I watched you try and hack me, you failed (Honeypot Thread)

Forums › Linux › I watched you try and hack me, you failed (Honeypot Thread)

michaelmurfy

Mr Snotty
8874 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 98959 9-Mar-2012 18:35

I noticed on my production Linode that there were a tonne of blocked ssh hosts in /etc/hosts.deny – I was interested to know what would happen if one of these “hackers” or “script kiddies” got into my server on root level.

So, I went and bought a 2nd Linode and set up Kippo (http://code.google.com/p/kippo/) – Kippo creates a SSH server under a restricted user, logs everything that goes on and is quite entertaining to watch them attempt to “hack” - I just did some iptables trickery to the 2nd server so I could find out what is going on, most of them are bots with a few of them being real people (looking at the logs though it seems the bots tell the user of a open host, of which the user manually connects and tries to infect with malware or IRC servers to control botnets)

So here, I present “I watched you hack, you failed”

#1 – iptables not found - http://honeypot.murfy.co.nz:8022/playlog/?l=20120218-125755-3907

#2 – Do you even know Linux? - http://honeypot.murfy.co.nz:8022/playlog/?l=20120222-035727-3285

#3 – Segmentation Fault - http://honeypot.murfy.co.nz:8022/playlog/?l=20120302-043815-1578

#4 – Yeah, PHP really doesn’t exist - http://honeypot.murfy.co.nz:8022/playlog/?l=20120308-003910-8337

If anyone else has any captured from Kippo post them here! Else, more to come.

codyc1515

1598 posts

Uber Geek
Inactive user

# 592886 9-Mar-2012 19:20

Good on you for doing this, its quite intriguing to actually see the methodology used. I might set up a few honey pots myself.

michaelmurfy

Mr Snotty
8874 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 592969 9-Mar-2012 21:02

codyc1515: Good on you for doing this, its quite intriguing to actually see the methodology used. I might set up a few honey pots myself.

What's cool is you actually get the files they download, for future inspection.

codyc1515

1598 posts

Uber Geek
Inactive user

# 592971 9-Mar-2012 21:03

michaelmurfy:
codyc1515: Good on you for doing this, its quite intriguing to actually see the methodology used. I might set up a few honey pots myself.

What's cool is you actually get the files they download, for future inspection.

Yeah, I took a look. Some of that stuff is pretty full on and still up. That means they are still out there hacking people.

shylo

13 posts

Geek

# 601047 27-Mar-2012 22:49

aaaaawesome. that's just rad.
can you set up a .profile for them so on login, it throws up an $(ssh -l root ${SSH_CLIENT}) ?
that's be hilarious to watch

michaelmurfy

Mr Snotty
8874 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 601571 28-Mar-2012 21:25

shylo: aaaaawesome. that's just rad.
can you set up a .profile for them so on login, it throws up an $(ssh -l root ${SSH_CLIENT}) ?
that's be hilarious to watch

Yeah could do quite easily :)

If a user logs out, they get a root@localhost prompt, that's sometimes amusing.

michaelmurfy

Mr Snotty
8874 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 609782 16-Apr-2012 03:31

More (for those who are interested)

http://honeypot.murfy.co.nz:8022/playlog/?l=20120410-022654-1748  - This guy thought he was on his local computer at the end, script-kiddie was from the US.

This guy comes back Here to give it another crack, he used his "set" root password he set up the last time, the advantage of using Kippo is you can get it to add password changes to the allowed password list.

http://honeypot.murfy.co.nz:8022/playlog/?l=20120410-021630-1948  - Goes to show that there are some real n00bs out there, this person was from China, as soon as a curveball is thrown at them they get confused.

http://honeypot.murfy.co.nz:8022/playlog/?l=20120413-205812-3678 - Damn, found a glitch I need to fix with Kippo.

http://honeypot.murfy.co.nz:8022/playlog/?l=20120416-022504-5769  - Another guy that seems to have no Linux experience, paste of uname -a?

For some reason, I got quite a few attacks on April the 7th from different IP's in Russia, Here - Another at the same time, same ISP, different IP Here (which seemed to have difficulty with creating a new user) and Here

There are quite a few more - but these are this month (so far) interesting ones.. Enjoy!

shylo

13 posts

Geek

# 610198 16-Apr-2012 19:54

http://honeypot.murfy.co.nz:8022/playlog/?l=20120410-021630-1948 - Goes to show that there are some real n00bs out there, this person was from China, as soon as a curveball is thrown at them they get confused.

bahahahaha Wargames for the win

throw in an "I'm sorry, Dave. I'm afraid I can't do that." for the deathblow

stevenz

2785 posts

Uber Geek

# 610214 16-Apr-2012 20:29

I like the fact they they give up when nano isn't available because they don't know how to use vi.

@KnightNZ

gjm

754 posts

Ultimate Geek

# 610221 16-Apr-2012 21:02

I used NMap to sidedoor into your system32 folder and ran my low orbit ion canon :@

[Amstrad CPC 6128: 128k Memory: 3 inch floppy drive: Colour Screen]

michaelmurfy

Mr Snotty
8874 posts

Uber Geek

Moderator

Trusted

Lifetime subscriber

# 610285 16-Apr-2012 23:46

Vi is actually available, everyone just tries Nano, then Pico then apt-get install nano (which appears to install) then SEGFAULT!

Then, confused they appear to edit the files on their computer, re-upload, download onto Sever of which they get messed around by Kippo.

Amusing at best.