Honeypot SIP. Honeysip

Ссылки

!!! DON'T USE CLEAN PROJECT honeysip FROM GITHUB !!! USE MODIFIED PROJECT honeysip FROM THIS MANUAL

https://github.com/mushorg/honeysip

https://dionaea.readthedocs.io/en/latest/service/sip.html

Установка

yum install epel-release

yum install python3.6

Download Honeysip.zip. Copy "honeysip" directory from this archive to /opt/

nano /etc/systemd/system/honeysip.service

[Unit]
Description=A SIP honeypot service
After=network.target
[Service]
Restart=always
RestartSec=5
WorkingDirectory=/opt/honeysip
ExecStart=/usr/bin/python3.6 /opt/honeysip/run.py
#StandardOutput=syslog
#StandardError=syslog
[Install]
WantedBy=multi-user.target

systemctl daemon-reload

systemctl enable honeysip

systemctl restart honeysip

Testing

netstat -luptn

    ...
    udp 0 0 192.168.166.52:5060 0.0.0.0:* 932/python3.6
    ...

Try to connect any sip phone to host with this honeysip

cat /opt/honeysip/log/honeysip.log

    ...
    2021-07-23 11:41:13,936 - sip - DEBUG - SipSession __init__
    2021-07-23 11:41:13,937 - sip - INFO - SIP Session created with personality 'default'
    2021-07-23 11:41:57,242 - sip - DEBUG - <sip.SipSession object at 0x7f52bcec5ac8> handle
    2021-07-23 11:41:57,243 - sip - INFO - Received: REGISTER
    2021-07-23 11:41:57,244 - sip - DEBUG - <sip.SipSession object at 0x7f52bcec5ac8> handle_REGISTER
    2021-07-23 11:41:57,244 - sip - INFO - Creating Response: code=404, message=None
    2021-07-23 11:41:57,245 - sip - INFO - Can't parse or convert the URI.
    2021-07-23 11:41:57,245 - sip - INFO - Can't parse or convert the URI.
    2021-07-23 11:41:57,245 - sip - DEBUG - <sip.SipSession object at 0x7f52bcec5ac8> send
    2021-07-23 11:41:57,246 - sip - DEBUG - Sending message "b'SIP/2.0 404 Not Found\r\nCSeq: 1 REGISTER\r\nCall-ID: M2UxMWZjODE1MjNmY2Q4OTFlZmE3NjA4MTE1NGUxZjg.\r\nVia: SIP/2.0/UDP 192.168.17.7:50326;branch=z9hG4bK-d8754z-3a001a634162af24-1---d8754z-;rport\r\nFrom: "100" <*>;tag=75501f07\r\nTo: "100" <*>\r\nContact: sip:100@192.168.166.52:\xc4\x13\r\nAllow: REGISTER, INVITE, BYE, CANCEL, ACK, OPTIONS\r\nContent-Length: \x00\r\n\r\n'" to (192.168.17.7:50326)
    2021-07-23 11:41:57,246 - sip - DEBUG - io_in: returning 571
    2021-07-23 11:44:58,461 - sip - DEBUG - SipSession __init__
    2021-07-23 11:44:58,462 - sip - INFO - SIP Session created with personality 'default'
    ...