Rob Graham created telnetlogger to:
This is a simple program to log login attempts on Telnet (port 23).
It’s designed to track the Mirai botnet. Right now (Oct 23, 2016) infected Mirai machines from around the world are trying to connect to Telnet on every IP address about once per minute. This program logs both which IP addresses are doing the attempts, and which passwords they are using.
I wrote it primarily because installing
telnetdon a Raspberry Pi wasn’t sufficient. For some reason, the Mirai botnet doesn’t like the output from Telnet, and won’t try to login. So I needed something that produced the type of Telnet is was expecting. While I was at it, I also wrote some code to parse things and extract the usernames/passwords.
…
Cool!
A handy, single purpose program that enables you to spy in Mirai botnets.
Rob has great notes on managing the output.
Perhaps you should publish the passwords you collect (internally) as fair warning to your users.
Or use them in an attempt to hack your own network, before someone else does.
Enjoy!
PS: It complies, etc., but even for the pleasure of spying on Mirai botnets, I’m not lowering my shields.