Honeypot SSH/Telnet. Сowrie

Ссылки

https://github.com/cowrie/cowrie

Установка

Зависимости

yum install git python36-virtualenv openssl-devel libffi-devel python3-devel python3

yum groupinstall 'Development Tools'

Cowrie

cd /opt/

git clone http://github.com/cowrie/cowrie

Добавляем пользователя и права

adduser cowrie

chown -R cowrie:cowrie /opt/cowrie

Разрешаем порты <1024 (22,23) для непривилегированных приложений (python)

yum localinstall -y https://s3.amazonaws.com/aaronsilber/public/authbind-2.1.1-0.1.x86_64.rpm

touch /etc/authbind/byport/22

chown cowrie:cowrie /etc/authbind/byport/22

chmod 770 /etc/authbind/byport/22

touch /etc/authbind/byport/23

chown cowrie:cowrie /etc/authbind/byport/23

chmod 770 /etc/authbind/byport/23

nano /opt/cowrie/etc/cowrie.cfg

[honeypot]
hostname = server01
...

nano /opt/cowrie/etc/userdb.txt

root:x:*
tomcat:x:*
oracle:x:*
admin:x:*

   VAR 1:

   COWRIE MANUAL RUN FOR TEST

   ---

   # su cowrie

   su - cowrie

   cd /opt/cowrie

   # change cowrie-honeypot ssh, telnet ports to standart 22,23

   nano /opt/cowrie/etc/cowrie.cfg

   ...    

   [telnet]

   enabled = true

   listen_endpoints = tcp:23:interface=0.0.0.0

   [ssh]

   listen_endpoints = tcp:22:interface=0.0.0.0

   ---

   # create virtialenv

   virtualenv-3 --python=python3 cowrie-env

   # run virtenv

   source cowrie-env/bin/activate

   # install py deps

   (cowrie-env) $ pip install --upgrade pip

   (cowrie-env) $ pip install --upgrade -r requirements.txt

   # run honeypot app

   bin/cowrie start

   

   VAR 2:

   COWRIE AS SERVICE AND AUTOSTART

   ---

   nano /opt/cowrie/etc/cowrie.cfg

   ...    

   [ssh]

   listen_endpoints = systemd:domain=INET6:index=0

   

   [telnet]

   enabled = true

   listen_endpoints = systemd:domain=INET6:index=1    

   ---

   

   nano /etc/systemd/system/cowrie.socket

   ---

   [Unit]

   Description=Cowrie SSH and Telnet honeypot socket

   PartOf=cowrie.service

   [Socket]

   ListenStream=22

   ListenStream=23

   [Install]

   WantedBy=sockets.target

   ---

   

   nano /etc/systemd/system/cowrie.service

   ---

   [Unit]

   Description=A SSH and Telnet honeypot service

   After=network.target

   After=rsyslog.service

   Requires=cowrie.socket

   [Service]

   User=cowrie

   Group=cowrie

   Restart=always

   RestartSec=5

   Environment=PYTHONPATH=/opt/cowrie/src

   WorkingDirectory=/opt/cowrie

   ExecStart=/opt/cowrie/cowrie-env/bin/python /opt/cowrie/cowrie-env/bin/twistd --umask 0022 --nodaemon --logger cowrie.python.logfile.logger --pidfile= -l - cowrie

   StandardOutput=syslog

   StandardError=syslog

   SyslogIdentifier=cowrie

   [Install]

   WantedBy=multi-user.target

   ---

       

   systemctl daemon-reload

   systemctl enable cowrie

   systemctl start cowrie

   

       VAR 3:

       # !!! OLD - DON'T USE !!!

       # AUTOSTART AT BOOT

       # CURVY, BUT IT WORKS

       ---

       nano /opt/cowrie/cowrie_start.sh

       ---

       #!/bin/bash

       su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie start'"""

       ---

       nano /opt/cowrie/cowrie_stop.sh

       ---

       #!/bin/bash

       su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie stop'"""

       ---

       nano /etc/systemd/system/cowrie.service

       ---

       [Unit]

       Description=cowrie

       Requires=network.target

       After=network.target

       [Service]

       WorkingDirectory=/opt/cowrie

       ExecStart=/opt/cowrie/cowrie_start.sh

       Type=forking

       Restart=on-failure

       RestartSec=60s

       [Install]

       WantedBy=multi-user.target

       ---

       systemctl daemon-reload

       systemctl enable cowrie

       systemctl start cowrie

       reboot

# TEST

# AT HONEYPOT HOST

netstat -luptn

   ...

   tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      18737/python3

   tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN      18737/python3

   ...

# AT OTHER HOST

   

ssh root@<honeypot_host>

# AT HONEYPOT HOST

# session logs (json)

nano /opt/cowrie/var/log/cowrie/cowrie.log

nano /opt/cowrie/var/log/cowrie/cowrie.json

# play session binary record (COOL!)

python3.6 /opt/cowrie/bin/playlog /opt/cowrie/var/lib/cowrie/tty/e37915d299d57dd525db26f1af1a22b5450885d98408d9922a8d084f6e12b131