and persistence setup. Commands checked OS/kernel (uname -a), CPU count (/proc/cpuinfo), and top processes (ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10). It searched writable locations (/dev/shm, /tmp, /var/run, /mnt, /root, /) and staged a script in /tmp: cd "/tmp" && if [ ! -f "w.sh" ]; then cat > "w.sh" && chmod +x w.sh; fi. Persistence attempts included crontab enumeration and an @reboot entry for /tmp/w.sh with arguments "astats" "netai" "kstats", plus a systemd user service at ~/.config/systemd/user/watcher-netai.service followed by systemctl --user daemon-reload and enable --now. No downloads, malware artifacts, lateral movement, or port forwards were observed.
show less