tempted credential exploitation across three login attempts using weak/default credentials (dell/123 ...
show moretempted credential exploitation across three login attempts using weak/default credentials (dell/123456, dell/3245gs5662d34, 345gs5662d34/345gs5662d34) with libssh 0.9.6. Two successful command executions observed. First payload removes existing SSH directory and recreates it, then deploys public key (RSA AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) for persistent remote access. Second command chain attempts to lock down the .ssh directory using chattr and lockr utilities to prevent removal/modification by other processes or users, suggesting coordination with additional access mechanisms or attempts to persist against cleanup efforts. Attack pattern indicates automated scanning for default credentials followed by SSH key installation for backdoor access. Attacker demonstrates knowledge of Linux file attributes and locking mechanisms, suggesting targeted rather than indiscriminate scanning.
show less
Attackers exploited weak credentials across three sessions using libssh_0.9.6. First session used 34 ...
show moreAttackers exploited weak credentials across three sessions using libssh_0.9.6. First session used 345gs5662d34/345gs5662d34; second attempted root/3245gs5662d34; third used root/south. After gaining access, operators executed SSH key injection followed by attribute manipulation. Initial command removed existing .ssh directory, created new one, and injected RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) into authorized_keys for persistent backdoor access. Second command attempted to modify inode attributes using chattr and lockr tools to prevent .ssh directory deletion/modification, hardening persistence against remediation. Attack chain demonstrates credential stuffing followed by SSH key persistence mechanism and anti-forensics/anti-removal tactics. No malware downloads observed. No lateral movement detected within honeypot scope.
show less
Brute-force SSH attack using Go library (automated scanner/botnet). Attacker attempted 10 common roo ...
show moreBrute-force SSH attack using Go library (automated scanner/botnet). Attacker attempted 10 common root creds across 10 sessions in 15min: Root123, admin, admin123, letmein, passw0rd, password, password1, qwerty, r00t, root. All targeted root account for sudo privesc. Recon payload queried CPU via nproc/busybox//proc/cpuinfo to enumerate system resources. Cmd exec chain attempted sudo with piped password via echo, indicating automated tooling with embedded creds. Suggests system fingerprinting for botnet recruitment or crypto-mining capacity assessment. No successful auth. Pattern consistent with mass-scanning infra enumeration campaigns. SSH-2.0-Go client string confirms Go-based SSH library typical of automated attack frameworks. No lateral movement, persistence, malware dl, or port forwarding observed. Dictionary-standard weak passwords commonly targeted by automated scanners on IoT/misconfigured Linux servers.
show less
Brute force SSH attack targeting root account with sequential numeric passwords (123-123456789) usin ...
show moreBrute force SSH attack targeting root account with sequential numeric passwords (123-123456789) using Go SSH client. Attacker executed reconnaissance commands: nproc, /proc/cpuinfo, busybox to enumerate CPU cores; uname for OS fingerprinting (kernel, hostname, arch). All nproc cmds prefixed with sudo -S password piping, testing for passwordless sudo/weak privilege escalation. PATH explicitly set before uname execution, indicating prep for payload delivery/lateral movement. No persistence, downloads, or secondary payloads observed. Pattern consistent with automated recon prior to malware deployment or botnet infection. Ten sessions over 15-min window with identical creds but varying cmd sequences indicates scripted scanning from credential-stuffing/mass-exploitation framework.
show less
Weak creds (root/111111) via Go SSH client - scripted brute-force. Two sessions in 4min executed: np ...
show moreWeak creds (root/111111) via Go SSH client - scripted brute-force. Two sessions in 4min executed: nproc, busybox, /proc/cpuinfo parsing for CPU detection; uname for OS fingerprinting (kernel, hostname, arch). PATH set to standard dirs with error suppression (2>/dev/null), indicating multi-distro scanner prep. No persistence, lateral movement, or payload downloads observed. Activity consistent with automated reconnaissance framework initial phase for target classification before secondary exploitation.
show less
Brute force SSH attack across 3 sessions. Creds tested: 345gs5662d34/345gs5662d34, demo/3245gs5662d3 ...
show moreBrute force SSH attack across 3 sessions. Creds tested: 345gs5662d34/345gs5662d34, demo/3245gs5662d34, demo/password using libssh 0.9.6 client. Post-exploitation: (1) Removed/recreated .ssh dir, injected RSA public key AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx for persistent SSH access. (2) Executed chattr -ia and lockr -ia against .ssh dir for file immutability/anti-remediation. Attack chain: credential compromise→successful auth→persistence via SSH key injection→anti-forensic file locking. Lockr utility suggests rootkit/anti-forensic tool. ~10 second duration. libssh 0.9.6 fingerprint consistent with automated propagation tools. Attacker achieved SSH backdoor access and hardened against detection/removal.
show less
Brute force SSH login attempt using credentials root/qwerty123456 via Go-based SSH client. Single su ...
show moreBrute force SSH login attempt using credentials root/qwerty123456 via Go-based SSH client. Single successful session lasting 12 seconds. Attacker executed system reconnaissance commands to enumerate CPU core count (nproc via sudo, grep /proc/cpuinfo fallback) and gather uname system information (kernel name, version, hostname, architecture). Commands show polyglot approach testing multiple binary paths and busybox fallbacks, indicating targeting of minimal/containerized environments. Credential and command patterns consistent with automated botnet reconnaissance phase. No file downloads, persistence mechanisms, or lateral movement observed in this session.
show less
SSH brute-force attack using Go client against root account. Creds attempted: p4ssword, passw0rd, pa ...
show moreSSH brute-force attack using Go client against root account. Creds attempted: p4ssword, passw0rd, password, qwerty across 4 sessions in 13min. Reconnaissance: CPU core enumeration via nproc with fallbacks (binary, busybox, /proc/cpuinfo). Attacker executed identical payload per cred variant using echo piping and sudo -S for privilege escalation. Secondary recon gathered kernel/hostname via uname with multiple exec paths. Environment PATH manipulation observed. Attack pattern consistent with automated botnet reconnaissance phase prior to payload delivery/lateral movement. No malware downloads, persistence, or lateral movement detected. Standard credential rotation with straightforward brute-force methodology.
show less
Brute force SSH attack using Go SSH client. Attacker attempted three weak credentials: root/changeme ...
show moreBrute force SSH attack using Go SSH client. Attacker attempted three weak credentials: root/changeme, root/default, root/letmein across three sessions. No successful command execution observed; all commands failed due to authentication issues. Attack focused on reconnaissance: CPU core enumeration via nproc with fallback methods (busybox, /proc/cpuinfo grep), system information gathering via uname (kernel, hostname, architecture), and PATH manipulation. Commands show sophisticated fallback logic with multiple binary paths and error suppression, indicating automated reconnaissance tooling rather than manual access. No malware downloads, persistence mechanisms, or lateral movement detected. Typical fingerprinting for botnet recruitment or vulnerability assessment. Go SSH client (likely paramiko or similar library) suggests automated scanning framework.
show less
Six SSH sessions using Go SSH client. Attacker attempted six password variants for root: Admin2026!, ...
show moreSix SSH sessions using Go SSH client. Attacker attempted six password variants for root: Admin2026!, P4ssw0rd, P4ssword, P@ssw0rd, P@ssw0rd2026, P@ssword. All follow common pattern variations with numbers/special chars. Primary activity: system profiling. Executed CPU enumeration via nproc with fallback methods (binary, busybox, /proc/cpuinfo grep), each cmd prefixed with password echo piped to sudo -S, indicating privilege escalation probing and resource inventory. PATH manipulation cmd executed setting standard paths. Initiated uname enumeration querying kernel name, version, hostname, architecture via multiple paths (direct, /bin/, /usr/bin/). No malware dl observed. No persistence deployed (cron, SSH keys, services). No lateral movement or port forwarding. No shell spawning or interactive access. Activity: automated reconnaissance with weak cred guessing, typical mass SSH scanning. System fingerprinting suggests botnet recruitment or vuln assessment staging.
show less
established 3 sessions using weak credentials (345gs5662d34/345gs5662d34, college/3245gs5662d34, col ...
show moreestablished 3 sessions using weak credentials (345gs5662d34/345gs5662d34, college/3245gs5662d34, college/college) via libssh 0.9.6. Primary objective was SSH key persistence. First command removed existing .ssh directory, recreated it, and injected a public RSA key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) into authorized_keys for future passwordless access. Second command attempted to set immutable flags on .ssh directory using chattr and lockr utilities, preventing removal or modification of injected keys by system administrators or competing threat actors. Attack pattern indicates automated credential stuffing followed by SSH backdoor installation. Persistence mechanism designed for resilience against standard remediation attempts. No data exfiltration, lateral movement, or additional malware deployment observed in captured session traffic.
show less
Brute-force attack with weak creds (oracle/qwerty123) via Go/Paramiko SSH clients. Attack chain: mal ...
show moreBrute-force attack with weak creds (oracle/qwerty123) via Go/Paramiko SSH clients. Attack chain: malware binary '.b0s' dl from 130.12.182.19 via curl/wget with retry logic, chmod +x exec, sudo privilege escalation attempt with embedded password. Commands show multiple evasion methods. Malware staged in /dev/shm to avoid disk persistence. uname recon post-exploitation. File uploaded to /home/honeypot/.b0s. Pattern matches known botnet infrastructure. Source IP shows credential stuffing capability and valid username knowledge. Sophisticated staging with multiple exec paths and cleanup attempts (rm -rf) indicates professional malware distribution framework. 130.12.182.19 likely C2/payload distribution node. Recommend: block both IPs, monitor oracle account compromise, quarantine contacted systems.
show less
Brute-force attack with credential enumeration and system fingerprinting. Attacker systematically te ...
show moreBrute-force attack with credential enumeration and system fingerprinting. Attacker systematically tested seven variations of sequential numeric passwords (1234 through 1234567890) paired with root username across multiple sessions using Go-based SSH client. Primary reconnaissance objective: CPU core enumeration via nproc command with multiple fallback methods (direct binary, busybox, /proc/cpuinfo parsing) to determine host capacity—likely for botnet recruitment or workload assessment. Secondary commands probed system identification through uname execution with redundant paths. PATH environment variable manipulation attempted to control command resolution. Attack pattern consistent with automated botnet scanning infrastructure or credential stuffing from compromised wordlist. No successful authentication achieved on honeypot. No malware downloads, persistence mechanisms, or lateral movement observed. Sequential password testing suggests non-targeted mass scanning rather than focused compromise attempt.
show less
Automated credential brute-force attack using Go-based SSH client. Attacker cycled through four weak ...
show moreAutomated credential brute-force attack using Go-based SSH client. Attacker cycled through four weak root passwords (!root, 111111, 123123, 123321) across five sessions over 11 minutes. All commands executed with sudo privileges using piped credentials. Primary reconnaissance activity focused on CPU core enumeration via nproc and /proc/cpuinfo, with fallback to busybox. Secondary command chain initiated system fingerprinting via uname to collect kernel version, hostname, and architecture details. Command structure shows automated reconnaissance toolkit designed for rapid resource assessment and OS profiling. No file downloads, persistence mechanisms, lateral movement, or malware deployment observed. Attack pattern consistent with initial reconnaissance phase of botnet recruitment or vulnerability assessment workflow. All commands executed successfully returned system information. No privilege escalation attempts detected beyond sudo invocation with supplied credentials.
show less
Attack chain: Attacker attempted credential compromise using three credential pairs (345gs5662d34/34 ...
show moreAttack chain: Attacker attempted credential compromise using three credential pairs (345gs5662d34/345gs5662d34, root/3245gs5662d34, root/adminasd) via libssh 0.9.6 client. SSH key injection performed: removed existing .ssh directory, recreated it, and injected RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) for persistence. Follow-up persistence attempt using chattr to remove immutable flags from .ssh directory, followed by lockr command (non-standard utility, likely custom lock mechanism). Attack duration 13 seconds across 3 sessions. This activity indicates reconnaissance and persistence establishment targeting SSH access compromise. Injected key enables passwordless access; flag manipulation and custom locking suggest defense evasion or preparation for privilege escalation.
show less
Attacked with libssh 0.9.6 client using credential spray: 345gs5662d34/345gs5662d34, root/3245gs5662 ...
show moreAttacked with libssh 0.9.6 client using credential spray: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/qwerty-12. Successful authentication enabled two-stage persistence installation. First command removed existing .ssh directory and injected attacker-controlled RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) into authorized_keys for persistent SSH access. Second command attempted to modify file attributes on .ssh directory using chattr -ia to prevent deletion, then executed lockr command (likely typo for chattr -ia or reference to attribute locking tool) to establish immutable file permissions. Attack demonstrates standard SSH key injection pattern combined with anti-forensics techniques to lock down persistence mechanism against removal. No malware downloads or lateral movement observed during activity window.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.