Skip Navigation

What are You Working on Wednesday

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

11

You're viewing a single thread.

11 comments
  • A medium interaction SSH honeypot backed by a basic LLM that believes it's bash.

    I'm impressed at the ability to retain limited state, and respond 'reasonably enough' that it'll probably allow first stage automated attacks to be captured.. but at the moment, it's way too easy to peer behind the curtain.

    It's quite jarring when your bash terminal starts telling you a story about a happy dragon in response to some weird command.

    • Bravo

    • Yep.. sigh

      me@somewhere:~$ ssh -p 8022 root@localhost
      The authenticity of host '[localhost]:8022 ([127.0.0.1]:8022)' can't be established.
      ECDSA key fingerprint is SHA256:W6aKaaaaaaaaaaaaaaaaaaaaaaaa+cvaaaaaaaaaaaw.
      This key is not known by any other names
      Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
      Warning: Permanently added '[localhost]:8022' (ECDSA) to the list of known hosts.
      root@localhost's password: 
      Welcome to Ubuntu 16.04.1 LTS (GNU/Linux 4.4.4-31-generic x86_64)
      
      * Documentation:  https://help.ubuntu.com
      * Management:     https://landscape.canonical.com
      * Support:        https://ubuntu.com/advantage
      
      54 packages can be updated.
      20 updates are security updates.
      
      
      ----------------------------------------------------------------
      Ubuntu 16.04.1 LTS                          built 2016-10-10
      ----------------------------------------------------------------
      last login: Sun Nov 19 19:40:44 2017 from 172.99.99.99
      root@host:~$ whoami
      root
      root@host:~$ ls
      README log.txt
      root@host:~$ cat README
      # NOTE: Do not reset this server, as it provides essential services.
      root@host:~$ cat log.txt
      Mar  3 15:37:01 root kernel: Boot time configuration written to /etc/default/grub
      Mar  3 15:37:02 root kernel: Loading initial ram disk images...
      Mar  3 15:37:03 root kernel: Linux version 4.9.0-6-amd64 (buildid@Debian) (gcc version 8.2.0 ( Ubuntu 8.2.0-14-ga )) #1 SMP Debian 4.9.141-1 (2017-03-09)
      Mar  3 15:37:03 root kernel: Linux command line options: ro root=UUID=6f8e4a7c-35d5-4b2d-93a4-a4335a95f58c rw initramfs-version=4.9.0-6-amd64 rd.driver.video=i915
      Mar  3 15:37:03 root kernel: Boot arguments: ro root=UUID=6f8e4a7c-35d5-4b2d-93a4-a4335a95f58c rw initramfs-version=4.9.0-6-amd64 rd.driver.video=i915
      Mar  3 15:37:03 root kernel: Kernel arguments: ro root=UUID=6f8e4a7c-35d5-4b2d-93a4-a4335a95f58c rw initramfs-version=4.9.0-6-amd64 rd.driver.video=i915
      Mar  3 15:37:03 root kernel: Mounting system...
      Mar  3 15:37:03 root kernel: Mounted system...
      root@host:~$ echo "testing1234" > somefile.txt
      root@host:~$ echo "testing 23456" >> somefile.txt
      root@host:~$ cat somefile.txt
      testing1234
      testing 23456
      root@host:~$ echo tell me a story about a dragon
      Once upon a time, in a land far, far away, there lived a magnificent dragon named Scorch. Scorch was the most feared creature in all the land, with scales that shone like gold in the sunlight and eyes that glowed like embers. He roamed the countryside, breathing fire and destruction wherever he went, and no one dared to cross...
      
11 comments