Changeset 1425

Show
Ignore:
Timestamp:
10/27/07 13:09:48 (10 months ago)
Author:
till
Message:

honeytrap
- weekend cleaning

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • honeytrap/trunk/ChangeLog

    r1409 r1425  
    11Version 1.0.0 
    22- Improved configure script 
    3 - Basic http download wrapper plugin added 
     3- New plugin: Basic http download wrapper 
    44- VNC plugin redesigned to generate virtual attacks 
    55- Safe signal delivery and handling using per-process pipes 
    …… 
    1616- Plugins can be prioritized 
    1717- x86 CPU emulation module for generic shellcode analysis 
    18   based on libemu by Markus and Paul 
     18  based on libemu by Markus and Paul (unstable) 
    1919- PostgreSQL module for commits into mwcollect database 
    2020- SHA512 hash support 

  • honeytrap/trunk/INSTALL

    r1249 r1425  
    99 
    1010   The `configure' shell script must be told which connection monitor 
    11 should be used by honeytrap to monitor network interfaces for incoming 
     11to use in honeytrap to monitor network interfaces for incoming 
    1212connection requests. Currently the following options are possible: 
    1313 
    14    --with-nfq-mon     monitoring via libnetfilter_queue 
    15                         (Linux only, recommended) 
    16  
    17    --with-ipq-mon     monitoring via netfilter/iptables ip_queue 
    18                         (Linux only) 
    19  
    20    --with-pcap-mon    monitoring with a PCAP-based sniffer 
     14   --with-stream-mon=nfq      monitoring via libnetfilter_queue 
     15                               (Linux only, recommended) 
     16 
     17   --with-stream-mon=ipq      monitoring via netfilter/iptables ip_queue 
     18                               (Linux only) 
     19 
     20   --with-stream-mon=pcap     monitoring with a PCAP-based sniffer 
    2121 
    2222To build additional plugins use the --with-[pluginname] options. 
     23`configure --help' gives a full list of available options. 
     24 
     25After the configure step a `make' compiles the code. Finally `make 
     26install' puts all needed files in the correct places. 
    2327 
    2428Please refer to the generic installation instructions below for further 

  • honeytrap/trunk/README

    r1270 r1425  
    2424INSTALLATION 
    2525 
    26   Installation of honeytrap should be pretty straight forward. Just 
    27   do  a  './configure  --with-<type>-mon  &&  make && make install' 
     26  Installation of honeytrap is  pretty straight forward.  Just do a 
     27  './configure  --with-stream-mon=<type> &&  make && make install' 
    2828  where '<type>' is the connection monitor  type  of  your  choice. 
    2929  Please  refer to the INSTALL file and to the output of './config- 

  • honeytrap/trunk/configure.in

    r1409 r1425  
    6868 
    6969bold () { 
    70         text=`echo $seo "$1" | sed -e "s/%B/${term_bold}/g" -e "s/%b/${term_norm}/g" 2>/dev/null` 
    71         echo $seo "$text" 
     70        text=`echo -e "$1" | sed -e "s/%B/${term_bold}/g" -e "s/%b/${term_norm}/g" 2>/dev/null` 
     71        echo "$text" 
    7272} 
    7373 
    …… 
    9696          enable_profile="X" 
    9797        ], enable_profile=" ") 
     98AC_ARG_ENABLE(devmodules, 
     99[  --enable-devmodules     enable unstable modules (not recommended for production setups)], 
     100                [ if test -n "$GCC"; then 
     101                    CFLAGS="-O0 -DDEBUG -g" 
     102                  else 
     103                    CFLAGS="$CFLAGS -DDEBUG" 
     104                  fi       
     105                  enable_devmodules="X" 
     106                ], enable_devmodules=" ") 
     107 
    98108 
    99109#AC_CANONICAL_HOST 
    …… 
    293303                        bold "   %BError%b - libpcap headers not found. Install them or use the following options:" 
    294304                        echo 
    295                         bold "   %B--with-libpcap-includes=%b[location of libpcap header files]" 
     305                        bold "   %B--with-libpcap-includes=%b\133location of libpcap header files\135" 
    296306                        echo 
    297307                        exit 1 
    …… 
    307317                        bold "   %BError%b - libpcap library not found. Install it or use the following options:" 
    308318                        echo 
    309                         bold "   %B--with-libpcap-library=%b[location of libpcap shared library files]" 
     319                        bold "   %B--with-libpcap-libraries=%b\133location of libpcap shared library files\135" 
    310320                        echo 
    311321                        exit 1 
    …… 
    333343                        bold "   %BError%b - libnetfilter_queue headers not found. Install them or use the following options:" 
    334344                        echo 
    335                         bold "   %B--with-libnfq-includes=%b[location of libnetfilter_queue header files]" 
     345                        bold "   %B--with-libnfq-includes=%b\133location of libnetfilter_queue header files\135" 
    336346                        echo 
    337347                        exit 
    …… 
    347357                        bold "   %BError%b - libnetfilter_queue library not found. Install it or use the following options:" 
    348358                        echo 
    349                         bold "   %B--with-libnfq-library=%b[location of libnetfilter_queue shared library files]" 
     359                        bold "   %B--with-libnfq-libraries=%b\133location of libnetfilter_queue shared library files\135" 
    350360                        echo 
    351361                        exit 
    …… 
    372382                        bold "   %BError%b - libipq headers not found. Install them or use the following options:" 
    373383                        echo 
    374                         bold "   %B--with-libipq-includes=%b[location of libipq header files]" 
     384                        bold "   %B--with-libipq-includes=%b\133location of libipq header files\135" 
    375385                        echo 
    376386                        exit 
    …… 
    386396                        bold "   %BError%b - libipq library not found. Install it or use the following options:" 
    387397                        echo 
    388                         bold "   %B--with-libipq-library=%[blocation of libipq shared library files]" 
     398                        bold "   %B--with-libipq-libraries=%b\133location of libipq shared library files\135" 
    389399                        echo 
    390400                        exit 
    …… 
    448458    bold "   %BError%b - libclamav headers not found. Install them or use the following options:" 
    449459    echo 
    450     bold "   %B--with-libclamav-includes=%b[location of libclamav header files]" 
     460    bold "   %B--with-libclamav-includes=%b\133location of libclamav header filesi\135" 
    451461    echo 
    452462    exit 
    …… 
    462472    bold "   %BError%b - libclamav library not found. Install it or use the following options:" 
    463473    echo 
    464     bold "   %B--with-libclamav-library=%b[location of libclamav shared library files]" 
     474    bold "   %B--with-libclamav-libraries=%b\133location of libclamav shared library files\135" 
    465475    echo 
    466476    exit 
    …… 
    475485AM_CONDITIONAL(BUILD_CPUEMU_PLUGIN, test x$with_cpuemu = xyes) 
    476486if test "$with_cpuemu" = "yes"; then 
     487  if test "$enable_devmodules" != "X"; then 
     488    echo 
     489    echo "   The cpuEmu plugin is still unstable and should not be used in production setups." 
     490    bold "   Use %B--enable-devmodules%b to build it anyway." 
     491    echo 
     492    exit 
     493  fi 
     494 
    477495  with_cpuemu="X" 
    478496  AC_ARG_WITH(libemu_includes, 
    …… 
    490508  AC_CHECK_HEADER(emu/emu.h,, HEMU="no") 
    491509  if test "$HEMU" = "no"; then 
     510    echo 
    492511    bold "   %BError%b - libemu headers not found. Install them or use the following options:" 
    493512    echo 
    494     bold "   %B--with-libemu-includes=%b[location of libemu header files]" 
     513    bold "   %B--with-libemu-includes=%b\133location of libemu header files\135" 
    495514    echo 
    496515    exit 
    …… 
    503522  AC_CHECK_LIB(emu, emu_getpc_check,, LEMU="no") 
    504523  if test "$LEMU" = "no"; then 
     524    echo 
    505525    bold "   %BError%b - libemu library not found. Install it or use the following options:" 
    506526    echo 
    507     bold "   %B--with-libemu-library=%b[location of libemu shared library files]" 
     527    bold "   %B--with-libemu-libraries=%b\133location of libemu shared library files\135" 
    508528    echo 
    509529    exit 
    …… 
    520540AM_CONDITIONAL(BUILD_SUBMIT_MWSERV_PLUGIN, test x$with_submit_mwserv = xyes) 
    521541if test "$with_submit_mwserv" = "yes"; then 
     542        if test "$enable_devmodules" != "X"; then 
     543                echo 
     544                echo "   The submitMWserv plugin is still unstable and should not be used in production setups." 
     545                bold "   Use %B--enable-devmodules%b to build it anyway." 
     546                echo 
     547                exit 
     548        fi 
     549 
    522550        with_submit_mwserv="X" 
    523551 
    …… 
    539567        AC_CHECK_HEADER(curl.h,, HCURL="no") 
    540568        if test "$HCURL" = "no"; then 
     569                echo 
    541570                bold "   %BError%b - libcurl headers not found. Install them or use the following options:" 
    542571                echo 
    543                 bold "   %B--with-libcurl-includes=%b[location of libcurl header files]" 
     572                bold "   %B--with-libcurl-includes=%b\133location of libcurl header files\135" 
    544573                echo 
    545574                exit 
    546575        fi 
    547576 
     577        if test "$with_libcurl_libraries" != "no"; then 
     578                LDFLAGS="${LDFLAGS}  -L${with_libcurl_libraries}" 
     579        fi 
    548580        LCURL="yes" 
    549581        AC_CHECK_LIB(curl, curl_version, LCURL="yes", LCURL="no") 
    550582        if test "$LCURL" = "no"; then 
     583                echo 
    551584                bold "   %BError%b - libcurl library not found. Install it or use the following options:" 
    552585                echo 
    553                 bold "   %B--with-libcurl-library=%b[location of libcurl shared library files]" 
     586                bold "   %B--with-libcurl-libraries=%b\133location of libcurl shared library files\135" 
    554587                echo 
    555588                exit 
    556589        fi 
    557  
    558         if test "x$libcurl" = xno ; then 
    559                 AC_MSG_CHECKING([checking for curl with SSL]) 
    560                 LIBS="$LIBS -lcurl -L/usr/local/ssl/lib -lssl -lcrypto" 
    561                 AC_TRY_LINK([#include <curl/curl.h>], [curl_version();], libcurl=yes, libcurl=no) 
    562                 if test "x$libcurl" = xno ; then 
    563                         AC_MSG_RESULT(no) 
    564                         AC_MSG_ERROR([libcurl required. Go to http://curl.haxx.se/ to download and then install it first]) 
    565                 else 
    566                         AC_MSG_RESULT(yes) 
    567                 fi 
    568         fi  
    569590else 
    570591        with_submit_mwserv=" " 
    …… 
    577598AM_CONDITIONAL(BUILD_CSPM_PLUGIN, test x$with_cspm = xyes) 
    578599if test "$with_cspm" = "yes"; then 
     600  if test "$enable_devmodules" != "X"; then 
     601    echo 
     602    echo "   The CSPM plugin is still unstable and should not be used in production setups." 
     603    bold "   Use %B--enable-devmodules%b to build it anyway." 
     604    echo 
     605    exit 
     606  fi 
     607 
     608  with_cspm="X" 
     609 
    579610  AC_ARG_WITH(libpcre_includes, 
    580611    [  --with-libpcre-includes=DIR     libpcre include directory], 
    …… 
    594625    bold "   %BError%b - libpcre headers not found. Install them or use the following options:" 
    595626    echo 
    596     bold "   %B--with-libpcre-includes=%b[location of libpcre header files]" 
     627    bold "   %B--with-libpcre-includes=%b\133location of libpcre header files\135" 
    597628    echo 
    598629    exit 
    …… 
    608639    bold "   %BError%b - libpcre library not found. Install it or use the following options:" 
    609640    echo 
    610     bold "   %B--with-libpcre-library=%b[location of libpcre shared library files]" 
    611     echo 
    612     exit 
    613   fi 
    614         with_cspm="X" 
     641    bold "   %B--with-libpcre-libraries=%b\133location of libpcre shared library files\135" 
     642    echo 
     643    exit 
     644  fi 
     645 
    615646else 
    616647        with_cspm=" " 
    …… 
    641672    bold "   %BError%b - libpq headers not found. Install them or use the following options:" 
    642673    echo 
    643     bold "   %B--with-libpq-includes=%b[location of libpq header files]" 
     674    bold "   %B--with-libpq-includes=%b\133location of libpq header files\135" 
    644675    echo 
    645676    exit 
    …… 
    655686    bold "   %BError%b - libpq library not found. Install it or use the following options:" 
    656687    echo 
    657     bold "   %B--with-libpq-library=%b[location of libpq shared library files]" 
     688    bold "   %B--with-libpq-libraries=%b\133location of libpq shared library files\135" 
    658689    echo 
    659690    exit 
    …… 
    754785bold "    (%B$enable_debug%b)  Debugging" 
    755786bold "    (%B$enable_profile%b)  Profiling" 
     787bold "    (%B$enable_devmodules%b)  Unstable Modules" 
    756788bold "    (%B$with_efence%b)  Electric Fence" 
    757789echo 
    …… 
    765797bold "    (%B$with_clamav%b)  ClamAV" 
    766798bold "    (%B$with_cpuemu%b)  cpuEmu" 
     799bold "    (%B$with_cspm%b)  CSPM" 
    767800bold "    (%B$with_postgres%b)  PostgeSQL" 
    768801bold "    (%B$with_spamsum%b)  SpamSum" 
    769 bold "    (%B$with_cspm%b)  CSPM" 
    770802bold "    (%B$with_submit_mwserv%b)  submitMwserv" 

  • honeytrap/trunk/doc/honeytrap.8

    r1081 r1425  
    2828.SH NAME 
    2929.B honeytrap  
    30 \- trap attacks against tcp services 
     30\- trap attacks against network services 
    3131.SH SYNOPSIS 
    3232.B honeytrap 
    …… 
    7171.SH DESCRIPTION 
    7272.I honeytrap 
    73 is a network security tool written to observe attacks against TCP services. As a low-interactive honeypot, it collects information regarding known or unknown network-based attacks. It starts server processes dynamically at the time of incoming connection requests. This generic behavior makes it possible to respond to most network-based attacks. Observed data can be processed with plugins for automatic analysis. 
     73is a network security tool written to observe attacks against network services. As a low-interactive honeypot, it collects information regarding known or unknown network-based attacks. It starts server processes dynamically at the time of incoming connection requests. This generic behavior makes it possible to respond to most network-based attacks. Observed data can be processed with plugins for automatic analysis. 
    7474.LP 
    7575Data capture is basically done by the core system. The master process uses a connection monitor to catch incoming requests. Currently, connection monitoring can be performed via a PCAP based sniffer or by hooking the ip_queue API, a userland interface to netfilter/iptables on Linux systems. The appropriate technique has to be built in during compile time. 
    7676.LP 
    77 Incoming connections are processed in one of the following modi: normal, ignore, proxy and mirror. The specific bevavior for a connection can be configured per TCP port. If no explicit configuration is given, the default mode applies. It is possible to setup 
     77Incoming connections are processed in one of the following modi: normal, ignore, proxy and mirror. The specific bevavior for a connection can be configured per tcp or udp port. If no explicit configuration is given, the default mode applies. It is possible to setup 
    7878.I honeytrap 
    7979as a meta-honeypot, forwarding some connections to different honeypot systems, handle some attacks with own routines or even route connections to different honeypots. 
    …… 
    177177To recognize rejected connections,  
    178178.I honeytrap 
    179 uses a berkeley packet filter (bpf) to sniff TCP reset packets sent to a remote host. The filter can be restricted by adding a bpf 
     179uses a berkeley packet filter (bpf) to catch connection requests. The filter can be restricted by adding a bpf 
    180180.I expression. 
    181181This only has an effect when using the pcap connection monitor. 
    …… 
    205205As a honeypot, 
    206206.I honeytrap 
    207 is exposed to attacks that might compromise the software itself. Running it into a hardened and secured environment is a good idea. Linking against a stack protection library might also improve security. The configure script supports the electric fence malloc debugger. Use it. 
     207is exposed to attacks that might compromise the software itself. Running it inside a hardened and secured environment is a good idea. Linking against a stack protection library might also improve security. The configure script supports the electric fence malloc debugger. Use it. 
    208208.SH SEE ALSO 
    209209.BR bpf (4), 
    210210.BR iptables (8), 
    211211.BR pcap (3), 
     212.BR udp(7). 
    212213.BR tcp (7). 
    213214.SH AUTHOR 

  • honeytrap/trunk/etc/honeytrap.conf.dist

    r1286 r1425  
    1414response_dir    = "/opt/honeytrap/etc/honeytrap/responses" 
    1515 
    16 /* run in mirror mode - mirror connections back to the initiator 
    17  * use with caution! */ 
    18 //mirror = "on" 
     16/* replace rfc1918 ip addresses with attacking ip address */ 
     17replace_private_ips = "no" 
     18 
     19/* default port mode -- valid values are "ignore", "normal" and "mirror" 
     20portconf_default = "normal" 
    1921 
    2022/* put network interface into promiscuous mode 
    …… 
    4850plugin-vncDownload = "" 
    4951 
     52 
    5053/* store attacks on disk */ 
    5154plugin-SaveFile = { 
    …… 
    5356        downloads_dir   = "/opt/honeytrap/downloads" 
    5457} 
     58 
    5559 
    5660/* scan downloaded samples with ClamAV engine */ 
    …… 
    6064} 
    6165 
     66 
    6267/* calculate locality sensitive hashes */ 
    6368plugin-SpamSum = { 
    …… 
    6570        spamsum_sigfile = "/opt/honeytrap/spamsum.sigs" 
    6671} 
     72 
    6773 
    6874/* store attacks in PostgeSQL database */ 
    …… 
    7682} 
    7783*/ 
     84 
     85 
     86/* invoke wget to download files via http */ 
     87/* 
     88plugin-httpDownload = { 
     89        http_program = "/usr/bin/wget" 
     90//      http_options = "-nv" 
     91        http_options = "-q" 
     92        download_dir = "/opt/honeytrap/downloads/" 
     93} 
     94*/ 
     95 
    7896 
    7997 

  • honeytrap/trunk/etc/ports.conf.dist

    r1270 r1425  
    33 * should be included in main configuration file 
    44 * (c) Tillmann Werner <tillmann.werner@gmx.de> 
    5 */ 
     5 */ 
    66 
    77portconf = { 

  • honeytrap/trunk/src/modules/Makefile.am

    r1387 r1425  
    8585endif 
    8686 
     87 
    8788install-exec-am: 
    88         $(mkinstalldirs) $(DESTDIR)/$(sysconfdir)/honeytrap/plugins 
     89        $(mkinstalldirs) $(libdir) 
    8990        for module in `find .libs -name htm_*.so`; do \ 
    90                 [ -h $$module ] || $(INSTALL_DATA) "$$module" $(DESTDIR)/$(sysconfdir)/honeytrap/plugins/ ; \ 
     91                [ -h $$module ] || $(INSTALL_DATA) "$$module" $(libdir) ; \ 
    9192        done 
    92         for module in `find . -name htm_*.*a`; do \ 
    93                 rm -f $(DESTDIR)/$(sysconfdir)/honeytrap/plugins/`basename "$$module"` ; \ 
    94         done 

  • honeytrap/trunk/src/modules/htm_cspm/Makefile.am

    r1388 r1425  
    2626htm_cspm_la_LDFLAGS = -module -no-undefined -avoid-version 
    2727 
     28 
    2829install-exec-am: 
    29         $(mkinstalldirs) $(DESTDIR)/$(sysconfdir)/honeytrap/plugins 
     30        $(mkinstalldirs) $(libdir) 
    3031        for module in `find .libs -name htm_*.so`; do \ 
    31                 [ -h $$module ] || $(INSTALL_DATA) "$$module" $(DESTDIR)/$(sysconfdir)/honeytrap/plugins/ ; \ 
     32                [ -h $$module ] || $(INSTALL_DATA) "$$module" $(libdir) ; \ 
    3233        done 
    33         for module in `find . -name htm_*.*a`; do \ 
    34                 rm -f $(DESTDIR)/$(sysconfdir)/honeytrap/plugins/`basename "$$module"` ; \ 
    35         done