Failed, Then Success

Every morning, the MetroRide infrastructure team reviews the SSH log of their jump server. This morning the log looks noisy.

Someone is guessing passwords: many failed logins, then, for one address, a success. That pattern, failed attempts followed by a login, is the signature of a brute-force attack that worked.

What you are given: about 40 lines of auth.log, below. All users, hosts and addresses are fictional.

What to find: the attacker's IP address. It is the one that failed several times and then logged in successfully. Then build the flag exactly like this: the letters MXC, an opening brace, the IP with dots replaced by underscores, the text broke_in, the incident code below, and a closing brace.

Incident code: y0j9

Tip: count the failures per IP first. Most addresses fail once or twice and give up. One does not.

Log:

Oct 12 08:02:11 jump sshd[1201]: Accepted password for priya from 192.0.2.10 port 40112 ssh2
Oct 12 08:15:44 jump sshd[1217]: Failed password for invalid user admin from 198.51.100.23 port 51234 ssh2
Oct 12 08:15:47 jump sshd[1217]: Failed password for invalid user admin from 198.51.100.23 port 51234 ssh2
Oct 12 08:20:03 jump sshd[1220]: Accepted password for rahul from 198.51.100.44 port 33310 ssh2
Oct 12 08:31:29 jump sshd[1233]: Failed password for root from 192.0.2.78 port 60021 ssh2
Oct 12 08:44:52 jump sshd[1241]: Failed password for invalid user admin from 203.0.113.45 port 52211 ssh2
Oct 12 08:44:55 jump sshd[1241]: Failed password for invalid user admin from 203.0.113.45 port 52211 ssh2
Oct 12 08:44:58 jump sshd[1241]: Failed password for invalid user admin from 203.0.113.45 port 52211 ssh2
Oct 12 08:45:02 jump sshd[1241]: Failed password for root from 203.0.113.45 port 52211 ssh2
Oct 12 08:45:05 jump sshd[1241]: Failed password for root from 203.0.113.45 port 52211 ssh2
Oct 12 08:52:19 jump sshd[1250]: Failed password for invalid user test from 203.0.113.99 port 41002 ssh2
Oct 12 08:52:22 jump sshd[1250]: Failed password for invalid user test from 203.0.113.99 port 41002 ssh2
Oct 12 08:52:25 jump sshd[1250]: Failed password for invalid user test from 203.0.113.99 port 41002 ssh2
Oct 12 09:02:37 jump sshd[1261]: Accepted password for priya from 192.0.2.10 port 40113 ssh2
Oct 12 09:11:08 jump sshd[1270]: Failed password for invalid user guest from 198.51.100.23 port 51235 ssh2
Oct 12 09:14:56 jump sshd[1274]: Accepted password for deploy from 203.0.113.45 port 52211 ssh2
Oct 12 09:20:31 jump sshd[1281]: Failed password for invalid user admin from 192.0.2.78 port 60022 ssh2
Oct 12 09:26:44 jump sshd[1288]: Accepted password for rahul from 198.51.100.44 port 33311 ssh2
Oct 12 09:33:02 jump sshd[1295]: Failed password for invalid user oracle from 203.0.113.99 port 41003 ssh2
Oct 12 09:41:17 jump sshd[1302]: Failed password for invalid user admin from 198.51.100.23 port 51236 ssh2
Oct 12 09:55:40 jump sshd[1311]: Accepted password for priya from 192.0.2.10 port 40114 ssh2
Oct 12 10:04:23 jump sshd[1320]: Failed password for root from 192.0.2.78 port 60023 ssh2
Oct 12 10:12:09 jump sshd[1327]: Failed password for invalid user admin from 203.0.113.45 port 52212 ssh2
Oct 12 10:12:12 jump sshd[1327]: Failed password for invalid user admin from 203.0.113.45 port 52212 ssh2
Oct 12 10:19:55 jump sshd[1334]: Accepted password for deploy from 192.0.2.10 port 40115 ssh2
Oct 12 10:28:31 jump sshd[1341]: Failed password for invalid user test from 198.51.100.77 port 22011 ssh2
Oct 12 10:35:02 jump sshd[1348]: Failed password for invalid user admin from 203.0.113.45 port 52212 ssh2
Oct 12 10:47:18 jump sshd[1355]: Accepted password for priya from 192.0.2.10 port 40116 ssh2
Oct 12 10:53:44 jump sshd[1362]: Failed password for root from 198.51.100.77 port 22012 ssh2
Oct 12 11:02:27 jump sshd[1370]: Failed password for invalid user ubuntu from 203.0.113.45 port 52213 ssh2
Oct 12 11:02:30 jump sshd[1370]: Failed password for invalid user ubuntu from 203.0.113.45 port 52213 ssh2
Oct 12 11:15:59 jump sshd[1381]: Accepted password for rahul from 198.51.100.44 port 33312 ssh2
Oct 12 11:22:36 jump sshd[1388]: Failed password for invalid user admin from 192.0.2.200 port 31001 ssh2
Oct 12 11:30:14 jump sshd[1395]: Failed password for invalid user admin from 192.0.2.200 port 31001 ssh2
Oct 12 11:41:03 jump sshd[1402]: Accepted password for priya from 192.0.2.10 port 40117 ssh2
Oct 12 11:52:48 jump sshd[1410]: Failed password for invalid user postgres from 198.51.100.77 port 22013 ssh2
Oct 12 12:03:15 jump sshd[1419]: Failed password for root from 192.0.2.200 port 31002 ssh2
Oct 12 12:14:29 jump sshd[1426]: Accepted password for rahul from 198.51.100.44 port 33313 ssh2
Oct 12 12:26:51 jump sshd[1433]: Failed password for invalid user admin from 198.51.100.23 port 51237 ssh2
Oct 12 12:38:07 jump sshd[1440]: Accepted password for priya from 192.0.2.10 port 40118 ssh2

Submit the flag when you have it.