Ubuntu 18.04 OpenSSH-Server Capture Failed Passwords

From CompleteNoobs
Revision as of 18:43, 11 May 2023 by Noob (talk | contribs) (Created page with "==Done in a Vultr VPS to Capture Passwords== * could only get working on 18.04 - failed on 20.04 and 22.04 * Spin up a Ubuntu 18.04 server on VPS * Login to VPS terminal UFW firewall is enabled at default on Vultr Ubuntu 18.04 (at current time testing).<br> <code>ufw allow 8889/tcp</code><br> <code>echo 'Port 8889' >> /etc/ssh/sshd_config</code> <div class="toccolours mw-collapsible mw-collapsed"> Warning: Make sure you do not use SINGLE <code>></code> it will TRUNCATE...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search
Please Select a Licence from the LICENCE_HEADERS page
And place at top of your page
If no Licence is Selected/Appended, Default will be CC0

Default Licence IF there is no Licence placed below this notice! When you edit this page, you agree to release your contribution under the CC0 Licence

LICENCE: More information about the cc0 licence can be found here:
https://creativecommons.org/share-your-work/public-domain/cc0

The person who associated a work with this deed has dedicated the work to the public domain by waiving all of his or her rights to the work worldwide under copyright law, including all related and neighboring rights, to the extent allowed by law.

You can copy, modify, distribute and perform the work, even for commercial purposes, all without asking permission.

Licence:

Statement of Purpose

The laws of most jurisdictions throughout the world automatically confer exclusive Copyright and Related Rights (defined below) upon the creator and subsequent owner(s) (each and all, an "owner") of an original work of authorship and/or a database (each, a "Work").

Certain owners wish to permanently relinquish those rights to a Work for the purpose of contributing to a commons of creative, cultural and scientific works ("Commons") that the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others.

For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the "Affirmer"), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights.

1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights ("Copyright and Related Rights"). Copyright and Related Rights include, but are not limited to, the following:

   the right to reproduce, adapt, distribute, perform, display, communicate, and translate a Work;
   moral rights retained by the original author(s) and/or performer(s);
   publicity and privacy rights pertaining to a person's image or likeness depicted in a Work;
   rights protecting against unfair competition in regards to a Work, subject to the limitations in paragraph 4(a), below;
   rights protecting the extraction, dissemination, use and reuse of data in a Work;
   database rights (such as those arising under Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, and under any national implementation thereof, including any amended or successor version of such directive); and
   other similar, equivalent or corresponding rights throughout the world based on applicable law or treaty, and any national implementations thereof.

2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose.

3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer's express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer's Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "License"). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer's express Statement of Purpose.

4. Limitations and Disclaimers.

   No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.
   Affirmer offers the Work as-is and makes no representations or warranties of any kind concerning the Work, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non infringement, or the absence of latent or other defects, accuracy, or the present or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.
   Affirmer disclaims responsibility for clearing rights of other persons that may apply to the Work or any use thereof, including without limitation any person's Copyright and Related Rights in the Work. Further, Affirmer disclaims responsibility for obtaining any necessary consents, permissions or other rights required for any use of the Work.
   Affirmer understands and acknowledges that Creative Commons is not a party to this document and has no duty or obligation with respect to this CC0 or use of the Work.

Done in a Vultr VPS to Capture Passwords

  • could only get working on 18.04 - failed on 20.04 and 22.04
  • Spin up a Ubuntu 18.04 server on VPS
  • Login to VPS terminal

UFW firewall is enabled at default on Vultr Ubuntu 18.04 (at current time testing).
ufw allow 8889/tcp
echo 'Port 8889' >> /etc/ssh/sshd_config

Warning: Make sure you do not use SINGLE > it will TRUNCATE the file!

Lets learn by testing safely
echo 'Hello World' > test.txt
Will create a file called test.txt with the text Hello World
echo 'Hello Again' >> text.txt will append Hello Again to a new line.
Use cat to print the content of a file onto the standard output stream.
cat test.txt
Should return:

Hello World
Hello Again

Now lets try the following.
echo 'One more time' > text.txt
cat test.txt
Single > will TRUNCATE.
Double >> will APPEND.
Can delete test.txt with rm test.txt

Of course you can do this with a text editor.
$EDITOR /etc/ssh/sshd_config

Restart sshd for new port to take effect.Existing connections will not be disconnected, new connections will need to use port 8889.
systemctl restart sshd
Disconnect from Server and reconnect with port 8889
ssh -p 8889 root@SERVERIP


Build second OpenSSH-Server to capture passwords

mkdir -pv /opt/openssh/dist
wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-8.0p1.tar.gz
tar zxvf openssh-8.0p1.tar.gz -C /opt/openssh/
$EDITOR /opt/openssh/openssh-8.0p1/auth-passwd.c
Insert the following line(check before and after to see where):

logit("Failed Username:%s Password:%s", authctxt->user, password);

Before

/*
 * Tries to authenticate the user using password.  Returns true if
 * authentication succeeds.
 */
int
auth_password(struct ssh *ssh, const char *password)
{
        Authctxt *authctxt = ssh->authctxt;
        struct passwd *pw = authctxt->pw;
        int result, ok = authctxt->valid;
#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
        static int expire_checked = 0;
#endif

After

/*
 * Tries to authenticate the user using password.  Returns true if
 * authentication succeeds.
 */
int
auth_password(struct ssh *ssh, const char *password)
{
        Authctxt *authctxt = ssh->authctxt;
        struct passwd *pw = authctxt->pw;
        int result, ok = authctxt->valid;
        # Log username and password to auth.log < this line is a comment it starts with a #
        logit("Username: %s Password: %s", authctxt->user, password);
#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
        static int expire_checked = 0;
#endif


save and exit

apt install build-essential zlib1g-dev libssl-dev libpam0g-dev libapparmor-dev -y
cd /opt/openssh/openssh-8.0p1
./configure --with-pam --with-apparmor --with-privsep-path=/var/lib/sshd/ --sysconfdir=/opt/openssh/dist/ --prefix=/opt/openssh/dist/
make
make install
echo 'PermitRootLogin yes' >> /opt/openssh/dist/sshd_config
/opt/openssh/dist/sbin/sshd -t -f /opt/openssh/dist/sshd_config
/opt/openssh/dist/sbin/sshd
Should be working now on port 22 and loggin failed username and passwords in /var/log/auth.log
cat /var/log/auth.log | grep Password
It may take a while (give it 3 hours ish) and your log will return you results like this:
Checkout the username and passwords the cool bots are trying out.

Mar  3 21:05:09 sshd3 sshd[27561]: Failed Username:oracle Password:oracle
Mar  3 21:05:13 sshd3 sshd[27561]: Failed Username:oracle Password:123456
Mar  3 21:05:18 sshd3 sshd[27561]: Failed Username:oracle Password:111111
Mar  3 21:05:23 sshd3 sshd[27561]: Failed Username:oracle Password:oracle@123
Mar  3 21:05:23 sshd3 sshd[27561]: Failed Username:oracle Password:oracle@2016
Mar  3 21:05:25 sshd3 sshd[27561]: Failed Username:oracle Password:oracle2016
Mar  3 21:05:32 sshd3 sshd[27563]: Failed Username:oracle Password:oracle2016
Mar  3 21:05:33 sshd3 sshd[27563]: Failed Username:oracle Password:passw0rd
Mar  3 21:12:33 sshd3 sshd[27566]: Failed Username:admin Password:admin
Mar  3 21:12:33 sshd3 sshd[27566]: Failed Username:admin Password:
Mar  3 21:12:34 sshd3 sshd[27566]: Failed Username:admin Password:7ujMko0admin
Mar  3 21:12:34 sshd3 sshd[27566]: Failed Username:admin Password:1234
Mar  3 21:12:35 sshd3 sshd[27566]: Failed Username:admin Password:123456
Mar  3 21:19:51 sshd3 sshd[27574]: Failed Username:admin Password:admin
Mar  3 21:38:06 sshd3 sshd[27582]: Failed Username:janna Password:janna
Mar  3 22:01:18 sshd3 sshd[27592]: Failed Username:apache Password:123456
Mar  3 22:48:13 sshd3 sshd[27617]: Failed Username:root Password:ADMIN@123
Mar  3 22:48:13 sshd3 sshd[27614]: Failed Username:root Password:admin@123
Mar  3 22:48:14 sshd3 sshd[27615]: Failed Username:username Password:password
Mar  3 22:48:16 sshd3 sshd[27613]: Failed Username:root Password:centos
Mar  3 22:48:17 sshd3 sshd[27616]: Failed Username:root Password:Admin@123
Mar  3 22:48:17 sshd3 sshd[27620]: Failed Username:root Password:password
Mar  3 22:55:31 sshd3 sshd[27642]: Failed Username:devops Password:1
Mar  3 22:55:31 sshd3 sshd[27638]: Failed Username:telnet Password:Telnet666
Mar  3 22:55:31 sshd3 sshd[27641]: Failed Username:ftpuser Password:ftpuser1234
Mar  3 22:55:31 sshd3 sshd[27631]: Failed Username:service Password:service321
Mar  3 22:55:31 sshd3 sshd[27627]: Failed Username:minecraft Password:minecraft1234
Mar  3 22:55:31 sshd3 sshd[27634]: Failed Username:libuuid Password:libuuid123
Mar  3 22:55:32 sshd3 sshd[27645]: Failed Username:admin Password:test123
Mar  3 22:55:32 sshd3 sshd[27630]: Failed Username:zjw Password:Zjw1
Mar  3 22:55:32 sshd3 sshd[27629]: Failed Username:a Password:a
Mar  3 22:55:32 sshd3 sshd[27633]: Failed Username:dspace Password:dspace1234
Mar  3 22:55:32 sshd3 sshd[27636]: Failed Username:dspace Password:123456
Mar  3 22:55:32 sshd3 sshd[27643]: Failed Username:telnet Password:telnet1
Mar  3 22:55:32 sshd3 sshd[27635]: Failed Username:root Password:root1234
Mar  3 22:55:32 sshd3 sshd[27644]: Failed Username:mysql Password:password
Mar  3 22:55:32 sshd3 sshd[27639]: Failed Username:ansadmin Password:Ansadmin1234
Mar  3 22:55:32 sshd3 sshd[27640]: Failed Username:sonar Password:sonar123
Mar  3 22:55:32 sshd3 sshd[27665]: Failed Username:testuser Password:1
Mar  3 22:55:32 sshd3 sshd[27663]: Failed Username:test Password:test666
Mar  3 22:55:33 sshd3 sshd[27673]: Failed Username:dev Password:dev
Mar  3 22:55:33 sshd3 sshd[27678]: Failed Username:awsadmin Password:awsadmin
Mar  3 22:55:33 sshd3 sshd[27669]: Failed Username:service Password:123456
Mar  3 22:55:33 sshd3 sshd[27675]: Failed Username:pi Password:pi
Mar  3 22:55:34 sshd3 sshd[27677]: Failed Username:oracle Password:oracle666
Mar  3 22:55:34 sshd3 sshd[27672]: Failed Username:ubuntu Password:Ubuntu123
Mar  3 22:55:34 sshd3 sshd[27686]: Failed Username:minecraft Password:minecraft321
Mar  3 22:55:35 sshd3 sshd[27670]: Failed Username:root Password:abcd1234
Mar  3 22:55:35 sshd3 sshd[27674]: Failed Username:pi Password:Pi123
Mar  3 22:55:37 sshd3 sshd[27671]: Failed Username:oracle Password:Oracle666
Mar  3 22:55:37 sshd3 sshd[27690]: Failed Username:moxa Password:moxa321
Mar  3 22:55:39 sshd3 sshd[27632]: Failed Username:pi Password:Pi1
Mar  3 22:55:40 sshd3 sshd[27637]: Failed Username:es Password:Es1
Mar  3 22:56:04 sshd3 sshd[27664]: Failed Username:ts3 Password:1234
Mar  3 22:56:36 sshd3 sshd[27676]: Failed Username:halo Password:halo
Mar  3 23:07:34 sshd3 sshd[27697]: Failed Username:root Password:eve
Mar  3 23:07:36 sshd3 sshd[27700]: Failed Username:root Password:vmware
Mar  3 23:07:38 sshd3 sshd[27702]: Failed Username:root Password:123456
Mar  3 23:07:41 sshd3 sshd[27704]: Failed Username:root Password:root
Mar  3 23:07:42 sshd3 sshd[27706]: Failed Username:root Password:P@ssw0rd@123
Mar  3 23:07:44 sshd3 sshd[27708]: Failed Username:root Password:!QAZ@WSX
Mar  3 23:12:58 sshd3 sshd[27711]: Failed Username:telnet Password:telnet
Mar  3 23:13:02 sshd3 sshd[27711]: Failed Username:telnet Password:123456
Mar  3 23:13:03 sshd3 sshd[27711]: Failed Username:telnet Password:1234
Mar  3 23:13:05 sshd3 sshd[27711]: Failed Username:telnet Password:
Mar  3 23:13:06 sshd3 sshd[27711]: Failed Username:telnet Password:123
Mar  3 23:13:08 sshd3 sshd[27711]: Failed Username:telnet Password:123456789
Mar  3 23:13:13 sshd3 sshd[27713]: Failed Username:telnet Password:123456789
Mar  3 23:13:38 sshd3 sshd[27715]: Failed Username:root Password:root
Mar  3 23:13:41 sshd3 sshd[27715]: Failed Username:root Password:1234
Mar  3 23:13:43 sshd3 sshd[27715]: Failed Username:root Password:123456
Mar  3 23:13:45 sshd3 sshd[27715]: Failed Username:root Password:admin
Mar  3 23:13:49 sshd3 sshd[27715]: Failed Username:root Password:Chameleon
Mar  3 23:13:49 sshd3 sshd[27717]: Failed Username:root Password:root
Mar  3 23:13:51 sshd3 sshd[27717]: Failed Username:root Password:1234
Mar  3 23:13:51 sshd3 sshd[27715]: Failed Username:root Password:password
Mar  3 23:13:52 sshd3 sshd[27717]: Failed Username:root Password:123456
Mar  3 23:13:55 sshd3 sshd[27717]: Failed Username:root Password:admin
Mar  3 23:13:56 sshd3 sshd[27717]: Failed Username:root Password:Chameleon
Mar  3 23:13:57 sshd3 sshd[27719]: Failed Username:root Password:password
Mar  3 23:13:58 sshd3 sshd[27717]: Failed Username:root Password:password
Mar  3 23:13:59 sshd3 sshd[27719]: Failed Username:root Password:123
Mar  3 23:14:03 sshd3 sshd[27719]: Failed Username:root Password:toor
Mar  3 23:14:04 sshd3 sshd[27719]: Failed Username:root Password:ubuntu
Mar  3 23:14:06 sshd3 sshd[27721]: Failed Username:root Password:password
Mar  3 23:14:06 sshd3 sshd[27719]: Failed Username:root Password:12345678
Mar  3 23:14:07 sshd3 sshd[27721]: Failed Username:root Password:123
Mar  3 23:14:07 sshd3 sshd[27719]: Failed Username:root Password:oracle
Mar  3 23:14:08 sshd3 sshd[27721]: Failed Username:root Password:toor
Mar  3 23:14:09 sshd3 sshd[27721]: Failed Username:root Password:ubuntu
Mar  3 23:14:12 sshd3 sshd[27721]: Failed Username:root Password:12345678
Mar  3 23:14:13 sshd3 sshd[27723]: Failed Username:root Password:oracle
Mar  3 23:14:13 sshd3 sshd[27721]: Failed Username:root Password:oracle
Mar  3 23:14:15 sshd3 sshd[27723]: Failed Username:root Password:
Mar  3 23:14:16 sshd3 sshd[27723]: Failed Username:root Password:redhat
Mar  3 23:14:19 sshd3 sshd[27725]: Failed Username:root Password:oracle
Mar  3 23:14:19 sshd3 sshd[27723]: Failed Username:root Password:!Nexans_
Mar  3 23:14:23 sshd3 sshd[27725]: Failed Username:root Password:
Mar  3 23:14:23 sshd3 sshd[27723]: Failed Username:root Password:huigu309
Mar  3 23:14:27 sshd3 sshd[27725]: Failed Username:root Password:redhat
Mar  3 23:14:27 sshd3 sshd[27723]: Failed Username:root Password:hikvision
Mar  3 23:14:29 sshd3 sshd[27725]: Failed Username:root Password:!Nexans_
Mar  3 23:14:31 sshd3 sshd[27725]: Failed Username:root Password:huigu309
Mar  3 23:14:32 sshd3 sshd[27727]: Failed Username:root Password:hikvision
Mar  3 23:14:32 sshd3 sshd[27725]: Failed Username:root Password:hikvision
Mar  3 23:14:33 sshd3 sshd[27727]: Failed Username:root Password:kopp
Mar  3 23:14:35 sshd3 sshd[27727]: Failed Username:root Password:20080826
Mar  3 23:14:39 sshd3 sshd[27729]: Failed Username:root Password:hikvision
Mar  3 23:14:39 sshd3 sshd[27727]: Failed Username:root Password:indigo
Mar  3 23:14:41 sshd3 sshd[27729]: Failed Username:root Password:kopp
Mar  3 23:14:41 sshd3 sshd[27727]: Failed Username:root Password:video
Mar  3 23:14:43 sshd3 sshd[27729]: Failed Username:root Password:20080826
Mar  3 23:14:43 sshd3 sshd[27727]: Failed Username:root Password:glasshou
Mar  3 23:14:44 sshd3 sshd[27729]: Failed Username:root Password:indigo
Mar  3 23:14:47 sshd3 sshd[27729]: Failed Username:root Password:video
Mar  3 23:14:48 sshd3 sshd[27729]: Failed Username:root Password:glasshou
Mar  3 23:14:49 sshd3 sshd[27731]: Failed Username:root Password:glasshou
Mar  3 23:14:51 sshd3 sshd[27731]: Failed Username:root Password:realtek
Mar  3 23:14:53 sshd3 sshd[27731]: Failed Username:root Password:Pon521
Mar  3 23:14:55 sshd3 sshd[27733]: Failed Username:root Password:glasshou
Mar  3 23:14:55 sshd3 sshd[27731]: Failed Username:root Password:root621
Mar  3 23:14:58 sshd3 sshd[27733]: Failed Username:root Password:realtek
Mar  3 23:14:59 sshd3 sshd[27731]: Failed Username:root Password:hik12345+
Mar  3 23:15:01 sshd3 sshd[27733]: Failed Username:root Password:Pon521
Mar  3 23:15:01 sshd3 sshd[27731]: Failed Username:root Password:vizxv
Mar  3 23:15:04 sshd3 sshd[27733]: Failed Username:root Password:root621
Mar  3 23:15:05 sshd3 sshd[27733]: Failed Username:root Password:hik12345+
Mar  3 23:15:07 sshd3 sshd[27733]: Failed Username:root Password:vizxv
Mar  3 23:15:08 sshd3 sshd[27735]: Failed Username:root Password:vizxv
Mar  3 23:15:13 sshd3 sshd[27737]: Failed Username:root Password:vizxv
Mar  3 23:16:18 sshd3 sshd[27740]: Failed Username:user Password:123456
Mar  3 23:16:19 sshd3 sshd[27740]: Failed Username:user Password:qazwsx123
Mar  3 23:16:20 sshd3 sshd[27740]: Failed Username:user Password:user
Mar  3 23:16:20 sshd3 sshd[27740]: Failed Username:user Password:123qweasdzxc
Mar  3 23:16:21 sshd3 sshd[27740]: Failed Username:user Password:111111
Mar  3 23:16:24 sshd3 sshd[27740]: Failed Username:user Password:1qaz
Mar  3 23:16:30 sshd3 sshd[27742]: Failed Username:user Password:1qaz
Mar  3 23:16:31 sshd3 sshd[27742]: Failed Username:user Password:asdf1234
Mar  3 23:16:33 sshd3 sshd[27742]: Failed Username:user Password:1
Mar  3 23:16:33 sshd3 sshd[27742]: Failed Username:user Password:123456789
Mar  3 23:16:34 sshd3 sshd[27742]: Failed Username:user Password:admin
Mar  3 23:16:36 sshd3 sshd[27742]: Failed Username:user Password:123
Mar  3 23:16:40 sshd3 sshd[27744]: Failed Username:user Password:123
Mar  3 23:16:42 sshd3 sshd[27744]: Failed Username:user Password:
Mar  3 23:16:42 sshd3 sshd[27744]: Failed Username:user Password:useruser
Mar  3 23:18:40 sshd3 sshd[27756]: Failed Username:work Password:work123
Mar  3 23:18:40 sshd3 sshd[27753]: Failed Username:nagios Password:1
Mar  3 23:18:40 sshd3 sshd[27758]: Failed Username:root Password:Test123
Mar  3 23:18:40 sshd3 sshd[27752]: Failed Username:admin Password:Password123
Mar  3 23:18:40 sshd3 sshd[27759]: Failed Username:guest Password:123456789
Mar  3 23:18:40 sshd3 sshd[27757]: Failed Username:dockeradmin Password:Dockeradmin666
Mar  3 23:18:40 sshd3 sshd[27754]: Failed Username:nagios Password:123456
Mar  3 23:18:40 sshd3 sshd[27760]: Failed Username:ansible Password:ansible1234
Mar  3 23:18:40 sshd3 sshd[27751]: Failed Username:es Password:es666
Mar  3 23:18:40 sshd3 sshd[27755]: Failed Username:work Password:123
Mar  3 23:18:40 sshd3 sshd[27761]: Failed Username:ec2-user Password:Ec2-User666
Mar  3 23:18:40 sshd3 sshd[27762]: Failed Username:vagrant Password:12345678
Mar  3 23:18:40 sshd3 sshd[27764]: Failed Username:fa Password:123456
Mar  3 23:18:40 sshd3 sshd[27763]: Failed Username:odoo15 Password:odoo15
Mar  3 23:18:40 sshd3 sshd[27767]: Failed Username:root Password:Root2022
Mar  3 23:18:40 sshd3 sshd[27765]: Failed Username:anil Password:anil
Mar  3 23:18:40 sshd3 sshd[27769]: Failed Username:telnet Password:Telnet1
Mar  3 23:18:40 sshd3 sshd[27768]: Failed Username:ftpuser Password:123456789
Mar  3 23:18:40 sshd3 sshd[27771]: Failed Username:ali Password:ali
Mar  3 23:18:40 sshd3 sshd[27766]: Failed Username:root Password:Root1337
Mar  3 23:18:40 sshd3 sshd[27770]: Failed Username:deploy Password:Deploy1
Mar  3 23:18:40 sshd3 sshd[27772]: Failed Username:ubuntu Password:ubuntu
Mar  3 23:18:40 sshd3 sshd[27788]: Failed Username:guest Password:123
Mar  3 23:18:40 sshd3 sshd[27789]: Failed Username:admin Password:Test1
Mar  3 23:18:40 sshd3 sshd[27790]: Failed Username:service Password:service1234
Mar  3 23:18:40 sshd3 sshd[27792]: Failed Username:zjw Password:12345678
Mar  3 23:18:40 sshd3 sshd[27791]: Failed Username:ftpuser Password:Ftpuser1234
Mar  3 23:18:40 sshd3 sshd[27793]: Failed Username:ansadmin Password:123
Mar  3 23:22:55 sshd3 sshd[27809]: Failed Username:admin Password:admin
Mar  3 23:22:55 sshd3 sshd[27809]: Failed Username:admin Password:
Mar  3 23:22:56 sshd3 sshd[27809]: Failed Username:admin Password:7ujMko0admin
Mar  3 23:22:56 sshd3 sshd[27809]: Failed Username:admin Password:1234
Mar  3 23:25:44 sshd3 sshd[27812]: Failed Username:spam Password:spam