Erinevus lehekülje "Honeyd" redaktsioonide vahel

Allikas: Kuutõrvaja
(→‎FreeBSD)
 
(ei näidata sama kasutaja 2 vahepealset redaktsiooni)
1. rida: 1. rida:
−
Startimine
 
−
 
−
honeyd -d -f honeyd.conf -l /tmp/logfile
 
−
 
−
Testimine nmapiga
 
−
 
−
nmap -p 135 192.168.134.147
 
−
 
 
===FreeBSD===
 
===FreeBSD===
  
38. rida: 30. rida:
 
  # '''honeyd -d -i nfe0 -f honey.conf'''
 
  # '''honeyd -d -i nfe0 -f honey.conf'''
 
  honeyd[5482]: listening promiscuously on nfe0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip )) and not ether src 00:17:31:dc:5d:b7
 
  honeyd[5482]: listening promiscuously on nfe0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip )) and not ether src 00:17:31:dc:5d:b7
 +
 +
Testimine nmapiga
 +
 +
nmap -p 135 192.168.134.147
 +
  
 
Manuaali leht mitmete näidetega http://www.manualpages.de/FreeBSD/FreeBSD-ports-9.0-RELEASE/man8/honeyd.8.html
 
Manuaali leht mitmete näidetega http://www.manualpages.de/FreeBSD/FreeBSD-ports-9.0-RELEASE/man8/honeyd.8.html
51. rida: 48. rida:
 
  #sudo route -n add -net 10.0.0.0/8 gw 127.0.0.1
 
  #sudo route -n add -net 10.0.0.0/8 gw 127.0.0.1
  
−
Ruutimine
 
−
 
−
# farpd 142.166.115.8/29
 
  
 
http://travisaltman.com/honeypot-honeyd-tutorial-part-2-multiple-honeypots/
 
http://travisaltman.com/honeypot-honeyd-tutorial-part-2-multiple-honeypots/
117. rida: 111. rida:
  
 
http://blogs.23.nu/disLEXia/2004/08/antville-4485/
 
http://blogs.23.nu/disLEXia/2004/08/antville-4485/
−
 
−
Scenario 1: FreeBSD router
 
−
 
−
I use the disc(art) interface to redirect traffic to my honeyd. All redirection to the honeyd can be archived by normal routing commands. First create a disc interface and put honeyd there.
 
−
 
−
% ifconfig disc0 create
 
−
% ifconfig disc0 172.31.255.255/32 #interface needs an private IP to be seen as an IP interface
 
−
% honeyd -i disc0
 
−
 
−
If I have only single IPs (eg a.b.c.130, .145 and .160) I can use host routes to redirect them to honeyd:
 
−
 
−
% route add -host a.b.c.130 -interface disc0
 
−
% route add -host a.b.c.145 -interface disc0
 
−
% route add -host a.b.c.160 -interface disc0
 
−
 
−
 
−
Now I just have to redirect traffic to the disc interface:
 
−
 
−
Lets assume the router carries the network a.b.c.128-255 which I want to use for honeynet purposes. Easy: just re-route it to disc0:
 
−
 
−
% route add -net a.b.c.128/27 -interface disc0
 
−
 
−
 
−
gateway_enable="YES"
 
−
 
−
annotate "AIX 4.0 - 4.2" fragment old
 
−
# Example of a simple host template and its binding
 
−
create template
 
−
set template personality "AIX 4.0 - 4.2"
 
−
add template tcp port 80 "sh scripts/web.sh"
 
−
add template tcp port 22 "sh scripts/test.sh $ipsrc $dport"
 
−
add template tcp port 23 proxy 10.23.1.2:23
 
−
set template default tcp action reset
 
−
 
−
bind 10.21.19.102 template
 
−
 
−
***
 
  
 
create windows
 
create windows
163. rida: 120. rida:
  
 
bind 193.40.0.10 windows
 
bind 193.40.0.10 windows
−
 
−
ymiseja# honeyd -f honeyd.conf -i disc0
 
−
Honeyd V1.5c Copyright (c) 2002-2007 Niels Provos
 
−
honeyd[56674]: started with -f honeyd.conf -i disc0
 
−
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
 
−
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
 
−
honeyd[56674]: listening on disc0: ip
 
−
Honeyd starting as background process
 
−
 
−
EVENT_NOKQUEUE to yes"
 
−
 
−
Sep 27 12:21:38 ymiseja honeyd[56675]: Kqueue does not recognize bpf filedescriptor.
 
−
 
−
 
−
export EVENT_NOKQUEUE=yes to .profile
 
−
 
  
 
  create template
 
  create template

Viimane redaktsioon: 22. detsember 2013, kell 21:40

FreeBSD

FreeBSD masinas paigaldatakse honeyd pordi installimise järel järgnevad failid 

/usr/local/lib/honeyd/libhoneyd.so
/usr/local/share/honeyd/proxy
/usr/local/bin/honeyd
/usr/local/share/honeyd/smtp
/usr/local/bin/honeydstats

Meil on serveri väline aadress 193.40.41.32 ning tekitame virtuaalse windowsi masina 193.40.41.34 aadressiga. 

create default
set default default tcp action block
set default default udp action block
set default default icmp action block

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action reset
add windows tcp port 135 open
add windows tcp port 139 open
add windows tcp port 445 open

set windows ethernet "00:00:24:ab:8c:12"
bind 193.40.41.34 windows

Ja käivitame selle 

# honeyd -d -i nfe0 -f honey.conf
honeyd[5482]: listening promiscuously on nfe0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip )) and not ether src 00:17:31:dc:5d:b7

Testimine nmapiga 

nmap -p 135 192.168.134.147


Manuaali leht mitmete näidetega http://www.manualpages.de/FreeBSD/FreeBSD-ports-9.0-RELEASE/man8/honeyd.8.html 

create default
set default personality "Linux 2.2.14"
set default tcp action block
add default udp port 53 "./scripts/dnstool.py"

Lokaalne testimine 

#sudo ./honeyd -f config.sample 10.0.0.0/8
#sudo route -n add -net 10.0.0.0/8 gw 127.0.0.1


http://travisaltman.com/honeypot-honeyd-tutorial-part-2-multiple-honeypots/

Windows XP koos uue MAC aadressi ja dhcp küsimisega. 

create default
set default default tcp action block
set default default udp action block
set default default icmp action block

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action reset
add windows tcp port 135 open
add windows tcp port 139 open
add windows tcp port 445 open

set windows ethernet "00:00:24:ab:8c:12"
dhcp windows on eth1 # väline seade

Käivitamiseks 

# honeyd -d -i eth1 -f honeyd-winxp.conf

Veel üks masin 

create default
set default default tcp action block
set default default udp action block
set default default icmp action block

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action reset
add windows tcp port 135 open
add windows tcp port 139 open
add windows tcp port 445 open

create avaya
set avaya personality "Avaya G3 PBX version 8.3"
set avaya default tcp action reset
add avaya tcp port 4445 open
add avaya tcp port 5038 open

create solaris set solaris personality "Avaya G3 PBX version 8.3" set solaris default tcp action reset add solaris tcp port 22 open add solaris tcp port 2049 open

set windows ethernet "00:00:24:ab:8c:12" set avaya ethernet "00:00:24:ab:8c:13" set solaris ethernet "00:00:24:ab:8c:14" dhcp windows on eth1 dhcp avaya on eth1 dhcp solaris on eth1 

honeyd -d -f honeyd.conf

nmap -p 4445,5038,5555 192.168.99.160


http://blogs.23.nu/disLEXia/2004/08/antville-4485/

create windows set windows personality "Microsoft Windows XP Professional SP1" set windows default tcp action reset add windows tcp port 135 open add windows tcp port 139 open add windows tcp port 445 open

bind 193.40.0.10 windows 

create template

set template personality "Linux kernel 2.4.23 (x86)"     # Honeypot signature
set template uptime 0428938                              # Set uptime
 
add template tcp port 21 "sh /usr/share/honeyd/ftp.sh"   # Add the template
 
set template default tcp action block                    # Block other TCP ports
set template default udp action block                    # Block other UDP ports


create template
set template personality "Microsoft Windows 2000 Advanced Server SP3"
add template tcp port 80 "sh /usr/share/honeyd/scripts/win2k/iis.sh"
bind 145.18.57.13 template
In the other con?g, e.g. /etc/honeyd/honeyd2.conf the apache con?guration

create template
set template personality "Linux kernel 2.4.18 (x86)"
add template tcp port 80 "sh /usr/share/honeyd/scripts/suse7.0/apache.sh"
bind 145.18.57.13 template
Pärit leheküljelt "https://kuutorvaja.eenet.ee/w/index.php?title=Honeyd&oldid=28072"