Session
crimson-creaky-porcupine
Source
86.104.23.207
Protocol
ssh/shell
User
ubuntu
Auth attempts
3
Commands
32
Transcript
10.6 K
Client
SSH-2.0-OpenSSH_9.7p1 Debian-5
Credentials attempted
| username | password | method | tier | result |
|---|---|---|---|---|
| ubuntu | — | publickey | — | rejected |
| ubuntu | — | publickey | — | rejected |
| ubuntu | P@ssw0rd.12 | password | other | accepted |
Transcript
17:46:49 $ top top - 17:46:49 up 5 days, 14:36, 0 user, load average: 0.14, 0.1, 0.09 Tasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie %Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 15888 total, 7785 free, 8102 used MiB Swap: 4095 total, 4095 free, 0 used PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node ^C 17:46:57 $ unset HISTFILE ; unset HISTSIZE 17:46:59 $ sudo -i 17:47:01 $ unset HISTFILE ; unset HISTSIZE 17:47:05 $ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin systemd-resolve:x:997:997:systemd Resolver:/:/usr/sbin/nologin messagebus:x:100:102::/nonexistent:/usr/sbin/nologin sshd:x:101:65534::/run/sshd:/usr/sbin/nologin postgres:x:102:105:PostgreSQL administrator,,,:/var/lib/postgresql:/usr/sbin/nologin node:x:1000:1000:stable service:/opt/stable:/bin/bash brumby:x:1001:1001:Brumby Stable Operator:/home/brumby:/bin/bash (3739ms) 17:47:19 $ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether f2:3c:91:65:96:d6 brd ff:ff:ff:ff:ff:ff inet 203.0.113.1/24 brd 45.33.68.255 scope global eth0 valid_lft forever preferred_lft forever inet6 2001:db8::1/64 scope global dynamic mngtmpaddr noprefixroute valid_lft 5325sec preferred_lft 1725sec 17:48:10 $ uname -a && uptime Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux 03:48:53 up 5 days, 14:38, 1 user, load average: 0.08, 0.11, 0.09 (1239ms) 17:48:35 $ ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 Aug20 ? 00:00:12 /sbin/init root 612 1 0 Aug20 ? 00:00:01 /usr/bin/systemd-journald root 655 1 0 Aug20 ? 00:00:00 /usr/lib/systemd/systemd-udevd systemd+ 702 1 0 Aug20 ? 00:00:00 /usr/lib/systemd/systemd-resolved root 731 1 0 Aug20 ? 00:00:00 /usr/lib/systemd/systemd-logind postgres 844 1 0 Aug20 ? 00:00:05 /usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/16/main -c config_file=/etc/postgresql/16/main/postgresql.conf postgres 863 844 0 Aug20 ? 00:00:00 postgres: 16/main: checkpointer postgres 864 844 0 Aug20 ? 00:00:00 postgres: 16/main: background writer postgres 865 844 0 Aug20 ? 00:00:00 postgres: 16/main: walwriter postgres 866 844 0 Aug20 ? 00:00:00 postgres: 16/main: autovacuum launcher postgres 867 844 0 Aug20 ? 00:00:00 postgres: 16/main: logical replication launcher node 920 1 0 Aug20 ? 00:01:47 node /opt/stable/src/server.js www-data 945 920 0 Aug20 ? 00:00:00 nginx: worker process www-data 946 920 0 Aug20 ? 00:00:00 nginx: worker process www-data 947 920 0 Aug20 ? 00:00:00 nginx: worker process root 918 1 0 Aug20 ? 00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; root 1050 1 0 Aug20 ? 00:00:00 /usr/sbin/sshd -D root 1122 1 0 Aug20 ? 00:00:00 /usr/bin/cron -f root 1138 1 0 Aug20 ? 00:00:00 /usr/sbin/rsyslogd -n root 1199 1122 0 03:40 ? 00:00:00 /bin/bash /opt/stable/bin/muck-out.sh root 1204 1199 0 03:40 ? 00:00:00 /usr/bin/gzip -f /var/backups/hayloft/stable_prod.sql root 1210 1122 (6066ms) 17:49:11 $ ls -la /var/backups/hayloft/ total 4 drwxr-xr-x 2 root root 64 Aug 20 03:10 . drwxr-xr-x 3 root root 22 Aug 20 03:10 .. -rw-r--r-- 1 root root 928 Aug 25 03:40 paddock.sql.gz -rw-r--r-- 1 root root 0 Aug 25 03:40 stable_prod.sql.gz (4895ms) 17:49:16 $ 17:49:46 $ zcat /var/backups/hayloft/paddock.sql.gz -- PostgreSQL database dump -- -- Dumped from database version 16.3 (Ubuntu 16.3-1.pgdg26.04+1) -- Dumped by pg_dump version 16.3 (Ubuntu 16.3-1.pgdg26.04+1) SET statement_timeout = 0; SET lock_timeout = 0; SET idle_in_transaction_session_timeout = 0; SET client_encoding = 'UTF8'; SET standard_conforming_strings = on; SET search_path = paddock, public; SET check_function_bodies = false; SET xmloption = content; SET client_min_messages = warning; CREATE SCHEMA paddock; CREATE TABLE paddock.boarding ( id integer NOT NULL, horse_name text NOT NULL, owner_name text NOT NULL, stall text NOT NULL, arrival_date date, departure_date date, active boolean DEFAULT true NOT NULL ); CREATE TABLE paddock.bloodlines ( id integer NOT NULL, horse_name text NOT NULL, sire text, dam text, breed text, notes text ); CREATE TABLE paddock.feed ( id integer NOT NULL, horse_name text NOT NULL, ration text NOT NULL, fed_at timestamp with time zone DEFAULT now() NOT NULL, fed_by text ); COPY paddock.boarding (id, horse_name, owner_name, stall, arrival_date, departure_date, active) FROM stdin; 1 Bucephalus Evelyn Hart 12A 2026-08-12 \N t 2 Marengo Thomas Vale 7B 2026-08-13 \N t 3 Palomino Sadie Reed 4C 2026-08-14 \N t 4 Appaloosa Noah Green 19D 2026-08-15 \N t 5 Clydesdale Marta Shaw 2F 2026-08-16 \N t \. COPY paddock.bloodlines (id, horse_name, sire, dam, breed, notes) FROM stdin; 1 Bucephalus Solar Drift Queen's Road Thoroughbred Hesitates at the wash rack. 2 Marengo Northwind Lady Bridle Path Morgan Requires steady handling. 3 Palomino Golden Hour Midnight Pearl Palomino Shod last on 2026-08-18. 4 Appaloosa Red River Spotted Crown Appaloosa Prone to drifting right on turns. 5 Clydesdale Iron Bell Stone Meadow Clydesdale Needs larger water bucket. \. COPY paddock.feed (id, horse_name, ration, fed_at, fed_by) FROM stdin; 1 Bucephalus 2 scoops oats, hay net_manager \N 2 Marengo 1.5 scoops pellets, hay net_manager \N 3 Palomino 2 scoops oats, beet pulp net_manager \N 4 Appaloosa 1 scoop pellets, hay net_manager \N 5 Clydesdale 3 scoops oats, hay net_manager \N \. SELECT pg_catalog.setval('paddock.boarding_id_seq', 5, true); SELECT pg_catalog.setval('paddock (5514ms) 17:49:51 $ 17:50:52 $ top top - 17:50:52 up 5 days, 14:40, 0 user, load average: 0.14, 0.1, 0.09 Tasks: 115 total, 1 running, 114 sleeping, 0 stopped, 0 zombie %Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 15888 total, 7785 free, 8102 used MiB Swap: 4095 total, 4095 free, 0 used PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node ^C 17:50:55 $ wget wget: missing URL (733ms) 17:51:18 $ ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 Aug20 ? 00:00:12 /sbin/init root 612 1 0 Aug20 ? 00:00:01 /usr/bin/systemd-journald root 655 1 0 Aug20 ? 00:00:00 /usr/lib/systemd/systemd-udevd systemd+ 702 1 0 Aug20 ? 00:00:00 /usr/lib/systemd/systemd-resolved root 731 1 0 Aug20 ? 00:00:00 /usr/lib/systemd/systemd-logind postgres 844 1 0 Aug20 ? 00:00:05 /usr/lib/postgresql/16/bin/postgres -D /var/lib/postgresql/16/main -c config_file=/etc/postgresql/16/main/postgresql.conf postgres 863 844 0 Aug20 ? 00:00:00 postgres: 16/main: checkpointer postgres 864 844 0 Aug20 ? 00:00:00 postgres: 16/main: background writer postgres 865 844 0 Aug20 ? 00:00:00 postgres: 16/main: walwriter postgres 866 844 0 Aug20 ? 00:00:00 postgres: 16/main: autovacuum launcher postgres 867 844 0 Aug20 ? 00:00:00 postgres: 16/main: logical replication launcher node 920 1 0 Aug20 ? 00:01:47 node /opt/stable/src/server.js www-data 945 920 0 Aug20 ? 00:00:00 nginx: worker process www-data 946 920 0 Aug20 ? 00:00:00 nginx: worker process www-data 947 920 0 Aug20 ? 00:00:00 nginx: worker process root 918 1 0 Aug20 ? 00:00:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; root 1050 1 0 Aug20 ? 00:00:00 /usr/sbin/sshd -D root 1122 1 0 Aug20 ? 00:00:00 /usr/bin/cron -f root 1138 1 0 Aug20 ? 00:00:00 /usr/sbin/rsyslogd -n root 1199 1122 0 03:40 ? 00:00:00 /bin/bash /opt/stable/bin/muck-out.sh root 1204 1199 0 03:40 ? 00:00:00 /usr/bin/gzip -f /var/backups/hayloft/stable_prod.sql root 1210 1122 (3386ms) 17:51:26 $ netstat -anp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 698/sshd: /usr/sbin tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 731/nginx: master p tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 731/nginx: master p tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 812/postgres tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN 944/node tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 612/systemd-resolve 17:51:31 $ poweroff System has been shut down. (585ms) 17:51:34 $ 17:51:35 $ 17:51:35 $ 17:51:35 $ 17:51:35 $ 17:51:36 $ 17:51:37 $ 17:51:38 $ 17:51:38 $ 17:51:38 $ 17:51:39 $ 17:51:39 $ 17:51:39 $ 17:51:44 $ shutdown -h now 17:51:46 $