{"id":13795747,"url":"https://github.com/robertdavidgraham/telnetlogger","last_synced_at":"2025-08-23T19:44:03.876Z","repository":{"id":68279305,"uuid":"72310094","full_name":"robertdavidgraham/telnetlogger","owner":"robertdavidgraham","description":"Simulates enough of a Telnet connection in order to log failed login attempts.","archived":false,"fork":false,"pushed_at":"2017-03-05T04:55:15.000Z","size":39,"stargazers_count":238,"open_issues_count":6,"forks_count":62,"subscribers_count":21,"default_branch":"master","last_synced_at":"2024-11-10T02:01:07.496Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/robertdavidgraham.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-10-29T21:22:02.000Z","updated_at":"2024-11-03T12:09:25.000Z","dependencies_parsed_at":"2023-03-11T03:23:10.942Z","dependency_job_id":null,"html_url":"https://github.com/robertdavidgraham/telnetlogger","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robertdavidgraham%2Ftelnetlogger","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robertdavidgraham%2Ftelnetlogger/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robertdavidgraham%2Ftelnetlogger/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/robertdavidgraham%2Ftelnetlogger/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/robertdavidgraham","download_url":"https://codeload.github.com/robertdavidgraham/telnetlogger/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225110575,"owners_count":17422411,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T23:01:01.577Z","updated_at":"2024-11-18T01:05:11.252Z","avatar_url":"https://github.com/robertdavidgraham.png","language":"C","readme":"# telnetlogger\n\nThis is a simple program to log login attempts on Telnet (port 23).\n\nIt's designed to track the Mirai botnet. Right now (Oct 23, 2016) infected Mirai\nmachines from around the world are trying to connect to Telnet on every IP address about once\nper minute. This program logs both which IP addresses are doing the attempts, and which\npasswords they are using.\n\nI wrote it primarily because installing `telnetd` on a Raspberry Pi wasn't sufficient.\nFor some reason, the Mirai botnet doesn't like the output from Telnet, and won't try\nto login. So I needed something that produced the type of Telnet is was expecting. While\nI was at it, I also wrote some code to parse things and extract the usernames/passwords.\n\n# Usage\n\nJust run the program in order to see passwords and IP addresses appear on stdout.\n\n    telnetlogger\n  \nTo log the information to files, use the `-p` and `-i` options.\n\n    telnetlogger -p passwds.txt -i ips.txt\n  \nTo listen on another port (for testing and whatnot), use `-l`.\n\n    telnetlogger -l 2323\n\nNote that on many systems, you'll get an \"access denied\" error message, because programs\nthat open ports below 1024 need extra priveleges. So you may need to `sudo` the program.\n\n# Compiling\n\nType `make` or:\n\n    gcc telnetlogger.c -o telnetlogger -lpthread\n\nIt'll also compile/run on Windows.\n\n# Output\n\nThere are two sample output files, `passwords.txt` and `ips.txt` that\nI generated by running this for the last day.\n\nThe program prints the username/password combination one line at a time.\n\n    admin 7ujMko0admin\n    root root\n    root 54321\n    root xmhdipc\n    root root\n    guest 12345\n    root 888888\n    root 123456\n    admin smcadmin\n\nIt doesn't filter duplicates. The easiest way to get rid of duplicates is\njust to `sort`/`uniq` the output.\n\n    sort passwords.txt | uniq\n  \nThe IP addresses work the same way as the passwords, with one per line.\n\n    153.99.123.134\n    114.35.226.25\n    114.35.226.25\n    1.52.107.87\n    2001:db8:a0b:12f0::1\n    114.35.226.25\n    1.52.107.87\n    1.52.107.87\n    153.99.123.134\n  \nNote that IPv6 is supported. Also note that you'll get lots of duplicates, \nso you'll be doing `sort`/`uniq` a lot in order to reduce the list size. The\nduplicates will make it easier to count how often individual IP address's attempt\nto connection. Thus, you can run the following:\n\n    sort ips.txt | uniq -c | sort -n\n  \nThis produces results like:\n\n     69 187.136.91.145\n     75 79.115.23.228\n     90 178.220.226.25\n     94 153.99.123.134\n    120 171.83.163.1\n    168 111.73.37.102\n    169 122.96.31.201\n    414 119.121.165.137\n    \n# Geolocation\n\nThis project can help you geo-locate the IPs, to see which country\nthey are coming from.\n\n\thttps://github.com/danielmiessler/HoneyCredIPTracker\n\n  \n","funding_links":[],"categories":["\u003ca id=\"c8f749888134d57b5fb32382c78ef2d1\"\u003e\u003c/a\u003eSSH\u0026\u0026Telnet","Tools","Honeypots"],"sub_categories":["Satellite"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frobertdavidgraham%2Ftelnetlogger","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frobertdavidgraham%2Ftelnetlogger","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frobertdavidgraham%2Ftelnetlogger/lists"}