Apr 22 15:18:15 sunet sshd[21980]: Accepted publickey for moss from 54.39.148.234 port 42318 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 03:59:05 sunet sshd[14050]: Accepted publickey for moss from 98.114.188.100 port 53532 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 04:00:00 sunet sshd[14085]: Accepted publickey for moss from 98.114.188.100 port 53562 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 04:01:35 sunet sshd[14125]: Accepted publickey for moss from 70.32.0.71 port 53617 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 04:02:04 sunet sshd[14157]: Accepted publickey for moss from 70.32.0.71 port 53630 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 05:15:56 sunet sshd[24823]: Accepted publickey for moss from 70.32.0.71 port 56310 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 05:22:01 sunet sshd[25853]: Accepted publickey for moss from 70.32.0.71 port 56568 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 05:40:16 sunet sshd[29374]: Accepted publickey for moss from 70.32.0.71 port 57351 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 05:59:17 sunet sshd[32195]: Accepted publickey for moss from 70.32.0.71 port 58075 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 24 06:42:46 sunet sshd[2568]: Accepted publickey for moss from 70.32.0.71 port 59484 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 27 09:05:59 sunet sshd[9221]: Accepted publickey for moss from 70.32.0.111 port 53430 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 27 09:08:33 sunet sshd[9285]: Accepted publickey for moss from 70.32.0.111 port 53475 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 27 09:18:51 sunet sshd[9383]: Accepted publickey for moss from 209.95.51.11 port 38156 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA
Apr 27 22:53:02 sunet sshd[17484]: Accepted publickey for moss from 70.32.0.111 port 52318 ssh2: RSA SHA256:aXnKqpEf1WTlG0Ls8RhT55Sk8IfewzwsHpQuPV1nRIA


root@sunet:/var/log# cat /home/moss/.bash_history
echo > /var/log/wtmp
echo > /var/log/btmp
echo > /var/log/lastlog


echo > /var/log/wtmp
echo > /var/log/btmp
echo > /var/log/lastlog


root@sunet:/var/log# cat /root/.bash_history
echo > /var/log/wtmp
echo > /var/log/btmp
echo > /var/log/lastlog
w
ls
cd .ssh
ls
./syn 79.76.217.246 8081
./syn 79.76.217.246 8081
./syn 79.76.217.246 9898
./syn 79.76.217.246 50501
w
./syn 51.68.70.119 9019
cd
passwd
exit
root@sunet:/var/log#

root@sunet:/var/log# ls -la /root/.ssh
total 32
drwx------  2 root root  4096 Apr  6 23:01 .
drwx------ 13 root root  4096 May 16 02:25 ..
-rw-r--r--  1 root root   222 Apr  6 23:01 known_hosts
-rwxr-x---  1 root root 18096 Apr  4 15:15 syn
root@sunet:/var/log#

root@sunet:~/.ssh# ./syn
syn.c - Fastest syn flooder in the west!
Usage: ./syn <dstaddr> <dstport>
    dstaddr  - the target we are trying to attack.
    dstport  - the port of the target, 0 = random.
root@sunet:~/.ssh#