Pretty sure that was the point

Do not run a telnetd server at all.

Assuming that they took any of your files to begin with and you didn't discover the hidden prompt

Years ago on FreeBSD I created a "Volkswagen mode" by using the similar `imgact_binmisc` kernel module to register a handler for binaries with the system's native ELF headers. It took a bit of hacking to make it all work with the native architecture, but when it was done, the handler would simply execute the binary, drop its return code, and return 0 instead - effectively making the system think that every command was "successful"

The system failed to boot when I finally got it all working (which was expected) but it was a fun adventure to do something so pointless and silly.

It would be a similarly clever place to maintain persistence and transparently inject bytecode or do other rude things on FreeBSD as well

It can get especially interesting when you do things like have your GitHub runners onboard themselves to Tailscale - at that point you can pretty much fully-provision isolated systems directly from GitHub Actions if you want

Rewrite it in Rust. /s

https://x.com/i/grok/share/fWJnfZVWmRxoDK5E0uFhl7iC2

If I don't reply "stop" to anything, it seems like one day "Retired Democrats PAC" will suddenly stop sending me messages and "Save Democracy PAC" will suddenly begin, and that pattern is what makes me think a single group is behind a lot of it.

If I do reply "stop" to one, of course they will stop from that PAC, but a few days later another one will always pop up and pick right back up.

Every few days I send out a mass "stop" to all of the numbers I've gotten messaged by, and it usually gives me 3-4 days of peace.

(and before OpenSearch, the AWS-managed ElasticSearch absolutely hurt the ElasticSearch brand because of all of the issues Amazon created - it couldn't even rebalance shards, let alone add new nodes or switch to larger nodes without a blue-green deployment)

Makes me really happy to run across random unexpected things like that

Remote: Yes

Willing to relocate: Depends on location

Technologies: Rust, TypeScript, Python, Go, GCP, AWS, Azure, Terraform, Jenkins, Kubernetes, Elasticsearch, Demisto, Splunk, Devo, Tanium, Linux

Resume: https://spun.io/resume.pdf

Email: nick@spun.io

GitHub: https://github.com/DominoTree

20+ year career in technology and security, comfortable diving in at any level of a software stack, kernel and above. Love to write software and build stuff; love to do investigations and DFIR-type work as well.