sshoney · ssh honeypot telemetry

Client

Credentials attempted

Transcript

15:35:10 $ sha256sum /etc/passwd
         b3b1f8f58e6f3a6b2a8f6c7f2d7a5d2d6cf5a8a0b4a3f8f0f7a0a9c5d1e2f3a  /etc/passwd  (1070ms)
15:35:45 $ ls
         bin
         src
         package.json
         package-lock.json
         .env
         README.md
         .git  (926ms)
15:35:52 $ cat package.json
         {
           "name": "stable",
           "version": "1.0.0",
           "description": "Stable boarding and horse records API",
           "main": "src/server.js",
           "scripts": {
             "start": "node src/server.js",
             "deploy": "bash bin/canter-deploy.sh",
             "backup": "bash bin/gallop-backup.sh",
             "check": "bash bin/hoofcheck.sh"
           },
           "dependencies": {
             "express": "^4.18.2",
             "pg": "^8.11.3",
             "dotenv": "^16.4.5"
           }
         }  (1452ms)
15:36:19 $ ifconfig
         eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
                 inet 203.0.113.1  netmask 255.255.255.0  broadcast 45.33.68.255
                 inet6 2001:db8::1  prefixlen 64  scopeid 0x0<global>
                 ether f2:3c:91:65:96:d6  txqueuelen 1000  (Ethernet)
                 RX packets 184392  bytes 21847392 (21.8 MB)
                 TX packets 92831  bytes 14203918 (14.2 MB)
         
         lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
                 inet 127.0.0.1  netmask 255.0.0.0
                 inet6 ::1  prefixlen 128  scopeid 0x10<host>
                 loop  txqueuelen 1000  (Local Loopback)
15:36:22 $ ifconfig
         eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
                 inet 203.0.113.1  netmask 255.255.255.0  broadcast 45.33.68.255
                 inet6 2001:db8::1  prefixlen 64  scopeid 0x0<global>
                 ether f2:3c:91:65:96:d6  txqueuelen 1000  (Ethernet)
                 RX packets 184392  bytes 21847392 (21.8 MB)
                 TX packets 92831  bytes 14203918 (14.2 MB)
         
         lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
                 inet 127.0.0.1  netmask 255.0.0.0
                 inet6 ::1  prefixlen 128  scopeid 0x10<host>
                 loop  txqueuelen 1000  (Local Loopback)
15:36:24 $ ufcibfug
         -bash: ufcibfug: command not found  (858ms)
15:36:47 $ sudo rm -rf / --no-preserve-root
         sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
         sudo: a password is required  (1004ms)
15:37:06 $ ssh localhost
         Pseudo-terminal will not be allocated because stdin is not a terminal.
         admin@localhost: Permission denied (publickey,password).  (639ms)
15:37:20 $ apt install reddit
         E: Unable to locate package reddit  (676ms)
15:37:25 $ apt install sentience
         E: Unable to locate package sentience  (691ms)
15:37:30 $ apt install python3
         python3 is already the newest version (3.12.3-0ubuntu2).
         python3 set to manually installed.
         0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.  (1197ms)
15:37:53 $ cd /root/secret/porn
15:37:54 $ ls
         bin
         src
         package.json
         package-lock.json
         .env
         README.md
         .git  (940ms)
15:38:01 Broadcast message from root@localhost (Thu Aug 20 15:38:01 2026):

retard
15:38:20 $ touch AnalScene360p.mp4
15:38:21 $ ls
         AnalScene360p.mp4  (637ms)
15:38:37 $ cat README.md
         cat: README.md: No such file or directory  (641ms)
15:38:40 $ ls
         AnalScene360p.mp4  (756ms)
15:38:41 $ ls -lf
         total 0
         -rw-r--r-- 1 admin admin 0 Aug 20 15:38 AnalScene360p.mp4  (626ms)
15:38:52 Message from syslogd@localhost ...
sshd[31204]: Accepted publickey for root from 10.0.0.14 port 55210 ssh2
15:39:08 $ ls -la
         total 4
         drwxr-xr-x 2 root root  40 Aug 20 15:38 .
         drwxr-xr-x 3 root root  60 Aug 20 15:38 ..
         -rw-r--r-- 1 root root   0 Aug 20 15:38 AnalScene360p.mp4  (1109ms)
15:39:43 $ cat /root/secret/plans/to-dolist.txt
         cat: /root/secret/plans/to-dolist.txt: No such file or directory  (624ms)
15:40:02 $ man man
         No manual entry for man  (1204ms)
15:40:12 $ cowsay FAGGOT
          _______
         < FAGGOT >
          -------
                 \   ^__^
                  \  (oo)\_______
                     (__)\       )\/\
                         ||----w |
                         ||     ||  (2495ms)
15:40:33 $ sudo
         sudo: a password is required  (622ms)
15:40:58 $ su
         Password:   (613ms)
15:41:02 $ passwor
         -bash: passwor: command not found  (548ms)
15:41:06 $ su
         Password:  (629ms)
15:41:07 $ sudo su
15:41:12 $ whoami
         admin
15:41:30 $ sudo -Si < root\n
15:41:41 $ sudo ls
15:41:48 $ cowsay im done now
         -bash: cowsay: command not found
15:41:55 $ cowsay IMDONE!
         -bash: cowsay: command not found
15:41:56 $ cowsay
         -bash: cowsay: command not found
15:41:57 $ cowsay
         -bash: cowsay: command not found
15:42:00 $ cowsay faggot!
         -bash: cowsay: command not found
15:42:07 $ exit
         logout