Lehekülje Honeyd lähteteksti vaatamine

Startimine

 honeyd -d -f honeyd.conf -l /tmp/logfile

===FreeBSD===

FreeBSD masinas paigaldatakse honeyd pordi installimise järel järgnevad failid

 /usr/local/lib/honeyd/libhoneyd.so
 /usr/local/share/honeyd/proxy
 /usr/local/bin/honeyd
 /usr/local/share/honeyd/smtp
 /usr/local/bin/honeydstats

Meil on serveri väline aadress 193.40.41.32 ning tekitame virtuaalse windowsi masina 193.40.41.34 aadressiga.

 create default
 set default default tcp action block
 set default default udp action block
 set default default icmp action block
 
 create windows
 set windows personality "Microsoft Windows XP Professional SP1"
 set windows default tcp action reset
 add windows tcp port 135 open
 add windows tcp port 139 open
 add windows tcp port 445 open
 
 set windows ethernet "00:00:24:ab:8c:12"
 bind 193.40.41.34 windows

Ja käivitame selle

 # '''honeyd -d -i nfe0 -f honey.conf'''
 honeyd[5482]: listening promiscuously on nfe0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip )) and not ether src 00:17:31:dc:5d:b7

Testimine nmapiga

 nmap -p 135 192.168.134.147


Manuaali leht mitmete näidetega http://www.manualpages.de/FreeBSD/FreeBSD-ports-9.0-RELEASE/man8/honeyd.8.html

 create default
 set default personality "Linux 2.2.14"
 set default tcp action block
 add default udp port 53 "./scripts/dnstool.py"

Lokaalne testimine

 #sudo ./honeyd -f config.sample 10.0.0.0/8
 #sudo route -n add -net 10.0.0.0/8 gw 127.0.0.1

Ruutimine

 # farpd 142.166.115.8/29

http://travisaltman.com/honeypot-honeyd-tutorial-part-2-multiple-honeypots/

Windows XP koos uue MAC aadressi ja dhcp küsimisega.

 create default
 set default default tcp action block
 set default default udp action block
 set default default icmp action block
 
 create windows
 set windows personality "Microsoft Windows XP Professional SP1"
 set windows default tcp action reset
 add windows tcp port 135 open
 add windows tcp port 139 open
 add windows tcp port 445 open
 
 set windows ethernet "00:00:24:ab:8c:12"
 dhcp windows on eth1 # väline seade

Käivitamiseks

 # honeyd -d -i eth1 -f honeyd-winxp.conf

Veel üks masin

 create default
 set default default tcp action block
 set default default udp action block
 set default default icmp action block

 create windows
 set windows personality "Microsoft Windows XP Professional SP1"
 set windows default tcp action reset
 add windows tcp port 135 open
 add windows tcp port 139 open
 add windows tcp port 445 open

 create avaya
 set avaya personality "Avaya G3 PBX version 8.3"
 set avaya default tcp action reset
 add avaya tcp port 4445 open
 add avaya tcp port 5038 open

create solaris
set solaris personality "Avaya G3 PBX version 8.3"
set solaris default tcp action reset
add solaris tcp port 22 open
add solaris tcp port 2049 open

set windows ethernet "00:00:24:ab:8c:12"
set avaya ethernet "00:00:24:ab:8c:13"
set solaris ethernet "00:00:24:ab:8c:14"
dhcp windows on eth1
dhcp avaya on eth1
dhcp solaris on eth1

 honeyd -d -f honeyd.conf

 nmap -p 4445,5038,5555 192.168.99.160


http://blogs.23.nu/disLEXia/2004/08/antville-4485/

Scenario 1: FreeBSD router

I use the disc(art) interface to redirect traffic to my honeyd. All redirection to the honeyd can be archived by normal routing commands. First create a disc interface and put honeyd there.

% ifconfig disc0 create
% ifconfig disc0 172.31.255.255/32 #interface needs an private IP to be seen as an IP interface
% honeyd -i disc0

If I have only single IPs (eg a.b.c.130, .145 and .160) I can use host routes to redirect them to honeyd:

% route add -host a.b.c.130 -interface disc0
% route add -host a.b.c.145 -interface disc0
% route add -host a.b.c.160 -interface disc0


Now I just have to redirect traffic to the disc interface:

Lets assume the router carries the network a.b.c.128-255 which I want to use for honeynet purposes. Easy: just re-route it to disc0:

% route add -net a.b.c.128/27 -interface disc0


 gateway_enable="YES"

annotate "AIX 4.0 - 4.2" fragment old
# Example of a simple host template and its binding
create template
set template personality "AIX 4.0 - 4.2"
add template tcp port 80 "sh scripts/web.sh"
add template tcp port 22 "sh scripts/test.sh $ipsrc $dport"
add template tcp port 23 proxy 10.23.1.2:23
set template default tcp action reset

bind 10.21.19.102 template

***

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action reset
add windows tcp port 135 open
add windows tcp port 139 open
add windows tcp port 445 open

bind 193.40.0.10 windows

ymiseja# honeyd -f honeyd.conf -i disc0
Honeyd V1.5c Copyright (c) 2002-2007 Niels Provos
honeyd[56674]: started with -f honeyd.conf -i disc0
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
honeyd[56674]: listening on disc0: ip 
Honeyd starting as background process

EVENT_NOKQUEUE to yes"

Sep 27 12:21:38 ymiseja honeyd[56675]: Kqueue does not recognize bpf filedescriptor.


export EVENT_NOKQUEUE=yes to .profile


 create template
 
 set template personality "Linux kernel 2.4.23 (x86)"     # Honeypot signature
 set template uptime 0428938                              # Set uptime
  
 add template tcp port 21 "sh /usr/share/honeyd/ftp.sh"   # Add the template
  
 set template default tcp action block                    # Block other TCP ports
 set template default udp action block                    # Block other UDP ports
 

 create template
 set template personality "Microsoft Windows 2000 Advanced Server SP3"
 add template tcp port 80 "sh /usr/share/honeyd/scripts/win2k/iis.sh"
 bind 145.18.57.13 template
 In the other con?g, e.g. /etc/honeyd/honeyd2.conf the apache con?guration
 
 create template
 set template personality "Linux kernel 2.4.18 (x86)"
 add template tcp port 80 "sh /usr/share/honeyd/scripts/suse7.0/apache.sh"
 bind 145.18.57.13 template