Honeypot SSH/Telnet. Сowrie
Ссылки
https://github.com/cowrie/cowrie
Установка
Зависимости
yum install git python36-virtualenv openssl-devel libffi-devel python3-devel python3
yum groupinstall 'Development Tools'
Cowrie
cd /opt/
git clone http://github.com/cowrie/cowrie
Добавляем пользователя и права
adduser cowrie
chown -R cowrie:cowrie /opt/cowrie
Разрешаем порты <1024 (22,23) для непривилегированных приложений (python)
yum localinstall -y https://s3.amazonaws.com/aaronsilber/public/authbind-2.1.1-0.1.x86_64.rpm
touch /etc/authbind/byport/22
chown cowrie:cowrie /etc/authbind/byport/22
chmod 770 /etc/authbind/byport/22
touch /etc/authbind/byport/23
chown cowrie:cowrie /etc/authbind/byport/23
chmod 770 /etc/authbind/byport/23
nano /opt/cowrie/etc/cowrie.cfg
[honeypot] hostname = server01 ...
nano /opt/cowrie/etc/userdb.txt
root:x:* tomcat:x:* oracle:x:* admin:x:*
VAR 1:
COWRIE MANUAL RUN FOR TEST
---
# su cowrie
su - cowrie
cd /opt/cowrie
# change cowrie-honeypot ssh, telnet ports to standart 22,23
nano /opt/cowrie/etc/cowrie.cfg
...
[telnet]
enabled = true
listen_endpoints = tcp:23:interface=0.0.0.0
[ssh]
listen_endpoints = tcp:22:interface=0.0.0.0
---
# create virtialenv
virtualenv-3 --python=python3 cowrie-env
# run virtenv
source cowrie-env/bin/activate
# install py deps
(cowrie-env) $ pip install --upgrade pip
(cowrie-env) $ pip install --upgrade -r requirements.txt
# run honeypot app
bin/cowrie start
VAR 2:
COWRIE AS SERVICE AND AUTOSTART
---
nano /opt/cowrie/etc/cowrie.cfg
...
[ssh]
listen_endpoints = systemd:domain=INET6:index=0
[telnet]
enabled = true
listen_endpoints = systemd:domain=INET6:index=1
---
nano /etc/systemd/system/cowrie.socket
---
[Unit]
Description=Cowrie SSH and Telnet honeypot socket
PartOf=cowrie.service
[Socket]
ListenStream=22
ListenStream=23
[Install]
WantedBy=sockets.target
---
nano /etc/systemd/system/cowrie.service
---
[Unit]
Description=A SSH and Telnet honeypot service
After=network.target
After=rsyslog.service
Requires=cowrie.socket
[Service]
User=cowrie
Group=cowrie
Restart=always
RestartSec=5
Environment=PYTHONPATH=/opt/cowrie/src
WorkingDirectory=/opt/cowrie
ExecStart=/opt/cowrie/cowrie-env/bin/python /opt/cowrie/cowrie-env/bin/twistd --umask 0022 --nodaemon --logger cowrie.python.logfile.logger --pidfile= -l - cowrie
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=cowrie
[Install]
WantedBy=multi-user.target
---
systemctl daemon-reload
systemctl enable cowrie
systemctl start cowrie
VAR 3:
# !!! OLD - DON'T USE !!!
# AUTOSTART AT BOOT
# CURVY, BUT IT WORKS
---
nano /opt/cowrie/cowrie_start.sh
---
#!/bin/bash
su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie start'"""
---
nano /opt/cowrie/cowrie_stop.sh
---
#!/bin/bash
su -m cowrie -c """/bin/bash -c 'cd /opt/cowrie/ && source cowrie-env/bin/activate && bin/cowrie stop'"""
---
nano /etc/systemd/system/cowrie.service
---
[Unit]
Description=cowrie
Requires=network.target
After=network.target
[Service]
WorkingDirectory=/opt/cowrie
ExecStart=/opt/cowrie/cowrie_start.sh
Type=forking
Restart=on-failure
RestartSec=60s
[Install]
WantedBy=multi-user.target
---
systemctl daemon-reload
systemctl enable cowrie
systemctl start cowrie
reboot
# TEST
# AT HONEYPOT HOST
netstat -luptn
...
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 18737/python3
tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN 18737/python3
...
# AT OTHER HOST
ssh root@<honeypot_host>
# AT HONEYPOT HOST
# session logs (json)
nano /opt/cowrie/var/log/cowrie/cowrie.log
nano /opt/cowrie/var/log/cowrie/cowrie.json
# play session binary record (COOL!)
python3.6 /opt/cowrie/bin/playlog /opt/cowrie/var/lib/cowrie/tty/e37915d299d57dd525db26f1af1a22b5450885d98408d9922a8d084f6e12b131