Honeypot SSH/Telnet. Сowrie: различия между версиями

Материал из Wiki
Перейти к навигации Перейти к поиску
(Новая страница: «Категория:Honeypot»)
 
Строка 1: Строка 1:
[[Категория:Honeypot]]
[[Категория:Honeypot]]
== Ссылки ==
https://github.com/cowrie/cowrie
== Установка ==
Зависимости
<code>yum install git python36-virtualenv openssl-devel libffi-devel python3-devel python3</code>
<code>yum groupinstall 'Development Tools'</code>
Cowrie
<code>cd /opt/</code>
<code>git clone <nowiki>http://github.com/cowrie/cowrie</nowiki></code>
Добавляем пользователя и права
<code>adduser cowrie</code>
<code>chown -R cowrie:cowrie /opt/cowrie</code>
Разрешаем порты <1024 (22,23) для непривилегированных приложений (python)
<code>yum localinstall -y <nowiki>https://s3.amazonaws.com/aaronsilber/public/authbind-2.1.1-0.1.x86_64.rpm</nowiki></code>
<code>touch /etc/authbind/byport/22</code>
<code>chown cowrie:cowrie /etc/authbind/byport/22</code>
<code>chmod 770 /etc/authbind/byport/22</code>
<code>touch /etc/authbind/byport/23</code>
<code>chown cowrie:cowrie /etc/authbind/byport/23</code>
<code>chmod 770 /etc/authbind/byport/23</code>
<code>nano /opt/cowrie/etc/cowrie.cfg</code>
[honeypot]
hostname = server01
...
<code>nano /opt/cowrie/etc/userdb.txt</code>
root:x:*
tomcat:x:*
oracle:x:*
admin:x:*
   VAR 1:
   COWRIE MANUAL RUN FOR TEST
   ---
   # su cowrie
   su - cowrie
   cd /opt/cowrie
   # change cowrie-honeypot ssh, telnet ports to standart 22,23
   nano /opt/cowrie/etc/cowrie.cfg
   ...    
   [telnet]
   enabled = true
   listen_endpoints = tcp:23:interface=0.0.0.0
   [ssh]
   listen_endpoints = tcp:22:interface=0.0.0.0
   ---
   # create virtialenv
   virtualenv-3 --python=python3 cowrie-env
   # run virtenv
   source cowrie-env/bin/activate
   # install py deps
   (cowrie-env) $ pip install --upgrade pip
   (cowrie-env) $ pip install --upgrade -r requirements.txt
   # run honeypot app
   bin/cowrie start
   
   VAR 2:
   COWRIE AS SERVICE AND AUTOSTART
   ---
   nano /opt/cowrie/etc/cowrie.cfg
   ...    
   [ssh]
   listen_endpoints = systemd:domain=INET6:index=0
   
   [telnet]
   enabled = true
   listen_endpoints = systemd:domain=INET6:index=1    
   ---
   
   nano /etc/systemd/system/cowrie.socket
   ---
   [Unit]
   Description=Cowrie SSH and Telnet honeypot socket
   PartOf=cowrie.service
   [Socket]
   ListenStream=22
   ListenStream=23
   [Install]
   WantedBy=sockets.target
   ---
   
   nano /etc/systemd/system/cowrie.service
   ---
   [Unit]
   Description=A SSH and Telnet honeypot service
   After=network.target
   After=rsyslog.service
   Requires=cowrie.socket
   [Service]
   User=cowrie
   Group=cowrie
   Restart=always
   RestartSec=5
   Environment=PYTHONPATH=/opt/cowrie/src
   WorkingDirectory=/opt/cowrie
   ExecStart=/opt/cowrie/cowrie-env/bin/python /opt/cowrie/cowrie-env/bin/twistd --umask 0022 --nodaemon --logger cowrie.python.logfile.logger --pidfile= -l - cowrie
   StandardOutput=syslog
   StandardError=syslog
   SyslogIdentifier=cowrie
   [Install]
   WantedBy=multi-user.target
   ---
       
   systemctl daemon-reload
   systemctl enable cowrie
   systemctl start cowrie
   
       VAR 3:
       # !!! OLD - DON'T USE !!!
       # AUTOSTART AT BOOT
       # CURVY, BUT IT WORKS
       ---
       nano /opt/cowrie/cowrie_start.sh
       ---
       #!/bin/bash
       su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie start'"""
       ---
       nano /opt/cowrie/cowrie_stop.sh
       ---
       #!/bin/bash
       su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie stop'"""
       ---
       nano /etc/systemd/system/cowrie.service
       ---
       [Unit]
       Description=cowrie
       Requires=network.target
       After=network.target
       [Service]
       WorkingDirectory=/opt/cowrie
       ExecStart=/opt/cowrie/cowrie_start.sh
       Type=forking
       Restart=on-failure
       RestartSec=60s
       [Install]
       WantedBy=multi-user.target
       ---
       systemctl daemon-reload
       systemctl enable cowrie
       systemctl start cowrie
       reboot
<nowiki>#</nowiki> TEST
<nowiki>#</nowiki> AT HONEYPOT HOST
netstat -luptn
   ...
   tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      18737/python3
   tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN      18737/python3
   ...
<nowiki>#</nowiki> AT OTHER HOST
   
ssh root@<honeypot_host>
<nowiki>#</nowiki> AT HONEYPOT HOST
<nowiki>#</nowiki> session logs (json)
nano /opt/cowrie/var/log/cowrie/cowrie.log
nano /opt/cowrie/var/log/cowrie/cowrie.json
<nowiki>#</nowiki> play session binary record (COOL!)
python3.6 /opt/cowrie/bin/playlog /opt/cowrie/var/lib/cowrie/tty/e37915d299d57dd525db26f1af1a22b5450885d98408d9922a8d084f6e12b131

Версия 12:20, 8 января 2022


Ссылки

https://github.com/cowrie/cowrie

Установка

Зависимости

yum install git python36-virtualenv openssl-devel libffi-devel python3-devel python3

yum groupinstall 'Development Tools'

Cowrie

cd /opt/

git clone http://github.com/cowrie/cowrie

Добавляем пользователя и права

adduser cowrie

chown -R cowrie:cowrie /opt/cowrie

Разрешаем порты <1024 (22,23) для непривилегированных приложений (python)

yum localinstall -y https://s3.amazonaws.com/aaronsilber/public/authbind-2.1.1-0.1.x86_64.rpm

touch /etc/authbind/byport/22

chown cowrie:cowrie /etc/authbind/byport/22

chmod 770 /etc/authbind/byport/22

touch /etc/authbind/byport/23

chown cowrie:cowrie /etc/authbind/byport/23

chmod 770 /etc/authbind/byport/23

nano /opt/cowrie/etc/cowrie.cfg 

[honeypot]
hostname = server01
...

nano /opt/cowrie/etc/userdb.txt 

root:x:*
tomcat:x:*
oracle:x:*
admin:x:*

   VAR 1:

   COWRIE MANUAL RUN FOR TEST

   ---

   # su cowrie

   su - cowrie

   cd /opt/cowrie

   # change cowrie-honeypot ssh, telnet ports to standart 22,23

   nano /opt/cowrie/etc/cowrie.cfg

   ...    

   [telnet]

   enabled = true

   listen_endpoints = tcp:23:interface=0.0.0.0

   [ssh]

   listen_endpoints = tcp:22:interface=0.0.0.0

   ---

   # create virtialenv

   virtualenv-3 --python=python3 cowrie-env

   # run virtenv

   source cowrie-env/bin/activate

   # install py deps

   (cowrie-env) $ pip install --upgrade pip

   (cowrie-env) $ pip install --upgrade -r requirements.txt

   # run honeypot app

   bin/cowrie start

   

   VAR 2:

   COWRIE AS SERVICE AND AUTOSTART

   ---

   nano /opt/cowrie/etc/cowrie.cfg

   ...    

   [ssh]

   listen_endpoints = systemd:domain=INET6:index=0

   

   [telnet]

   enabled = true

   listen_endpoints = systemd:domain=INET6:index=1    

   ---

   

   nano /etc/systemd/system/cowrie.socket

   ---

   [Unit]

   Description=Cowrie SSH and Telnet honeypot socket

   PartOf=cowrie.service

   [Socket]

   ListenStream=22

   ListenStream=23

   [Install]

   WantedBy=sockets.target

   ---

   

   nano /etc/systemd/system/cowrie.service

   ---

   [Unit]

   Description=A SSH and Telnet honeypot service

   After=network.target

   After=rsyslog.service

   Requires=cowrie.socket

   [Service]

   User=cowrie

   Group=cowrie

   Restart=always

   RestartSec=5

   Environment=PYTHONPATH=/opt/cowrie/src

   WorkingDirectory=/opt/cowrie

   ExecStart=/opt/cowrie/cowrie-env/bin/python /opt/cowrie/cowrie-env/bin/twistd --umask 0022 --nodaemon --logger cowrie.python.logfile.logger --pidfile= -l - cowrie

   StandardOutput=syslog

   StandardError=syslog

   SyslogIdentifier=cowrie

   [Install]

   WantedBy=multi-user.target

   ---

       

   systemctl daemon-reload

   systemctl enable cowrie

   systemctl start cowrie

   

       VAR 3:

       # !!! OLD - DON'T USE !!!

       # AUTOSTART AT BOOT

       # CURVY, BUT IT WORKS

       ---

       nano /opt/cowrie/cowrie_start.sh

       ---

       #!/bin/bash

       su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie start'"""

       ---

       nano /opt/cowrie/cowrie_stop.sh

       ---

       #!/bin/bash

       su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie stop'"""

       ---

       nano /etc/systemd/system/cowrie.service

       ---

       [Unit]

       Description=cowrie

       Requires=network.target

       After=network.target

       [Service]

       WorkingDirectory=/opt/cowrie

       ExecStart=/opt/cowrie/cowrie_start.sh

       Type=forking

       Restart=on-failure

       RestartSec=60s

       [Install]

       WantedBy=multi-user.target

       ---

       systemctl daemon-reload

       systemctl enable cowrie

       systemctl start cowrie

       reboot

# TEST

# AT HONEYPOT HOST

netstat -luptn

   ...

   tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      18737/python3

   tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN      18737/python3

   ...

# AT OTHER HOST

   

ssh root@<honeypot_host>

# AT HONEYPOT HOST

# session logs (json)

nano /opt/cowrie/var/log/cowrie/cowrie.log

nano /opt/cowrie/var/log/cowrie/cowrie.json

# play session binary record (COOL!)

python3.6 /opt/cowrie/bin/playlog /opt/cowrie/var/lib/cowrie/tty/e37915d299d57dd525db26f1af1a22b5450885d98408d9922a8d084f6e12b131

Источник — https://wiki.cless.pro/index.php?title=Honeypot_SSH/Telnet._Сowrie&oldid=413