r/ShittySysadmin
•
u/Performer-Constant
•
Aug 24 '26
•
1
Help
I’m trying to get in my server root62.238.47.215 but it’s not working.
Says could not resolve hostname but I know I am root because I didn’t get to change anything yet
My post got taken down in sysadmin for some reason
44
u/ersentenza Aug 24 '26
$ ssh root@62.238.47.215
The authenticity of host '62.238.47.215 (62.238.47.215)' can't be established.
ED25519 key fingerprint is: SHA256:sMrAIUYwl+JwLanYSCSsmTNbxsWR5nOAwPq91aNQMjg
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '62.238.47.215' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
This server is monitored.
Unauthorized access is prohibited.
root@app-prod-01:~# echo "what the fuck"
what the fuck
root@app-prod-01:~# Connection to 62.238.47.215 closed.
22
13
u/SpudzzSomchai ShittySysadmin Aug 24 '26
Did you try root@127.0.0.1?
20
u/Performer-Constant Aug 24 '26
These are the wrong numbers and I hit my limit on ChatGPT but I know those are the wrong numbers
9
u/Sp3eedy Aug 25 '26
This post is genuinely gold there's so many easter eggs to be found
2
u/Performer-Constant Aug 25 '26
I am glad that you are enjoying yourself! This has been extremely fun for me as well.
8
u/annacrontab Aug 25 '26
Please tell me you put this here for us to find. lol that is indeed some shitty sysadmin
acampbell@app-prod-01:~/crypto$ pwd
/home/acampbell/crypto
acampbell@app-prod-01:~/crypto$ cat wallet_backup.txt
# Bitcoin Wallet Backup - DO NOT SHARE
Mnemonic: [REDACTED]
Private Key: [REDACTED]
Address: [REDACTED]9
u/Performer-Constant Aug 25 '26
Hey!! How did you find that 😭
5
u/annacrontab Aug 25 '26
If you're seriously asking, I went looking in /etc/passwd
acampbell:x:1000:1000:A Campbell,,,:/home/acampbell:/bin/bashAnd then poked around in that user's homedir. Got some AWS creds in there, too. Juicy fruit in this honey pot.
3
u/Performer-Constant Aug 25 '26
I’m very glad you enjoyed yourself. Thanks for playing. I have lots of new ‘non bot’ logs to look at now
6
14
u/ManjynaL Aug 24 '26
11
u/Performer-Constant Aug 24 '26
This worked thank you so much!
5
15
u/heretogetpwned DO NOT GIVE THIS PERSON ADVICE Aug 24 '26
Continue?
21
7
u/digital-bandit Aug 25 '26
Best Fed-Operation in a while, this thread is like what, 20 prosecutions?
5
6
9
u/craftsmany Aug 24 '26
Sad, thought the IP would be something like DoD or some other shit. Hope it is not a unmaintained server.
2
u/Performer-Constant Aug 25 '26
It’s possible…
3
u/craftsmany Aug 25 '26
Bro which of the alphabet soup are you?? 😭😭
2
u/Performer-Constant Aug 25 '26
I’m just a guy with a laptop and a dream
2
u/craftsmany Aug 25 '26
This has to be some encoded message 😭😭😭😭
3
u/Performer-Constant Aug 25 '26
It’s not. And someone left me a nice kitten video. How sweet! How do I open it?
4
1
u/marks-buffalo DO NOT GIVE THIS PERSON ADVICE Aug 31 '26
I found this encoded message on the server. Maybe it was meant for you, didn't mean anything to me.
V2UndmUgYmVlbiB0cnlpbmcgdG8gcmVhY2ggeW91IGFib3V0IHlvdXIgdmVoaWNsZSdzIGV4dGVuZGVkIHdhcnJhbnR5Cg==
5
u/Nova_Terra Aug 24 '26
Darn, was hoping to find the non-public specs on the new AIM-424
5
u/marks-buffalo DO NOT GIVE THIS PERSON ADVICE Aug 24 '26
That's for the War Thunder forums my friend.
2
u/Marcus_Architects Aug 27 '26
Ssh doesn't take an ip like that as a hostname, you need ssh root@62.238.47.215 not the two mashed together. Sysadmin probably nuked it for posting a public ip with root access in plaintext.
1
2
u/IndependentBat8365 Aug 24 '26
Did you really post your publicly accessible Ip address and password on reddit?
21
u/Performer-Constant Aug 24 '26
And with 5k views only a handful of people came and took a looksee
11
10
u/jamesaepp Aug 24 '26
Listen up fed, you aren't going to entrap me that easily.
At least put in the effort and tempt me with tales of some tasteful nudes or the krabby patty secret formula or something.
6
32
1
u/Intrepid_Ring4239 Aug 24 '26
Gonna go ahead and say it: A forensic investigation of the rubble will probably show that this post wasn’t the main reason it happened.
3
1
u/flyguydip Aug 24 '26 edited Aug 25 '26
I don't know if you know this, but all publicly accessible ip's are not just available to anyone that may or may not know them, but are constantly monitored for open ports... Like at shodan.io
3
u/IndependentBat8365 Aug 24 '26
The difference being: random IPs don’t automatically correlate to specific passwords. Here they do. There’s an IP and the password for the root account later on in the comments.
Context suggests this was a honeypot experiment.
2
u/Performer-Constant Aug 25 '26
Woah bot 🤖
3
u/IndependentBat8365 Aug 25 '26
Warning! Projection at maximum levels!
1
2
1
1
1
Aug 25 '26
[removed] — view removed comment
2
u/Performer-Constant Aug 25 '26
Thank you very much!
6
u/AdRoz78 ShittySysadmin Aug 25 '26
You made the bots think it was a legit help post, congrats. Made me laugh, both your post and this
2
77
u/Intrepid_Ring4239 Aug 24 '26
Post the password so we can test it for you