Hacker News new | ask | show | jobs
by fragmede 15 days ago
Yeah I have an SSH daemon running on the default port at funky.nondeterministic.computer for people to hit, but it's mostly bots, which is no fun.
2 comments

Do you allow them entry, present a fake prompt, and record what they do?

Some time ago I did a little experiment by running `nc -l -p 23` (telnet) which connects the next incoming telnet connection to your console. Type in a simulated prompt like Password: or # and it'll be buffered until the connection comes in. Then see what the scanner sends.

Danger. I believe this opens a RCE hole if the attacker sends a properly crafted sequence of terminal escape codes.
Hope you never cat any file or curl any URL
Is this the GTA 4 trailer?! /s

It’s too bad that ssh doesn’t carry sound. A MIDI-style rendition of the song would really tie it all together.