This is a simple program to log login attempts on Telnet (port 23).
It's designed to track the Mirai botnet. Right now (Oct 23, 2016) infected Mirai machines from around the world are trying to connect to Telnet on every IP address about once per minute. This program logs both which IP addresses are doing the attempts, and which passwords they are using.
I wrote it primarily because installing
telnetd on a Raspberry Pi wasn't sufficient.
For some reason, the Mirai botnet doesn't like the output from Telnet, and won't try
to login. So I needed something that produced the type of Telnet is was expecting. While
I was at it, I also wrote some code to parse things and extract the usernames/passwords.
Just run the program in order to see passwords and IP addresses appear on stdout.
To log the information to files, use the
telnetlogger -p passwds.txt -i ips.txt
To listen on another port (for testing and whatnot), use
telnetlogger -l 2323
Note that on many systems, you'll get an "access denied" error message, because programs
that open ports below 1024 need extra priveleges. So you may need to
sudo the program.
gcc telnetlogger.c -o telnetlogger -lpthread
It'll also compile/run on Windows.
There are two sample output files,
I generated by running this for the last day.
The program prints the username/password combination one line at a time.
admin 7ujMko0admin root root root 54321 root xmhdipc root root guest 12345 root 888888 root 123456 admin smcadmin
It doesn't filter duplicates. The easiest way to get rid of duplicates is
uniq the output.
sort passwords.txt | uniq
The IP addresses work the same way as the passwords, with one per line.
22.214.171.124 126.96.36.199 188.8.131.52 184.108.40.206 2001:db8:a0b:12f0::1 220.127.116.11 18.104.22.168 22.214.171.124 126.96.36.199
Note that IPv6 is supported. Also note that you'll get lots of duplicates,
so you'll be doing
uniq a lot in order to reduce the list size. The
duplicates will make it easier to count how often individual IP address's attempt
to connection. Thus, you can run the following:
sort ips.txt | uniq -c | sort -n
This produces results like:
69 188.8.131.52 75 184.108.40.206 90 220.127.116.11 94 18.104.22.168 120 22.214.171.124 168 126.96.36.199 169 188.8.131.52 414 184.108.40.206
This project can help you geo-locate the IPs, to see which country they are coming from.