Watch bots attack in real time — Honeypot live feed. A new challenge every Monday.
ogurexxx@root:~$ less case-2026-W44.log
Weekly investigation
Below is the log of a real bot session that “hacked” the honeypot on my server this week. Addresses and links are hidden; everything else is as it happened. Work out what it did and answer the questions. The site builds a new challenge every week from fresh attacks.
[2026-10-29 20:21] new connection · SSH-2.0-libssh_0.11.1
[2026-10-29 20:21] login succeeded: root
root@srv-backup01:~# cd ~ && rm -rf .ssh && mkdir .ssh && echo <arg> && chmod -R <arg> ~/.ssh && cd ~
root@srv-backup01:~# cat /proc/cpuinfo | grep name | wc -l
root@srv-backup01:~# echo <str> | chpasswd | bash
root@srv-backup01:~# rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.
root@srv-backup01:~# cat /proc/cpuinfo | grep name | head -n 1 | awk <str>
root@srv-backup01:~# free -m | grep <arg> | awk <str>
root@srv-backup01:~# ls -lh <arg> <arg>
root@srv-backup01:~# crontab -l
root@srv-backup01:~# w
root@srv-backup01:~# uname -m
root@srv-backup01:~# cat /proc/cpuinfo | grep model | grep name | wc -l
[+28 s] connection closed
Show answers
- Linux File and Directory Permissions Modification — The first meaningful command is Linux File and Directory Permissions Modification, technique T1222.002.
- SSH key implant — The goal is the “furthest” action in the chain — what the bot came for in the first place.
- 11 — Count the lines with the root@… prompt in the log.
- System Network Configuration Discovery — The other three are in the chain — you can match them to commands.
- SSH-2.0-libssh_0.11.1 — The client shows at the very start of the session, in the protocol version string. Go and libssh are typical signs of automated bots.