Changeset 1286

Timestamp:

06/10/07 20:22:28 (1 year ago)

Author:

till

Message:

- Default port configuration can be set to "ignore", "normal" or "mirror"
- malloc(NULL) segfault bug in tftpDownload plugin fixed
- Try to download from the attacking host in case of failed ftp connect()s
- Reconfiguration on SIGHUP fixed

Files:

• honeytrap/trunk/ChangeLog (modified) (1 diff)
• honeytrap/trunk/configure.in (modified) (1 diff)
• honeytrap/trunk/etc/honeytrap.conf.dist (modified) (5 diffs)
• honeytrap/trunk/src/attack.c (modified) (2 diffs)
• honeytrap/trunk/src/conftree.c (modified) (1 diff)
• honeytrap/trunk/src/dynsrv.c (modified) (12 diffs)
• honeytrap/trunk/src/honeytrap.c (modified) (3 diffs)
• honeytrap/trunk/src/honeytrap.h (modified) (1 diff)
• honeytrap/trunk/src/modules/htm_SavePostgres.c (modified) (7 diffs)
• honeytrap/trunk/src/modules/htm_ftpDownload.c (modified) (2 diffs)
• honeytrap/trunk/src/modules/htm_tftpDownload.c (modified) (1 diff)
• honeytrap/trunk/src/nfqmon.c (modified) (1 diff)
• honeytrap/trunk/src/plugin.c (modified) (1 diff)
• honeytrap/trunk/src/readconf.c (modified) (10 diffs)
• honeytrap/trunk/src/readconf.h (modified) (1 diff)
• honeytrap/trunk/src/response.c (modified) (3 diffs)

honeytrap/trunk/ChangeLog

@@ -1 +1 @@
-Version 1.0.0
-- New configuration concept with hierarchically organized file format
+- Default port configuration can be set to "ignore", "normal" or "mirror"
-- New plugin: libclamav-based virus scanner module
-- New plugin: PostgreSQL module for commits into mwcollect database
-- New plugin: Saving attack data in files is performed by a module now
-New plugin: x86 CPU emulation module for generic shellcode analysis
-
+malloc(NULL) segfault bug in tftpDownload plugin fixed
+
-- Improved connection request handling in the nfq stream monitor
+- Reconfiguration on SIGHUP fixed
+Version 0.7.0
-- Plugins can be prioritized
-
+
+
+
+
+
+
-- FTP download plugin is now source-based routing safe
-- Changed autotools process to make module builts optional
-- Performance improvements
-Version 0.6.5
-- Introduced an nfnetlink_queue-based connection monitor

honeytrap/trunk/configure.in

@@ -560 +560 @@
-fi
-
-echo $with_ipq_mon, $sith_nfq_mon, $with_ipfw_mon, $with_pcap_mon
-
-
-AC_PROG_INSTALL

honeytrap/trunk/etc/honeytrap.conf.dist

@@ -2 +2 @@
- * honeytrap 1.0 configuration file template -- please adjust
- * (c) Tillmann Werner <tillmann.werner@gmx.de>
-
+ 
-
-/* log to this file */
@@ -11 +11 @@
-
-/* where to look for default responses
- 
+*
-response_dir    = "/opt/honeytrap/etc/honeytrap/responses"
-
-/* where to look for plugins
-   need to be set before loading plugins */
-plugin_dir      = "/opt/honeytrap/etc/honeytrap/plugins"
-
-/* run in mirror mode - mirror connections back to the initiator
- 
+*
-//mirror = "on"
-
-/* put network interface into promiscuous mode
- 
+*
-//promisc = "on"
-
-
+
+
-user    = "nobody"
-group   = "nogroup"
+
+// do not read more than 20 MB - used to prevent DoS attacks
+read_limit = "20971520"
-
-/* include a file */
@@ -35 +35 @@
-
-/* ----- plugin stuff below ----- */
+
+/* where to look for plugins
+   need to be set before loading plugins */
+plugin_dir      = "/opt/honeytrap/etc/honeytrap/plugins"
+
-
-/* include a plugin via plugin-[ModuleName] = "" */
@@ -47 +52 @@
-        attacks_dir     = "/opt/honeytrap/attacks"
-        downloads_dir   = "/opt/honeytrap/downloads"
+}
+
+/* scan downloaded samples with ClamAV engine */
+plugin-ClamAV = {
+        temp_dir        = "/tmp"
+        clamdb_path     = "/var/lib/clamav"
-}
-
@@ -62 +73 @@
-        db_user = "some_user"
-        db_pass = "some_pass"
-if not set, use the default (5432/tcp)
+defaults to 5432/tcp if not set
-}
-*/
-
-
-
+
+
+
+
+
+
+
+
+
-portconf = {
-        /* ignore these ports */

honeytrap/trunk/src/attack.c

@@ -1 @@
-dynsrv
-6
+attack
+7
- *
- * This file is free software; as a special exception the author gives
@@ -127 +127 @@
-        }
-
-(a->download[a->dl_count].dl_type = strdup(dl_type)) == NULL
-(a->download[a->dl_count].user = strdup(user)) == NULL
-(a->download[a->dl_count].pass = strdup(pass)) == NULL
-(a->download[a->dl_count].filename = strdup(filename)) == NULL
+dl_type && ((a->download[a->dl_count].dl_type = strdup(dl_type)) == NULL)
+filename && ((a->download[a->dl_count].filename = strdup(filename)) == NULL)
+user && ((a->download[a->dl_count].user = strdup(user)) == NULL)
+pass && ((a->download[a->dl_count].pass = strdup(pass)) == NULL)
-            ((a->download[a->dl_count].dl_payload.data = (u_char *) malloc(size)) == NULL)) { 
-                logmsg(LOG_ERR, 1, "Error - Unable to allocate memory: %s.\n", strerror(errno));

honeytrap/trunk/src/conftree.c

@@ -154 +154 @@
-        while (cur_node) {
-                /* compare current node's keyword with prefix */
-ncmp(cur_node->keyword, subkey, strlen(subkey)
+cmp(cur_node->keyword, subkey
-                        if ((subkey = strsep(key, ".")) == NULL) return(cur_node);
-                        cur_node = cur_node->first_leaf;

honeytrap/trunk/src/dynsrv.c

@@ -60 +60 @@
-        pid_t                   pid;
-        int                     listen_fd, mirror_sock_fd, proxy_sock_fd, connection_fd, disconnect,
-mirror_this, proxy_this, 
+
-#ifdef USE_IPQ_MON
-        int                     status;
@@ -86 +86 @@
-        mirror_sock_fd  = -1;
-        proxy_sock_fd   = -1;
-        proxy_this      = 0;
-        mirror_this     = mirror_mode;
-        established     = 0;
-PORTCONF_NONE
+portconf_default
-
-        if (!((proto == TCP) || (proto == UDP))) {
@@ -208 +206 @@
-                                                logmsg(LOG_DEBUG, 1,
-                                                       "   %s  Handling connection in normal mode.\n", portstr);
-                                                mirror_this = 0;
-                                                proxy_this = 0;
-                                        } else if (port_mode & PORTCONF_PROXY) {
-                                                /* get proxy server address for port */
@@ -249 +245 @@
-                                                               "== %s  Proxy connection rejected, falling back to normal mode.\n",
-                                                               portstr);
-proxy_this = 0
+       port_mode = PORTCONF_NORMAL
-                                                } else
-                                                        logmsg(LOG_NOTICE, 1,
@@ -256 +252 @@
-                                                               inet_ntoa(*(struct in_addr *) proxy_addr->
-                                                                         h_addr_list[0]), proxy_dst->port);
-(mirror_this) || (port_mode & PORTCONF_MIRROR)
+port_mode & PORTCONF_MIRROR
-                                                /* try to establish mirror connection back to the client */
-                                                logmsg(LOG_DEBUG, 1,
@@ -272 +268 @@
-                                                               "<> %s  Mirror connection rejected, falling back to normal mode.\n",
-                                                               portstr);
-mirror_this = 0
+       port_mode = PORTCONF_NORMAL
-                                                } else
-                                                        logmsg(LOG_NOTICE, 1,
@@ -363 +359 @@
-                                                        total_bytes = 0;
-
-(proxy_this) || (port_mode & PORTCONF_PROXY)
+port_mode & PORTCONF_PROXY
-                                                                logmsg(LOG_DEBUG, 1,
-                                                                       "   %s  Handling connection from %s:%u in proxy mode.\n",
@@ -378 +374 @@
-                                                                                          m_read_timeout,
-                                                                                          read_timeout, attack);
-
-
+
-                                                                logmsg(LOG_DEBUG, 1,
-                                                                       "   %s  Handling connection from %s:%u in mirror mode.\n",
@@ -408 +403 @@
-
-                                                } else if (pid == -1)
-
-
+
-                                                close(mirror_sock_fd);
-                                                close(connection_fd);
-                                                free(attack);
+                                                port_mode = portconf_default;
-                                        }       /* connection accepted */
-                                }       /* FD_ISSET - incoming connection */
@@ -481 +476 @@
-                                disconnect = 0;
-                                /* check if read limit was hit */
-bytes_read
+read_limit) if (total_bytes
-                                        /* read limit hit, process attack string */
-                                        logmsg(LOG_WARN, 1,
-Byte limit (%d
+Read limit (%d bytes
-                                               portstr, read_limit);
-                                        close(connection_fd);
@@ -570 +565 @@
-                                       logpre, portstr, bytes_sent, bytes_read, logact, inet_ntoa(ipaddr), sport);
-                                total_from_server += bytes_read;
-
+read_limit) if (
-                                        /* read limit hit, process attack string */
-                                        logmsg(LOG_WARN, 1,
-Byte limit (%d
+Read limit (%u bytes
-                                               logpre, portstr, read_limit, logact);
-                                        shutdown(server_sock_fd, SHUT_RDWR);
@@ -618 +613 @@
-                                       logpre, portstr, bytes_sent, bytes_read, inet_ntoa(ipaddr), dport);
-                                total_bytes += bytes_read;
-
+read_limit) if (
-                                        /* read limit hit, process attack string */
-                                        logmsg(LOG_WARN, 1,
-Byte limit (%d
+Read limit (%u bytes
-                                               logpre, portstr, read_limit, logact);
-                                        shutdown(server_sock_fd, SHUT_RDWR);

honeytrap/trunk/src/honeytrap.c

@@ -48 +48 @@
-        /* the following are default values - change them in your configuration file */
-        
-        mirror_mode     = 0;            /* mirror mode is not on by default */
-        daemonize       = 1;            /* default is to daemonize */
-
@@ -65 +64 @@
-        read_timeout    = 1;            /* 1 second read timeout */
-        m_read_timeout  = 60;           /* 1 minute read timeout for mirror connections */
-10485760;    /* read max. 10MB from attack connections
+0;           /* 0 means no read limit
-        
-        conffile_name   = strdup("/etc/honeytrap/honeytrap.conf");
@@ -77 +76 @@
-        packet_sniffer  = NULL; /* pcap device pointer */
-#endif
+
+        portconf_default = PORTCONF_NONE;
-
-

honeytrap/trunk/src/honeytrap.h

@@ -39 +39 @@
-// global variables regarding configuration
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-/* explicit port configurations */
+u_char  portconf_default;
+
-typedef struct sport_flag {
-        u_int8_t tcp;

honeytrap/trunk/src/modules/htm_SavePostgres.c

@@ -36 +36 @@
-#include <md5.h>
-#include <sha512.h>
-
+tcp
-
-#include "htm_SavePostgres.h"
@@ -203 +203 @@
-                return(NULL);
-        }
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-
@@ -214 +231 @@
-        strncat(uri, inet_ntoa(*(struct in_addr*)&download->r_addr), strlen(inet_ntoa(*(struct in_addr*)&download->r_addr)));
-
+        if (download->r_port) {
+                logmsg(LOG_NOISY, 1, "SavePostgre - Adding port to URI: %d\n", download->r_port);
+                if (snprintf(uri + strlen(uri), 7, ":%d/", download->r_port)
+                    >= MAX_URI_SIZE - strlen(uri)) {
+                        logmsg(LOG_ERR, 1, "  SavePostgres error - Unable to build URI: Port string too large.\n");
+                        return(NULL);
+                }
+                if (MAX_URI_SIZE - strlen(uri) < strlen(PROTO(download->protocol))) {
+                        logmsg(LOG_ERR, 1, "  SavePostgres error - Unable to build URI: Protocol string too large.\n");
+                        return(NULL);
+                }
+                strcat(uri + strlen(uri), PROTO(download->protocol));
+        }
+
-        if (download->filename) {
-                logmsg(LOG_NOISY, 1, "SavePostgres - Adding filename to URI: %s\n", download->filename);
-
-
-
-
-
-
-
+
+
+
+
+
-        }
-
@@ -259 +288 @@
-        /* upload malware */
-        if (attack->dl_count) {
+                logmsg(LOG_DEBUG, 1, "SavePostgres - Processing %d. sample.\n", attack->dl_count+1);
-                if ((query = malloc(MAX_SQL_BUFFER + 1)) == NULL) {
-                        logmsg(LOG_ERR, 1, "SavePostgres error - Unable to allocate memory: %s.\n", strerror(errno));
@@ -283 +313 @@
-                        logmsg(LOG_NOISY, 1, "SavePostgres - Malware sample exists in database, increasing counter.\n");
-                } else {
+                        logmsg(LOG_NOISY, 1, "SavePostgres - Malware sample does not exist in database, submitting it.\n");
-                        /* escape byte data to prevent sql injection */
-                        if ((esc_bytea = PQescapeByteaConn(db_connection, attack->download->dl_payload.data,
@@ -293 +324 @@
-                        }
-
-
-
-
-
+
+
-
-                        if (((l_ip = strdup(inet_ntoa(*(struct in_addr*)&(attack->a_conn.l_addr)))) == NULL) ||
@@ -312 +341 @@
-//                              "honeytrap-default",
-//                              "dynamic-generic",
-inet_ntoa(*(struct in_addr*)&(attack->a_conn.l_addr))
-inet_ntoa(*(struct in_addr*)&(attack->a_conn.r_addr))
+l_ip
+r_ip
-                                uri
-//                              attack->a_conn.l_port,

honeytrap/trunk/src/modules/htm_ftpDownload.c

@@ -16 +16 @@
- */
-
+#include <arpa/inet.h>
+#include <ctype.h>
+#include <errno.h>
+#include <netdb.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
-#include <unistd.h>
-#include <arpa/inet.h>
-#include <errno.h>
-#include <sys/stat.h>
-#include <netdb.h>
-#include <sys/socket.h>
-#include <ctype.h>
-
-#include <honeytrap.h>
@@ -347 +347 @@
-        control_socket.sin_port            = htons(port);
-        if (connect(control_sock_fd, (struct sockaddr *) &control_socket, sizeof(control_socket)) != 0) {
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-        logmsg(LOG_DEBUG, 1, "FTP download - Ftp control connection to %s:%d established.\n",

honeytrap/trunk/src/modules/htm_tftpDownload.c

@@ -180 +180 @@
-                logmsg(LOG_ERR, 1, "TFTP download error - Filename too long.\n");
-                return(-1);
+        }
+
+        /* 0.0.0.0 is an invalid ip address - set it to the attacker's address */
+        if (0 == *(u_int32_t *)host) {
+                logmsg(LOG_DEBUG, 1, "  TFTP download - TFTP server IP addres corrected to %s.\n", inet_ntoa(*host));
+                host = (struct in_addr *) &attack->a_conn.r_addr;
-        }
-

honeytrap/trunk/src/nfqmon.c

@@ -151 +151 @@
-        if (nfq_unbind_pf(h, AF_INET) < 0) {
-                logmsg(LOG_ERR, 1, "Error - Could not unbind existing NFQ handle: %s\n", strerror(errno));
+                logmsg(LOG_ERR, 1, "Do you have root privileges?\n");
-                clean_exit(EXIT_FAILURE);
-        }

honeytrap/trunk/src/plugin.c

@@ -38 +38 @@
-
-        if (strlen(plugname) > 265) {
-
-
+
+
+
+
+
+
+
+
-        }
-
-        if ((plugindir = opendir(dir)) == NULL) {
-                fprintf(stderr, "  Error - Unable to open plugin directory: %s.\n", strerror(errno));
-return(-1
+exit(EXIT_FAILURE
-        }
-        

honeytrap/trunk/src/readconf.c

@@ -47 +47 @@
-#endif
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-static const char *config_keywords[] = {
-        "logfile",
@@ -99 +54 @@
-        "response_dir",
-        "plugin_dir",
-mirror
+read_limit
-#ifdef USE_PCAP_MON
-        "promisc",
@@ -106 +61 @@
-        "group",
-        "include",
+        "portconf_default",
-        "portconf",
-        "portconf.ignore.protocol",
@@ -121 +77 @@
-};
-
+/* global config tree */
+struct lcfg *confkeys_tree;
+
+
+conf_node *process_conftree(conf_node *conftree, conf_node *tree, process_confopt_fn proc_opt, void *opt_data) {
+        conf_node       *cur_node = NULL;
+
+        if (!tree) return(NULL);
+
+        cur_node = tree;
+        while (cur_node) {
+                if (proc_opt(tree, cur_node, opt_data) == NULL) return(NULL);
+                if (cur_node->first_leaf) {
+                        // descend to subtree
+                        if ((cur_node = process_conftree(tree, cur_node->first_leaf, proc_opt, NULL)) == NULL) {
+                                fprintf(stderr, "  Error - Subtree processing failed.\n");
+                                return(NULL);
+                        } else return(cur_node);
+
+                        if (cur_node->next) cur_node = cur_node->next;
+                        else return(cur_node);
+                }
+                if (cur_node->next) cur_node = cur_node->next;
+                else return(cur_node);
+        }
+
+        return(cur_node);
+}
+
+
+enum lcfg_status check_conffile(const char *key, void *data, size_t len, void *tree) {
+        conf_node       *new_node;
+        char            *list_item;
+        
+
+        new_node        = NULL;
+        list_item       = NULL;
+
+        if ((new_node = add_keyword(&config_tree, key, data, len)) == NULL) {
+                fprintf(stderr, "Error - Unable to add configuration option to tree.\n");
+                return(lcfg_status_error);
+        }       
+
+        return(lcfg_status_ok);
+}
+
-
-int configure(int my_argc, char *my_argv[]) {
@@ -157 +159 @@
-        /* initialization of plugin hooks */
-        init_plugin_hooks();
-
-
-        /* scan command line options to determine logging level or print version number or usage */
-        while((option = getopt(my_argc, my_argv, OPTSTRING)) > 0) {
@@ -223 +223 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-#ifdef USE_PCAP_MON
-       
-       
-       
-       
-       
-       
-       
-       
-       
-       
-       
-       
+
+
+
+
+
+
+
+
+
+
+
+
-#endif
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-