conducted reconnaissance and file write testing across two sessions using Go-based SSH client. Crede ...
show moreconducted reconnaissance and file write testing across two sessions using Go-based SSH client. Credentials attempted: root/pass1234 and root/pass123456. Activity spans system enumeration including /etc/passwd, /etc/shadow read attempts, CPU model, kernel version, environment variables, and hostname discovery. File write capability tested via /tmp with timestamped test files (test_1788541959, test_1788542496). Command history and user ID enumeration performed. No malware payloads, persistence mechanisms, or lateral movement observed. Activity consistent with automated scanning and initial access testing. No downloads or exfiltration detected. Attack chain limited to credential brute force followed by post-authentication reconnaissance to assess system properties and write permissions.
show less
SSH brute force: root/pass0123, root/pass1 via Go SSH client. 35 unique recon cmds, 70 total executi ...
show moreSSH brute force: root/pass0123, root/pass1 via Go SSH client. 35 unique recon cmds, 70 total executions over 9min across 2 sessions. Enumeration: /etc/passwd, /etc/shadow, /proc/cpuinfo, /proc/version, kernel details, CPU info. Temp files created in /tmp (test_1788540341, test_1788540878) to test write perms. Env var enumeration, cmd history inspection, id/groups checks indicate privilege assessment. Additional probes: ifconfig, ip addr, ps aux, uptime, disk usage, pkg manager checks. No persistence mechanisms, malware dl, privilege escalation exploits, lateral movement, shell modifications, cron jobs detected. Opportunistic scanning with weak credentials, standard recon only.
show less
SSH session root/pass!@# weak cred via Go client. 35 cmd exec rapid recon: /etc/passwd, /etc/shadow, ...
show moreSSH session root/pass!@# weak cred via Go client. 35 cmd exec rapid recon: /etc/passwd, /etc/shadow, CPU specs, kernel version, ip addr show, process lists, env vars, /tmp access test. Sequential automated script, no pauses. 47sec duration. No malware dl, persistence, lateral movement, or priv esc. Pattern: initial access scanning to profile system before secondary payload staging. Recon focused system config, hardware, processes to assess botnet/cryptomining suitability. No shell history manipulation, exfiltration, or tunneling.
show less
Brute force SSH attack using weak credentials against root account. Attacker used SSH-2.0-Go client ...
show moreBrute force SSH attack using weak credentials against root account. Attacker used SSH-2.0-Go client attempting two passwords (000000, 111111). Commands executed focused on system enumeration: CPU core count detection via nproc, /proc/cpuinfo, or busybox fallbacks; PATH variable manipulation; uname invocation for OS/kernel/hostname/architecture fingerprinting. Attack pattern indicates automated reconnaissance activity, likely scanning for vulnerable systems suitable for botnet recruitment or lateral movement. No persistence mechanisms, malware downloads, or successful privilege escalation observed. Commands executed with sudo prefixed by password pipes, suggesting attacker expected passwordless sudo or misconfigured sudoers. Attack duration approximately 3 minutes with 2 sessions total.
show less
SSH brute force using weak creds root/pa55, root/pa55w0rd. Client: SSH-2.0-Go (automated tooling). 3 ...
show moreSSH brute force using weak creds root/pa55, root/pa55w0rd. Client: SSH-2.0-Go (automated tooling). 35 unique commands across 70 invocations in 9.5min window. Reconnaissance phase: OS fingerprinting via /etc/passwd, /etc/shadow access attempts, /proc/cpuinfo, /proc/version queries. Env vars and cmd history enumeration. Created test files /tmp/test_1788537704, /tmp/test_1788538224 to verify write permissions and exec capability. Standard privilege enumeration: hostname, id, whoami. Command repetition (70 vs 35 unique) indicates automated reconnaissance suite execution. No persistence mechanisms, file downloads, lateral movement, malware payloads, backdoors, or additional services deployed. Attack confined to info gathering post-credential compromise. Consistent with automated reconnaissance, botnet scanning, or pre-exploitation intelligence gathering. Weak creds and Go SSH client suggest commodity scanning infrastructure, not targeted operation.
show less
Credential attack with Go-based SSH client attempting both "pa$$word" and "pa$$word1" variants again ...
show moreCredential attack with Go-based SSH client attempting both "pa$$word" and "pa$$word1" variants against root. Executed 35 unique reconnaissance commands focused on system enumeration: OS version, CPU model, passwd/shadow file extraction, user context, hostname, environment variables, and process listings. Created test files in /tmp directory (test_1788536647, test_1788537166) suggesting write-access verification. No malware downloads, persistence mechanisms, or lateral movement observed. Attack pattern consistent with automated credential brute-force scanning followed by post-compromise information gathering on vulnerable targets. Go-based SSH client indicates potential botnet or automated attack framework rather than manual access attempt.
show less
Reconnaissance-focused SSH brute force attack using weak credentials root/pa$$1234. Attacker employe ...
show moreReconnaissance-focused SSH brute force attack using weak credentials root/pa$$1234. Attacker employed Go-based SSH client (SSH-2.0-Go) to execute comprehensive system enumeration. Attack chain involved: credential validation, followed by systematic information gathering across system configuration, hardware specifications, network interfaces, user accounts, process listings, and environment variables. Commands targeted /etc/passwd, /etc/shadow, /proc/cpuinfo, /proc/version, and network configuration via ip addr. Attacker tested file write permissions via /tmp/test_1788535060 creation. No malware downloads, persistence mechanisms, lateral movement attempts, or port forwarding observed. Attack lasted approximately 47 seconds with 35 total command executions across 33 unique commands. This represents typical credential-stuffing reconnaissance phase, likely automated scanning to profile target system prior to secondary exploitation or botnet recruitment.
show less
Attempted 3 credential pairs across 3 sessions, gained root access with root/3245gs5662d34. Used lib ...
show moreAttempted 3 credential pairs across 3 sessions, gained root access with root/3245gs5662d34. Used libssh 0.9.6 client. Activity: SSH key injection and file attribute manipulation for persistence. Cmd chain: navigated home, removed .ssh dir, recreated it, injected RSA pubkey (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx) into authorized_keys for passwordless access. Second cmd: chattr -ia .ssh to remove immutable/append-only attrs, then lockr cmd to set immutable attrs. Two-phase attribute manipulation suggests attempt to prevent key detection/removal. Classic SSH persistence: cred compromise leading to authorized_keys poisoning + filesystem hardening to evade cleanup. No lateral movement, port forwarding, or secondary payloads observed. Duration ~15 sec across 3 sessions indicates scripted automated recon and persistence setup.
show less
Credential attack against three accounts using credentials 345gs5662d34/345gs5662d34, root/3245gs566 ...
show moreCredential attack against three accounts using credentials 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/Qf123456!. Attacker executed SSH key injection payload modifying .ssh directory permissions and injecting RSA public key AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx for persistence via authorized_keys. Follow-up commands attempted to lock down .ssh directory using chattr and attempted 'lockr' tool execution (likely typo or non-existent command). Attack chain indicates SSH key-based persistence establishment. Three sessions within 5-second window suggests scripted brute force with libssh library. No file artifacts recovered. Attack represents classic SSH persistence mechanism targeting privileged account access.
show less
Attempted SSH brute force using Go-based client with weak password variants (p@svord, p@svvord targe ...
show moreAttempted SSH brute force using Go-based client with weak password variants (p@svord, p@svvord targeting root account). Attack established 2 successful sessions over 9 minutes. Reconnaissance phase executed 35 unique commands focused on system enumeration: OS details via /proc/version and /proc/cpuinfo, user enumeration through /etc/passwd and /etc/shadow access attempts, privilege verification using id command, hostname resolution, environment variable inspection, and shell history review. Write-access testing performed via temporary file creation in /tmp directory with timestamped filenames (test_1788531273, test_1788531790). Full command execution history indicates systematic host profiling. No malware downloads, lateral movement, or persistence mechanisms detected within observation window. Attack pattern suggests reconnaissance-phase botnet activity or credential-stuffing campaign using Go SSH implementation, likely automated scanning infrastructure. Host remains compromised during final session state.
show less
Brute-force SSH attack using weak credentials (master/wasd) via Go SSH client. Attacker attempted mu ...
show moreBrute-force SSH attack using weak credentials (master/wasd) via Go SSH client. Attacker attempted multi-stage malware deployment targeting /home/<user>/.16, with fallback execution chains using sudo privilege escalation with hardcoded passwords. Primary payload delivery from hxxp://5[.]189[.]149[.]171/f/brute/m/ using curl/wget with retry logic and architecture-specific variants (.16_$(uname -m)). Attack sequence: reconnaissance via uname enumeration, payload download to /dev/shm, chmod +x execution, and cleanup via rm -rf. Two identical infection attempts across sessions with password spray variations (root and wasd). Download infrastructure hosted on 5.189.149.171 indicates coordinated malware distribution. No artifacts recovered for hash analysis. Attack pattern consistent with automated botnet recruitment targeting Linux systems with inadequate credential hygiene.
show less
conducted system reconnaissance across 5 SSH sessions using weak/default credentials (jan/jan, ubunt ...
show moreconducted system reconnaissance across 5 SSH sessions using weak/default credentials (jan/jan, ubuntu/ollama, ubuntu/sglang, ubuntu/ubuntu, vllm/vllm). Go-based SSH client initiating brute force against machine learning framework usernames (ollama, sglang, vllm indicate targeting ML infrastructure). All 7 commands executed focused on GPU enumeration and system profiling: uname for OS details, lspci queries for 3D controller/VGA GPU detection, nvidia-smi for NVIDIA GPU product names and count, uptime for system runtime. Pattern indicates reconnaissance-only activity targeting ML/AI compute environments to identify GPU resources for potential cryptocurrency mining, training job hijacking, or botnet recruitment. No persistence mechanisms, lateral movement, or payload delivery observed during 11-minute window. Attack consistent with initial scanning phase of GPU-targeting campaigns that frequently precede cryptomining or resource theft operations.
show less
SSH brute-force targeting weak creds (sol/sol, solana/solana) via Go-based SSH client. Recon cmds ex ...
show moreSSH brute-force targeting weak creds (sol/sol, solana/solana) via Go-based SSH client. Recon cmds executed: uname, lspci (3D/VGA controllers), nproc, nvidia-smi (Product Name extraction, count validation), uptime. No malware dl, cmd injection, persistence, or lateral movement. Pattern indicates botnet scanner (Mirai variant or IoT/GPU-targeting infrastructure) profiling for cryptocurrency mining pool inclusion or computational resource theft. Heavy GPU enumeration suggests Monero/GPU-mineable coin targeting. No successful shell access on honeypot; all auth failed. ~8 min duration across 3 sessions with automated credential rotation retry logic.
show less
Cred brute-force attack using 3 username/password combos targeting default accts. Attacker used libs ...
show moreCred brute-force attack using 3 username/password combos targeting default accts. Attacker used libssh v0.9.6 for SSH connection attempts w/ key injection & persistence. First cmd chain: removed existing SSH dir, recreated it, injected long RSA public key for backdoor access. Second cmd: modified file attrs via chattr (immutable/append-only flags) to protect .ssh dir from deletion, then lockr cmd to harden injected key dir against removal. Attack sequence shows systematic compromise attempt establishing persistent SSH access while preventing detection/remediation via attr manipulation. Rapid sequential login attempts & cmd execution within 7 secs consistent w/ automated exploitation. No successful cmd execution confirmation or secondary payload delivery observed in session logs.
show less
performed host reconnaissance and persistence installation across three sessions using libssh client ...
show moreperformed host reconnaissance and persistence installation across three sessions using libssh client. Initial commands gathered CPU model/count, disk space, and memory configuration. Persistence mechanism involved SSH key injection: created .ssh directory and attempted to add RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...). Executed chattr and lockr commands to modify file attributes, likely attempting to protect .ssh directory from deletion. Changed root password hash to MmGwjEvTzobw via chpasswd. Verified system binaries with ls -lh. Credential root/Qwer2025 used for all access attempts. Attack consistent with botnet reconnaissance and persistence establishment on compromised host. System fingerprinting suggests targeting of specific infrastructure for lateral movement or service deployment. No downloaded payloads observed in captured session data.
show less
Conducted brute force attacks using weak credentials (root/p@ss123456, root/p@ssw0rd) via SSH-2.0-Go ...
show moreConducted brute force attacks using weak credentials (root/p@ss123456, root/p@ssw0rd) via SSH-2.0-Go client. Established two separate sessions over nine-minute window. Post-authentication reconnaissance focused on system enumeration: extracted /etc/passwd and /etc/shadow headers, queried CPU model from /proc/cpuinfo, retrieved kernel version via /proc/version. Tested write permissions with timestamped test files in /tmp (test_1788526667, test_1788527174). Harvested environment variables and command history. Executed hostname and id commands for identity confirmation. Full command set included 35 unique commands executed 70 times across sessions, indicating systematic host profiling. No malware downloads, persistence mechanisms, or lateral movement observed during capture window. Attack pattern consistent with automated reconnaissance scanning targeting Linux systems with default or commonly-used credentials.
show less
Automated SSH recon attack. Four sequential root login attempts with incrementing numeric passwords ...
show moreAutomated SSH recon attack. Four sequential root login attempts with incrementing numeric passwords (1, 12, 123, 1234) across separate sessions. Primary payload: CPU core enumeration via nproc binary, /proc/cpuinfo parsing, or busybox nproc. Each attempt pipes password to sudo -S for privilege escalation. Secondary commands: system fingerprinting including PATH manipulation, uname invocation for kernel version/hostname/architecture across multiple binary paths. Shows defensive programming with error suppression and redundant tool chains targeting diverse Linux environments. No file dls, persistence, or lateral movement observed. Attack pattern consistent with botnet recon phase or automated vuln scanning—profiling hosts for resource capacity and OS details prior to payload delivery.
show less
exploited weak credentials across multiple accounts using libssh 0.9.6. Credentials attempted: 345gs ...
show moreexploited weak credentials across multiple accounts using libssh 0.9.6. Credentials attempted: 345gs5662d34/345gs5662d34, root/3245gs5662d34, root/hm123456. Attack executed SSH key injection for persistence: removed existing .ssh directory, recreated it, and installed malicious RSA public key (AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...). Second command attempted to lock down .ssh directory using chattr -ia and lockr -ia flags, preventing attribute modification and providing additional persistence hardening. Attack chain indicates SSH backdoor installation for remote access maintenance. Three sessions within 7-second window suggests automated credential spraying and exploitation. Legitimate system administration would not execute rapid wholesale .ssh directory replacement followed by attribute locking across multiple accounts.
show less
Brute-force SSH attack via Go-based client. Weak creds attempted: root/p@s5word, root/p@s5word123 ac ...
show moreBrute-force SSH attack via Go-based client. Weak creds attempted: root/p@s5word, root/p@s5word123 across 2 sessions. 35 reconnaissance cmds executed targeting system config, hardware, privileges, processes. Enumerated /etc/passwd, /etc/shadow, CPU, kernel, env vars, cmd history, hostname. Test files written to /tmp (timestamps 1788523130, 1788523636). Executed ps, netstat, whoami, uname variants mapping system state and network connectivity. Pattern matches automated post-compromise assessment toolkit for privilege escalation planning. Go SSH client indicates botnet/automated scanning framework vs manual exploitation. No confirmed successful cmd execution beyond recon in available logs. Creds commonly deployed across IoT botnets and mass scanner networks. Recommend immediate blocking and monitor for follow-up attacks using alternate creds or exploits targeting identified system configuration.
show less
Brute-ForceSSH
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.