FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: wangjunhui
{
"id": "5b957905b637",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:32:09.351924Z",
"end_time": "2026-10-19T03:32:11.327183Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "wangjunhui",
"pass": "QWEasd123@"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: anonymo
{
"id": "0528ffecad1d",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:32:04.341448Z",
"end_time": "2026-10-19T03:32:06.468652Z",
"duration": "2.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "anonymo",
"pass": "ben"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: deployuser
{
"id": "2757dd77d2e4",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:59.338578Z",
"end_time": "2026-10-19T03:32:01.673849Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "deployuser",
"pass": "abc1"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ampmon
{
"id": "8d9ef8953f23",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:54.373415Z",
"end_time": "2026-10-19T03:31:56.290353Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "ampmon",
"pass": "manager"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: us62
{
"id": "26d13d3c92df",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:49.651194Z",
"end_time": "2026-10-19T03:31:51.467400Z",
"duration": "1.8",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "us62",
"pass": "7539510"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: bita
{
"id": "b19e79fd4bee",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:44.200164Z",
"end_time": "2026-10-19T03:31:46.243822Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "bita",
"pass": "fastuser"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: skakulia
{
"id": "7e538b3a90aa",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:39.187737Z",
"end_time": "2026-10-19T03:31:41.510566Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "skakulia",
"pass": "123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 5930
{
"id": "ccf004d3dcb7",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:34.256389Z",
"end_time": "2026-10-19T03:31:36.709037Z",
"duration": "2.5",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "5930",
"pass": "ark"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: dengfoyou
{
"id": "ee29303ea2e8",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:29.392917Z",
"end_time": "2026-10-19T03:31:31.384847Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "dengfoyou",
"pass": "backup"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ftp
{
"id": "4cb4ea22aae2",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:24.140124Z",
"end_time": "2026-10-19T03:31:26.184408Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "ftp",
"pass": "Aa112211.."
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: unl0
{
"id": "4c7fb8174f19",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:19.250307Z",
"end_time": "2026-10-19T03:31:21.522212Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "unl0",
"pass": "k8s-cp-3"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mikewaz
{
"id": "538b2e3bd8cb",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:13.977011Z",
"end_time": "2026-10-19T03:31:16.958532Z",
"duration": "3.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "mikewaz",
"pass": "abc123!@"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: r-config-08
{
"id": "181fe2e7f67f",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:09.293875Z",
"end_time": "2026-10-19T03:31:11.616237Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "r-config-08",
"pass": "000000"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cs399
{
"id": "ebbdfb050ee3",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:31:04.392519Z",
"end_time": "2026-10-19T03:31:06.650540Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "cs399",
"pass": "wacos"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ahmad
{
"id": "2292bf075047",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:59.440168Z",
"end_time": "2026-10-19T03:31:01.423502Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "ahmad",
"pass": "Pa2534074w0rd"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
RECONNAISSANCE
SUCCESSFUL LOGIN
SCORE: 200
Credential acceptance event recorded. Target authentication: root / 123456
Remote entity achieved interactive shell state. Command sequence (9 executed):
[obs-node]:~$
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$
uname -s -v -n -m 2 > /dev/null
[obs-node]:~$
/bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$
/usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$
busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$
( [ -f /proc/version ]
[obs-node]:~$
[ -f /proc/version ]
[obs-node]:~$
head -1 /proc/version | cut -d -f1
[obs-node]:~$
[ -f /etc/os-release ]
{
"id": "129dc003a7a8",
"src_ip": "92.118.39.14",
"start_time": "2026-10-19T03:30:58.139233Z",
"end_time": "2026-10-19T03:31:30.521278Z",
"duration": "32.4",
"version": "SSH-2.0-Go",
"hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "123456"
},
"commands": [
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"uname -s -v -n -m 2 > /dev/null",
"/bin/uname -s -v -n -m 2 > /dev/null",
"/usr/bin/uname -s -v -n -m 2 > /dev/null",
"busybox uname -s -v -n -m 2 > /dev/null",
"( [ -f /proc/version ]",
"[ -f /proc/version ]",
"head -1 /proc/version | cut -d -f1",
"[ -f /etc/os-release ]"
],
"detailed_commands": [
{
"cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"failed": false,
"error": null
},
{
"cmd": "uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
"failed": true,
"error": "Command not found: /usr/bin/uname -s -v -n -m"
},
{
"cmd": "busybox uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "( [ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "[ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "head -1 /proc/version | cut -d -f1",
"failed": false,
"error": null
},
{
"cmd": "[ -f /etc/os-release ]",
"failed": false,
"error": null
}
],
"failed_commands": [
"/usr/bin/uname -s -v -n -m"
],
"score": 200,
"tags": [
"COMMANDS RUN",
"RECONNAISSANCE",
"SUCCESSFUL LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: weiwenbo
{
"id": "8f9d6fdd6666",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:54.332186Z",
"end_time": "2026-10-19T03:30:56.479509Z",
"duration": "2.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "weiwenbo",
"pass": "NDM4YzI2$"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
SCORE: 0
Autonomous probing activity normalized. Remote entity established connection but deferred authentication.
{
"id": "e124869e9847",
"src_ip": "92.118.39.14",
"start_time": "2026-10-19T03:30:53.687079Z",
"end_time": "2026-10-19T03:30:57.970488Z",
"duration": "4.3",
"version": null,
"hassh": null,
"attempts": [],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": []
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: tgk2
{
"id": "eb8da1ddcb15",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:49.477265Z",
"end_time": "2026-10-19T03:30:51.448367Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "tgk2",
"pass": "term2"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ubuntu2
{
"id": "7be5a7f4abf4",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:44.669156Z",
"end_time": "2026-10-19T03:30:47.379304Z",
"duration": "2.7",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "ubuntu2",
"pass": "proxy"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: lando_calrissian
{
"id": "5f5abe5cef03",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:39.797807Z",
"end_time": "2026-10-19T03:30:42.066097Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "lando_calrissian",
"pass": "Pa623561w0rd"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: abasak
{
"id": "d2580235cad3",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:34.952822Z",
"end_time": "2026-10-19T03:30:36.949689Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "abasak",
"pass": "heslo"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: ashish
{
"id": "2aa39555e028",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:30.011396Z",
"end_time": "2026-10-19T03:30:32.390043Z",
"duration": "2.4",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "ashish",
"pass": "alexis"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: yd01
{
"id": "444b2af6352e",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:25.171278Z",
"end_time": "2026-10-19T03:30:27.647626Z",
"duration": "2.5",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "yd01",
"pass": "123123aaa"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cs375
{
"id": "07fea876e007",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:20.417607Z",
"end_time": "2026-10-19T03:30:22.729791Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "cs375",
"pass": "claude123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: cyber
{
"id": "3832384035e4",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:15.721705Z",
"end_time": "2026-10-19T03:30:17.798144Z",
"duration": "2.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "cyber",
"pass": "survival"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: guanying
{
"id": "64823d6e1967",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:10.708600Z",
"end_time": "2026-10-19T03:30:12.935552Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "guanying",
"pass": "fastuser"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: calvin
{
"id": "25d1028497b4",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:05.880420Z",
"end_time": "2026-10-19T03:30:07.872817Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "calvin",
"pass": "localhost"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: odoo16
{
"id": "e089a74cee34",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:30:00.967499Z",
"end_time": "2026-10-19T03:30:03.017033Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "odoo16",
"pass": "Pa591296w0rd"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: user04
{
"id": "d4714187ba10",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:55.979230Z",
"end_time": "2026-10-19T03:29:58.196744Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "user04",
"pass": "jason"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: plex1
{
"id": "73b8f2c6b0f2",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:51.303437Z",
"end_time": "2026-10-19T03:29:53.606293Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "plex1",
"pass": "vic@123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: astra
{
"id": "3316f57d346b",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:46.420971Z",
"end_time": "2026-10-19T03:29:48.681246Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "astra",
"pass": "elasticsearch"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: slurm
{
"id": "2e5b4ec6fb4a",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:41.706708Z",
"end_time": "2026-10-19T03:29:44.015587Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "slurm",
"pass": "hdfs"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: hari
{
"id": "a4fa1e33e23a",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:36.828626Z",
"end_time": "2026-10-19T03:29:39.253826Z",
"duration": "2.4",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "hari",
"pass": "backup1234"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: zj
{
"id": "1e5f8faab6e5",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:32.083519Z",
"end_time": "2026-10-19T03:29:34.328829Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "zj",
"pass": "Zhangjay5865358"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: 5913
{
"id": "31332fecdec0",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:27.115946Z",
"end_time": "2026-10-19T03:29:29.339608Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "5913",
"pass": "liuyan"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jarjar_binks
{
"id": "8d392ad3067f",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:22.363431Z",
"end_time": "2026-10-19T03:29:24.402100Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "jarjar_binks",
"pass": "zaq12wsxcde3"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: s9teeyira
{
"id": "a1aa7ff4cce4",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:17.577027Z",
"end_time": "2026-10-19T03:29:19.487816Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "s9teeyira",
"pass": "root.123"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: mdol
{
"id": "ded28ec95c94",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:12.644989Z",
"end_time": "2026-10-19T03:29:14.700389Z",
"duration": "2.1",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "mdol",
"pass": "pornporn"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: gitlab
{
"id": "b97937649e1f",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:07.663207Z",
"end_time": "2026-10-19T03:29:09.706830Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "gitlab",
"pass": "Tiki2025@!"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: n-config-08
{
"id": "5d48396907a2",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:29:02.893334Z",
"end_time": "2026-10-19T03:29:05.151547Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "n-config-08",
"pass": "user50"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: wso2
{
"id": "525d977c5e85",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:57.642066Z",
"end_time": "2026-10-19T03:28:59.961847Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "wso2",
"pass": "iphone"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rahul
{
"id": "292f345b363c",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:52.865034Z",
"end_time": "2026-10-19T03:28:55.133470Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "rahul",
"pass": "lenovo"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: proxy
{
"id": "7aca6638775e",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:47.916144Z",
"end_time": "2026-10-19T03:28:50.089443Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "proxy",
"pass": "Pa1658957w0rd"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: jiangsuxingan
{
"id": "1179b361afce",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:43.226508Z",
"end_time": "2026-10-19T03:28:45.474208Z",
"duration": "2.2",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "jiangsuxingan",
"pass": "Qq123456"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: astra_user
{
"id": "3df2d32021eb",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:38.225770Z",
"end_time": "2026-10-19T03:28:40.478090Z",
"duration": "2.3",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "astra_user",
"pass": "rootadmin"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: prabhjot
{
"id": "af5ce0842b2b",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:33.425465Z",
"end_time": "2026-10-19T03:28:35.345164Z",
"duration": "1.9",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "prabhjot",
"pass": "docker"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: rtelekom
{
"id": "e833deb20d2a",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:28.291432Z",
"end_time": "2026-10-19T03:28:30.290118Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "rtelekom",
"pass": "flink"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
FAILED LOGIN
SCORE: 0
Unauthorized authentication attempt escalated. Dictionary traversal detected (1 distinct queries). Vector identities: person
{
"id": "5cceb5d1ac0b",
"src_ip": "109.160.32.178",
"start_time": "2026-10-19T03:28:23.316211Z",
"end_time": "2026-10-19T03:28:25.367581Z",
"duration": "2.0",
"version": "SSH-2.0-Go",
"hassh": "0a07365cc01fa9fc82608ba4019af499",
"attempts": [
{
"user": "person",
"pass": "digital"
}
],
"success_login": false,
"success_credential": null,
"commands": [],
"detailed_commands": [],
"failed_commands": [],
"score": 0,
"tags": [
"FAILED LOGIN"
]
}
COMMANDS RUN
RECONNAISSANCE
SUCCESSFUL LOGIN
SCORE: 200
Credential acceptance event recorded. Target authentication: root / 12345
Remote entity achieved interactive shell state. Command sequence (9 executed):
[obs-node]:~$
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output"
[obs-node]:~$
uname -s -v -n -m 2 > /dev/null
[obs-node]:~$
/bin/uname -s -v -n -m 2 > /dev/null
[obs-node]:~$
/usr/bin/uname -s -v -n -m 2 > /dev/null
Command not found: /usr/bin/uname -s -v -n -m
[obs-node]:~$
busybox uname -s -v -n -m 2 > /dev/null
[obs-node]:~$
( [ -f /proc/version ]
[obs-node]:~$
[ -f /proc/version ]
[obs-node]:~$
head -1 /proc/version | cut -d -f1
[obs-node]:~$
[ -f /etc/os-release ]
{
"id": "61c6386bfa58",
"src_ip": "92.118.39.14",
"start_time": "2026-10-19T03:28:22.594291Z",
"end_time": "2026-10-19T03:28:47.441101Z",
"duration": "24.8",
"version": "SSH-2.0-Go",
"hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
"attempts": [],
"success_login": true,
"success_credential": {
"user": "root",
"pass": "12345"
},
"commands": [
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"uname -s -v -n -m 2 > /dev/null",
"/bin/uname -s -v -n -m 2 > /dev/null",
"/usr/bin/uname -s -v -n -m 2 > /dev/null",
"busybox uname -s -v -n -m 2 > /dev/null",
"( [ -f /proc/version ]",
"[ -f /proc/version ]",
"head -1 /proc/version | cut -d -f1",
"[ -f /etc/os-release ]"
],
"detailed_commands": [
{
"cmd": "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '\"' ) || echo \"\"); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q \"lm\" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 8\" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q \"CPU architecture: 7\" /proc/cpuinfo && echo armv7l ) || echo \"\"); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E \"^model name\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E \"^Hardware\" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; printf 'execute_err='; out=$(bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf \"#!/bin/bash\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case \"$out\" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf \"#!/bin/sh\\necho \\\"xxxxxx\\\"\\n\" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' \"$out\" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\\n' 2>/dev/null || busybox tr -d '\\n' 2>/dev/null || cat ); printf '\\n'; echo '===DONE===' ) 2>&1 ); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"LAST:$last_output\"; echo \"FILTER:$filter_output\"",
"failed": false,
"error": null
},
{
"cmd": "uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/bin/uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "/usr/bin/uname -s -v -n -m 2 > /dev/null",
"failed": true,
"error": "Command not found: /usr/bin/uname -s -v -n -m"
},
{
"cmd": "busybox uname -s -v -n -m 2 > /dev/null",
"failed": false,
"error": null
},
{
"cmd": "( [ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "[ -f /proc/version ]",
"failed": false,
"error": null
},
{
"cmd": "head -1 /proc/version | cut -d -f1",
"failed": false,
"error": null
},
{
"cmd": "[ -f /etc/os-release ]",
"failed": false,
"error": null
}
],
"failed_commands": [
"/usr/bin/uname -s -v -n -m"
],
"score": 200,
"tags": [
"COMMANDS RUN",
"RECONNAISSANCE",
"SUCCESSFUL LOGIN"
]
}