---
title: Hunt: unusually long or all-"A" SSH passwords in front of internet-exposed sshd (SSHole) | ctxsec
url: https://ctxsec.com/items/hunt-sshole-long-or-repeated-char-ssh-passwords-isc-nov-8
description: "SANS ISC saw SSHole attempts as unusually long SSH passwords, with the first real exploit attempts on Nov 5 using an all-\"A\" password. If you have a sensor or a proxy that records password length, those are cheap things to look for. Standard sshd does not log passwords, so this mostly fits honeypots and SSH-aware proxies."
status: "hunt idea based on SANS ISC honeypot observations (Nov 8); not a vendor-published detection"
published: 2026-11-08
---

> SANS ISC saw SSHole attempts as unusually long SSH passwords, with the first real exploit attempts on Nov 5 using an all-"A" password. If you have a sensor or a proxy that records password length, those are cheap things to look for. Standard sshd does not log passwords, so this mostly fits honeypots and SSH-aware proxies.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-sshole-long-or-repeated-char-ssh-passwords-isc-nov-8.md)

hunt idea based on SANS ISC honeypot observations (Nov 8); not a vendor-published detection

2026-11-08

### Hunt: unusually long or all-"A" SSH passwords in front of internet-exposed sshd (SSHole)

- **Where it applies:** honeypots (Cowrie and similar), SSH proxies or bastions that record auth attempts. Stock sshd does not log the attempted password, so do not expect to find this in `auth.log`.
- **Query ideas:** auth attempts whose password is far longer than your normal brute-force wordlists (ISC's honeypots truncate at 255 characters); passwords made of one repeated character such as all "A"; shell commands pasted into a password field (a separate pattern ISC saw, often wget/curl followed by chmod).
- **Host-side follow-up on exposed Linux hosts:** sshd crashes or restarts around inbound connections, then new root sessions or unexpected processes started by sshd. See our earlier SSHole hunt and patch items for the Alpine/OpenSSH 10.6p2 details.
- **Caveat:** ISC says some long "passwords" were buggy scripts rather than exploits, so treat a hit as a lead to check, not proof of compromise.

Sources: [SANS ISC: Scans for Sshole Vulnerability (CVE-2026-123158) (Nov 8)](https://isc.sans.edu/diary/33498)