Nasazení honeypotu na serveru srv4.cloud.batacek.eu

Anruf

tool_search Tool Search

Searching available tools: runner execute command honeypot

Eingang

query

runner execute command honeypot

limit

10

Ergebnis

Searched available tools

Loaded 5 HoneypotMCP tools:
  HoneypotMCP:execute_command:
    command: string
    runner: string
    timeout_seconds?: integer
  HoneypotMCP:get_command_logs:
    runner: string
    limit?: integer
    since?: any
  HoneypotMCP:get_runner_health:
    runner?: any
  HoneypotMCP:get_system_info:
    runner: string
  HoneypotMCP:list_runners
These tools are now available for you to call directly.

<functions>
<function>{"description": "Execute shell command on one or more runners. runner: runner name or \"all\" command: shell command to run timeout_seconds: command timeout", "name": "HoneypotMCP:execute_command", "parameters": {"additionalProperties": false, "properties": {"command": {"type": "string"}, "runner": {"type": "string"}, "timeout_seconds": {"default": 60, "type": "integer"}}, "required": ["command", "runner"], "type": "object"}}</function>
<function>{"description": "Get recent command logs from a runner via /api/v1/logs.", "name": "HoneypotMCP:get_command_logs", "parameters": {"additionalProperties": false, "properties": {"limit": {"default": 100, "type": "integer"}, "runner": {"type": "string"}, "since": {"anyOf": [{"type": "string"}, {"type": "null"}], "default": null}}, "required": ["runner"], "type": "object"}}</function>
<function>{"description": "Check health status of runner(s) via /api/v1/health. runner: specific name or None/\"all\" for all runners.", "name": "HoneypotMCP:get_runner_health", "parameters": {"additionalProperties": false, "properties": {"runner": {"anyOf": [{"type": "string"}, {"type": "null"}], "default": null}}, "type": "object"}}</function>
<function>{"description": "Get system information from a specific runner via /api/v1/system.", "name": "HoneypotMCP:get_system_info", "parameters": {"additionalProperties": false, "properties": {"runner": {"type": "string"}}, "required": ["runner"], "type": "object"}}</function>
<function>{"description": "Return list of all configured runners with name, address and tags.", "name": "HoneypotMCP:list_runners", "parameters": {"additionalProperties": false, "properties": {}, "type": "object"}}</function>
</functions>

Anruf

HoneypotMCP:list_runners HoneypotMCP

List runners

Eingang

Ergebnis

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:get_runner_health HoneypotMCP

Get runner health

Eingang

runner

all

Ergebnis

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:get_system_info HoneypotMCP

Get system info

Eingang

runner

srv4 - honeypot

Ergebnis

architecture

x86_64

available_shells

[0]

/bin/sh

[1]

bash

hostname

srv4.cloud.batacek.eu

name

srv4 - honeypot

os_type

linux

os_version

Linux

package_managers

[0]

apt

status

online

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

echo "=== ID/OS ==="; id; cat /etc/os-release | head -5; uname -a; echo; echo "=== CPU/RAM ==="; nproc; free -h; echo; echo "=== DISK ==="; df -hT; echo; echo "=== UPTIME ==="; uptime; date -Is; timedatectl 2>/dev/null | head -8

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 1.838 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

echo "=== IP ==="; ip -brief addr; echo; echo "=== ROUTE ==="; ip route; echo; echo "=== LISTEN ==="; ss -tulpnH | sort; echo; echo "=== WG ==="; wg show 2>/dev/null; echo; echo "=== NFT ==="; nft list ruleset 2>/dev/null | head -60; echo "=== IPTABLES ==="; iptables -S 2>/dev/null | head -30

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 2.310 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

echo "=== RSYSLOG CONF ==="; ls -la /etc/rsyslog.d/ 2>/dev/null; echo "---- rsyslog.conf ----"; grep -vE '^\s*#|^\s*$' /etc/rsyslog.conf 2>/dev/null; echo "---- rsyslog.d files ----"; for f in /etc/rsyslog.d/*.conf; do echo "### $f"; grep -vE '^\s*#|^\s*$' "$f"; done 2>/dev/null; echo; echo "=== RSYSLOG SVC ==="; systemctl is-active rsyslog; systemctl is-enabled rsyslog

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 1.110 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

echo "=== SSHD EFFECTIVE ==="; sshd -T 2>/dev/null | grep -Ei '^(port|listenaddress|permitrootlogin|passwordauthentication|pubkeyauthentication|allowusers|allowgroups|kbdinteractive)' ; echo; echo "=== sshd_config (non-default lines) ==="; grep -rvE '^\s*#|^\s*$' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ 2>/dev/null; echo; echo "=== AUTH LOG: accepted ==="; grep -aE 'Accepted|session opened' /var/log/auth.log 2>/dev/null | tail -20; echo; echo "=== AUTH LOG: failed sample ==="; grep -acE 'Failed|Invalid user' /var/log/auth.log 2>/dev/null; echo; echo "=== authorized_keys ==="; ls -la /root/.ssh/ 2>/dev/null; wc -l /root/.ssh/authorized_keys 2>/dev/null

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 3.731 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

echo "=== ROOT PW STATUS ==="; passwd -S root; echo "=== USERS with shell ==="; awk -F: '$3>=1000 || $1=="root" {print $1,$3,$7}' /etc/passwd; echo; echo "=== SYSTEMD FAILED ==="; systemctl --failed --no-legend; echo "=== ENABLED SERVICES ==="; systemctl list-unit-files --state=enabled --no-legend --type=service | awk '{print $1}'; echo; echo "=== hedgehog unit ==="; systemctl cat hedgehog-runner 2>/dev/null | head -40; echo; echo "=== TIMERS ==="; systemctl list-timers --no-legend --all | head -20; echo; echo "=== CRON ==="; crontab -l 2>/dev/null; ls -la /etc/cron.d/ 2>/dev/null

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 2.510 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

echo "=== OUTBOUND TEST ==="; timeout 10 curl -sS -o /dev/null -w 'deb.debian.org: %{http_code} %{time_total}s\n' http://deb.debian.org/ 2>&1; timeout 10 curl -sS -o /dev/null -w 'github: %{http_code}\n' https://github.com 2>&1; echo; echo "=== PY/TOOLS ==="; python3 -V; which pip3 python3-venv git docker tcpdump nft iptables logger jq 2>/dev/null; echo; echo "=== APT UPDATE ==="; DEBIAN_FRONTEND=noninteractive apt-get update -qq 2>&1 | tail -5; echo "exit=$?"; echo; echo "=== APT POLICY ==="; apt-cache policy nftables tcpdump python3-venv git jq net-tools 2>/dev/null | grep -E '^[a-z]|Installed|Candidate' | head -30

runner

srv4 - honeypot

timeout_seconds

180

Ergebnis

[Ausgabe ausgeblendet · 557 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

export DEBIAN_FRONTEND=noninteractive; apt-get install -y -qq nftables python3-venv python3-dev jq libssl-dev libffi-dev build-essential > /tmp/apt.log 2>&1; echo "apt exit=$?"; tail -3 /tmp/apt.log; echo; nft -v; python3 -c 'import venv,ssl,socket;print("py ok", ssl.OPENSSL_VERSION)'; systemctl list-unit-files nftables.service

runner

srv4 - honeypot

timeout_seconds

600

Ergebnis

[Ausgabe ausgeblendet · 313 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

echo "shell test:"; echo $0; ls -la /opt/honeypot/ /var/log/honeypot/ 2>/dev/null; rm -rf '/opt/honeypot/{bin,etc,var}' '/var/log/honeypot/{bodies,pcap,state}'; mkdir -p /opt/honeypot/bin /opt/honeypot/etc /opt/honeypot/var /var/log/honeypot/bodies /var/log/honeypot/pcap /var/log/honeypot/state; chown -R root:root /opt/honeypot; chown hpsvc:hpsvc /var/log/honeypot /var/log/honeypot/bodies; chmod 0755 /var/log/honeypot; chmod 0750 /var/log/honeypot/bodies; echo "--- po opravě ---"; ls -la /opt/honeypot/ /var/log/honeypot/; id hpsvc; id cowrie

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 1.003 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cat > /opt/honeypot/bin/hplib.py <<'PYEOF'
"""hplib - sdilene utility pro honeypot srv4.

Navrh:
  * kazda udalost = jeden radek JSON v /var/log/honeypot/<svc>.jsonl
  * radek je tvrde omezen na MAX_LINE bajtu, aby se vesel do syslog zpravy
    (rsyslog default maxMessageSize = 8 kB); useknuti se vzdy oznaci.
  * velka telaquery se ukladaji zvlast do bodies/ podle sha256 (dedup).
  * soubor se nikdy nemaze ani neprepisuje - jen se pripisuje (O_APPEND).
"""
import json, os, socket, struct, sys, threading, time, hashlib, binascii

LOGDIR = "/var/log/honeypot"
BODYDIR = os.path.join(LOGDIR, "bodies")
MAX_LINE = 7000          # limit na jeden JSON radek (syslog ma 8 kB)
MAX_BODY_STORE = 1 << 20  # 1 MB na jeden ulozeny payload

SO_ORIGINAL_DST = 80
SOL_IPV6 = 41


def utcnow():
    t = time.time()
    ms = int((t % 1) * 1000000)
    return time.strftime("%Y-%m-%dT%H:%M:%S", time.gmtime(t)) + ".%06dZ" % ms, t


def orig_dst(sock):
    """Puvodni cilova adresa pred REDIRECT (nftables). None = neproslo NATem."""
    try:
        data = sock.getsockopt(socket.SOL_IP, SO_ORIGINAL_DST, 16)
        port = struct.unpack("!H", data[2:4])[0]
        return socket.inet_ntoa(data[4:8]), port
    except OSError:
        pass
    try:
        data = sock.getsockopt(SOL_IPV6, SO_ORIGINAL_DST, 28)
        port = struct.unpack("!H", data[2:4])[0]
        return socket.inet_ntop(socket.AF_INET6, data[8:24]), port
    except OSError:
        return None, None


def hexdump(b, limit=512):
    b = b[:limit]
    return binascii.hexlify(b).decode("ascii")


def printable(b, limit=2048):
    """Bezpecny textovy nahled binarnich dat (utf-8 s nahradou)."""
    return b[:limit].decode("utf-8", "replace").replace("\x00", "\\x00")


class EventLog:
    def __init__(self, svc):
        self.svc = svc
        self.path = os.path.join(LOGDIR, svc + ".jsonl")
        self.lock = threading.Lock()
        self.fd = os.open(self.path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o640)
        self.count = 0
        self.dropped = 0
        t = threading.Thread(target=self._syncer, daemon=True)
        t.start()

    def _syncer(self):
        # periodicky fsync - data prezijou pad stroje, ale nezdrzuje kazdy zapis
        while True:
            time.sleep(5)
            try:
                with self.lock:
                    os.fsync(self.fd)
            except OSError:
                pass

    def emit(self, evt, **kw):
        try:
            ts, t = utcnow()
            rec = {"ts": ts, "t": round(t, 6), "svc": self.svc, "evt": evt}
            rec.update(kw)
            line = json.dumps(rec, ensure_ascii=True, separators=(",", ":"), default=str)
            if len(line) > MAX_LINE:
                # useknout nejvetsi textove pole, ne cely zaznam
                for key in ("data", "body", "raw", "headers_raw", "preview"):
                    if key in rec and isinstance(rec[key], str):
                        over = len(line) - MAX_LINE + 64
                        rec[key] = rec[key][: max(0, len(rec[key]) - over)]
                        rec["line_truncated"] = True
                        line = json.dumps(rec, ensure_ascii=True, separators=(",", ":"), default=str)
                        if len(line) <= MAX_LINE:
                            break
                if len(line) > MAX_LINE:
                    line = line[: MAX_LINE - 2] + '"}'
            with self.lock:
                os.write(self.fd, line.encode("utf-8", "replace") + b"\n")
                self.count += 1
        except Exception as e:  # logovani nesmi nikdy shodit honeypot
            self.dropped += 1
            try:
                sys.stderr.write("EMIT-FAIL %r\n" % (e,))
            except Exception:
                pass

    def store_body(self, data):
        """Ulozi payload mimo JSON radek. Vraci (sha256, ulozeno_bajtu)."""
        if not data:
            return None, 0
        h = hashlib.sha256(data).hexdigest()
        blob = data[:MAX_BODY_STORE]
        p = os.path.join(BODYDIR, h)
        try:
            if not os.path.exists(p):
                fd = os.open(p, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o640)
                os.write(fd, blob)
                os.close(fd)
        except FileExistsError:
            pass
        except OSError as e:
            sys.stderr.write("STORE-FAIL %r\n" % (e,))
            return h, 0
        return h, len(blob)


def recv_until(sock, terminator, maxlen, timeout=None):
    """Cte do vyskytu terminatoru. Vraci (data, complete)."""
    if timeout is not None:
        sock.settimeout(timeout)
    buf = b""
    while len(buf) < maxlen:
        try:
            chunk = sock.recv(min(4096, maxlen - len(buf)))
        except (socket.timeout, TimeoutError):
            return buf, False
        except OSError:
            return buf, False
        if not chunk:
            return buf, False
        buf += chunk
        if terminator in buf:
            return buf, True
    return buf, False


def send_all(sock, data):
    try:
        sock.sendall(data)
        return True
    except OSError:
        return False
PYEOF
python3 -c "import sys; sys.path.insert(0,'/opt/honeypot/bin'); import hplib; print('hplib OK')"

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 9 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cat > /opt/honeypot/bin/hphttp.py <<'PYEOF'
"""hphttp - emulace HTTP serveru pro honeypot.

Cil: co nejvic udrzet skener/utocnika v konverzaci a zaznamenat presne, co poslal.
 - hlasi se jako nginx + PHP, aby vypadal jako bezny hostingovy stroj
 - na admin cesty vraci prihlasovaci formular (chceme videt POST s hesly)
 - predstira otevrenou proxy (CONNECT / absolutni URI), ale NIKDY nic nepreposila
 - vsechno loguje vcetne tela pozadavku
"""
import re, time, hashlib
from hplib import printable, hexdump, send_all

SERVER_HDR = "nginx/1.24.0"
POWERED = "PHP/8.2.28"

MAX_HEAD = 32768
MAX_BODY = 1 << 20
MAX_REQ_PER_CONN = 25
IDLE_TIMEOUT = 20

INDEX = (
    "<!DOCTYPE html><html><head><title>Welcome</title>"
    "<style>body{font-family:sans-serif;margin:5em auto;max-width:38em;color:#333}</style>"
    "</head><body><h1>It works!</h1><p>This server is up and running. "
    "If you are seeing this page, the web server software is operational but "
    "no site content has been configured yet.</p><hr><address>%s</address>"
    "</body></html>" % SERVER_HDR
)

LOGIN = (
    "<!DOCTYPE html><html><head><title>Administration - Sign in</title>"
    "<style>body{font-family:sans-serif;background:#eef1f5}"
    ".b{max-width:22em;margin:6em auto;padding:2em;background:#fff;border:1px solid #ccd}"
    "input{width:100%%;padding:.5em;margin:.3em 0 1em}</style></head><body><div class='b'>"
    "<h2>Sign in</h2><form method='post' action='%s'>"
    "<label>Username</label><input name='username' autofocus>"
    "<label>Password</label><input name='password' type='password'>"
    "<button type='submit'>Log in</button></form></div></body></html>"
)

NOTFOUND = (
    "<html><head><title>404 Not Found</title></head><body>"
    "<center><h1>404 Not Found</h1></center><hr><center>%s</center></body></html>" % SERVER_HDR
)

FAKE_ENV = (
    "APP_NAME=Laravel\nAPP_ENV=production\nAPP_KEY=base64:Yk9uZXBvdEZha2VLZXlOb3RSZWFsMDAwMA==\n"
    "APP_DEBUG=false\nAPP_URL=http://localhost\n\nLOG_CHANNEL=stack\n\n"
    "DB_CONNECTION=mysql\nDB_HOST=127.0.0.1\nDB_PORT=3306\nDB_DATABASE=app_prod\n"
    "DB_USERNAME=app_rw\nDB_PASSWORD=Xr7-tmp-local-only\n\n"
    "REDIS_HOST=127.0.0.1\nREDIS_PORT=6379\n\nMAIL_MAILER=smtp\nMAIL_HOST=127.0.0.1\nMAIL_PORT=25\n"
)

LOGIN_PATHS = re.compile(
    r"^/(admin|administrator|login|signin|user|manager|cms|panel|controlpanel|cpanel|"
    r"phpmyadmin|pma|myadmin|dbadmin|mysql|adminer|wp-login\.php|wp-admin|"
    r"webadmin|console|portal|dashboard|auth|owa|remote|vpn|cgi-bin/luci)(/.*)?$", re.I)

ENV_PATHS = re.compile(r"^/(\.env|\.env\.[a-z]+|config/\.env|api/\.env|laravel/\.env)$", re.I)


def _http_date():
    return time.strftime("%a, %d %b %Y %H:%M:%S GMT", time.gmtime())


def response(code, reason, body, ctype="text/html; charset=UTF-8", extra=None, keep=True):
    if isinstance(body, str):
        body = body.encode("utf-8")
    h = ["HTTP/1.1 %d %s" % (code, reason),
         "Server: " + SERVER_HDR,
         "Date: " + _http_date(),
         "Content-Type: " + ctype,
         "Content-Length: %d" % len(body),
         "X-Powered-By: " + POWERED,
         "Connection: " + ("keep-alive" if keep else "close")]
    if extra:
        h.extend(extra)
    return ("\r\n".join(h) + "\r\n\r\n").encode("ascii", "replace") + body


def parse_head(head):
    """Vraci (method, target, version, [(k,v)], ok)."""
    try:
        text = head.decode("latin-1")
    except Exception:
        return None, None, None, [], False
    lines = text.replace("\r\n", "\n").split("\n")
    if not lines or not lines[0].strip():
        return None, None, None, [], False
    parts = lines[0].split()
    if len(parts) < 2:
        return None, None, None, [], False
    method, target = parts[0], parts[1]
    version = parts[2] if len(parts) > 2 else "HTTP/0.9"
    if not re.match(r"^[A-Za-z_-]{1,20}$", method):
        return None, None, None, [], False
    hdrs = []
    for ln in lines[1:]:
        if not ln.strip():
            break
        if ":" in ln:
            k, v = ln.split(":", 1)
            hdrs.append((k.strip(), v.strip()))
    return method, target, version, hdrs, True


def hget(hdrs, name, default=None):
    n = name.lower()
    for k, v in hdrs:
        if k.lower() == n:
            return v
    return default


def read_head(sock, buf):
    """Docte hlavicku ze socketu. Vraci (head, rest) nebo (None, buf)."""
    while True:
        for term in (b"\r\n\r\n", b"\n\n"):
            i = buf.find(term)
            if i >= 0:
                return buf[:i], buf[i + len(term):]
        if len(buf) > MAX_HEAD:
            return None, buf
        try:
            chunk = sock.recv(8192)
        except Exception:
            return None, buf
        if not chunk:
            return None, buf
        buf += chunk


def read_body(sock, buf, length):
    length = min(length, MAX_BODY)
    while len(buf) < length:
        try:
            chunk = sock.recv(min(65536, length - len(buf)))
        except Exception:
            break
        if not chunk:
            break
        buf += chunk
    return buf[:length], buf[length:]


def read_chunked(sock, buf):
    out = b""
    while len(out) < MAX_BODY:
        i = buf.find(b"\r\n")
        while i < 0:
            try:
                c = sock.recv(4096)
            except Exception:
                return out, buf
            if not c:
                return out, buf
            buf += c
            i = buf.find(b"\r\n")
        try:
            size = int(buf[:i].split(b";")[0].strip() or b"0", 16)
        except ValueError:
            return out, buf
        buf = buf[i + 2:]
        if size == 0:
            return out, buf
        data, buf = read_body(sock, buf, size + 2)
        out += data[:size]
    return out, buf


def serve(sock, ctx, log):
    """Obslouzi jedno HTTP spojeni. ctx = dict s src_ip/src_port/dst_port/tls/sess."""
    buf = b""
    n = 0
    sock.settimeout(IDLE_TIMEOUT)
    while n < MAX_REQ_PER_CONN:
        head, buf = read_head(sock, buf)
        if head is None:
            if n == 0 and buf:
                # neni to HTTP - zaznamenat syrova data (skener jineho protokolu)
                log.emit("nonhttp_data", sess=ctx["sess"], src_ip=ctx["src_ip"],
                         src_port=ctx["src_port"], dst_port=ctx["dst_port"],
                         tls=ctx.get("tls"), nbytes=len(buf),
                         hex=hexdump(buf, 256), preview=printable(buf, 512))
            return n
        n += 1
        method, target, version, hdrs, ok = parse_head(head)
        if not ok:
            log.emit("http_malformed", sess=ctx["sess"], src_ip=ctx["src_ip"],
                     src_port=ctx["src_port"], dst_port=ctx["dst_port"],
                     tls=ctx.get("tls"), hex=hexdump(head, 256), preview=printable(head, 512))
            send_all(sock, response(400, "Bad Request", NOTFOUND, keep=False))
            return n

        body = b""
        te = (hget(hdrs, "Transfer-Encoding") or "").lower()
        cl = hget(hdrs, "Content-Length")
        if "chunked" in te:
            body, buf = read_chunked(sock, buf)
        elif cl and cl.strip().isdigit():
            body, buf = read_body(sock, buf, int(cl.strip()))

        body_sha = None
        body_stored = 0
        if body:
            body_sha, body_stored = log.store_body(body)

        path, _, query = target.partition("?")
        evt = {
            "sess": ctx["sess"], "src_ip": ctx["src_ip"], "src_port": ctx["src_port"],
            "dst_port": ctx["dst_port"], "tls": ctx.get("tls"), "req_no": n,
            "method": method, "target": target[:2048], "path": path[:1024],
            "query": query[:1024], "version": version,
            "host": hget(hdrs, "Host"), "ua": hget(hdrs, "User-Agent"),
            "headers": [(k[:128], v[:512]) for k, v in hdrs[:64]],
            "body_len": len(body), "body_sha256": body_sha, "body_stored": body_stored,
            "body": printable(body, 3000) if body else None,
        }

        # --- volba odpovedi -------------------------------------------------
        if method.upper() == "CONNECT":
            # test otevrene proxy. Odpovime OK, ale NIC nepreposilame.
            evt["proxy_attempt"] = "connect"
            log.emit("http_request", code=200, **evt)
            send_all(sock, b"HTTP/1.1 200 Connection established\r\n\r\n")
            sock.settimeout(15)
            tun = b""
            while len(tun) < 65536:
                try:
                    c = sock.recv(8192)
                except Exception:
                    break
                if not c:
                    break
                tun += c
            if tun:
                sha, stored = log.store_body(tun)
                log.emit("proxy_payload", sess=ctx["sess"], src_ip=ctx["src_ip"],
                         src_port=ctx["src_port"], dst_port=ctx["dst_port"],
                         target=target[:512], nbytes=len(tun), sha256=sha,
                         hex=hexdump(tun, 256), preview=printable(tun, 2000))
            return n

        if target.lower().startswith(("http://", "https://")):
            evt["proxy_attempt"] = "absolute_uri"

        if ENV_PATHS.match(path):
            resp = response(200, "OK", FAKE_ENV, ctype="text/plain; charset=UTF-8")
            code = 200
        elif LOGIN_PATHS.match(path):
            resp = response(200, "OK", LOGIN % path.replace("&", "&amp;").replace("<", "&lt;").replace("'", "&#39;"))
            code = 200
        elif path in ("/", "/index.html", "/index.php", "/index.htm"):
            resp = response(200, "OK", INDEX)
            code = 200
        elif path == "/robots.txt":
            resp = response(200, "OK", "User-agent: *\nDisallow: /admin/\nDisallow: /backup/\n",
                            ctype="text/plain")
            code = 200
        elif method.upper() in ("POST", "PUT"):
            # at si mysli, ze se neco stalo - vic pokusu = vic dat
            resp = response(200, "OK", LOGIN % path)
            code = 200
        else:
            resp = response(404, "Not Found", NOTFOUND)
            code = 404

        evt["code"] = code
        log.emit("http_request", **evt)
        if not send_all(sock, resp):
            return n
        conn = (hget(hdrs, "Connection") or "").lower()
        if "close" in conn or version.startswith("HTTP/1.0"):
            return n
    return n
PYEOF
cd /opt/honeypot/bin && python3 -c "import sys; sys.path.insert(0,'.'); import hphttp; print('hphttp OK'); print(hphttp.response(200,'OK','x')[:60])"

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 78 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cat > /opt/honeypot/bin/hpweb.py <<'PYEOF'
"""hpweb - HTTP a HTTPS honeypot.

Poslouchá na 42280 (plain) a 42443 (TLS). Provoz sem smeruje nftables REDIRECT
z verejnych portu (80, 8080, 443, ...); puvodni port zjistujeme pres SO_ORIGINAL_DST.
"""
import os, socket, ssl, sys, threading, time, uuid, traceback

sys.path.insert(0, "/opt/honeypot/bin")
from hplib import EventLog, orig_dst, printable, hexdump
import hphttp

CERT = "/opt/honeypot/etc/hp.crt"
KEY = "/opt/honeypot/etc/hp.key"
MAX_CONN = 400

log = EventLog("hpweb")
sem = threading.BoundedSemaphore(MAX_CONN)
stats = {"conn": 0, "rejected": 0}


def make_ctx():
    c = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    c.load_cert_chain(CERT, KEY)
    # zamerne povolujeme i stare verze - chceme videt i archaicke skenery
    c.minimum_version = ssl.TLSVersion.TLSv1
    try:
        c.set_ciphers("ALL:@SECLEVEL=0")
    except ssl.SSLError:
        try:
            c.set_ciphers("DEFAULT:@SECLEVEL=1")
        except ssl.SSLError:
            pass

    def sni_cb(sslsock, name, ctx):
        try:
            sslsock._hp_sni = name
        except Exception:
            pass
    c.sni_callback = sni_cb
    return c


def handle(conn, addr, tls_ctx):
    sess = uuid.uuid4().hex[:16]
    t0 = time.time()
    src_ip = addr[0]
    if src_ip.startswith("::ffff:"):
        src_ip = src_ip[7:]
    src_port = addr[1]
    odst_ip, odst_port = orig_dst(conn)
    if odst_port is None:
        try:
            odst_port = conn.getsockname()[1]
        except OSError:
            odst_port = 0
    tls_info = None
    nreq = 0
    try:
        conn.settimeout(20)
        if tls_ctx is not None:
            try:
                conn = tls_ctx.wrap_socket(conn, server_side=True)
            except (ssl.SSLError, OSError) as e:
                log.emit("tls_handshake_fail", sess=sess, src_ip=src_ip, src_port=src_port,
                         dst_port=odst_port, error=str(e)[:300])
                return
            tls_info = {
                "version": conn.version(),
                "cipher": (conn.cipher() or [None])[0],
                "sni": getattr(conn, "_hp_sni", None),
            }
        log.emit("conn_open", sess=sess, src_ip=src_ip, src_port=src_port,
                 dst_port=odst_port, tls=tls_info)
        ctx = {"sess": sess, "src_ip": src_ip, "src_port": src_port,
               "dst_port": odst_port, "tls": tls_info}
        nreq = hphttp.serve(conn, ctx, log)
    except Exception as e:
        log.emit("handler_error", sess=sess, src_ip=src_ip, error=str(e)[:300],
                 trace=traceback.format_exc()[-800:])
    finally:
        log.emit("conn_close", sess=sess, src_ip=src_ip, src_port=src_port,
                 dst_port=odst_port, requests=nreq, duration=round(time.time() - t0, 3))
        try:
            conn.shutdown(socket.SHUT_RDWR)
        except OSError:
            pass
        try:
            conn.close()
        except OSError:
            pass
        sem.release()


def listener(port, tls):
    tls_ctx = make_ctx() if tls else None
    s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
    s.bind(("::", port))
    s.listen(512)
    log.emit("listener_up", port=port, tls=bool(tls))
    while True:
        try:
            conn, addr = s.accept()
        except OSError as e:
            log.emit("accept_error", port=port, error=str(e)[:200])
            time.sleep(0.5)
            continue
        if not sem.acquire(blocking=False):
            stats["rejected"] += 1
            try:
                conn.close()
            except OSError:
                pass
            continue
        stats["conn"] += 1
        threading.Thread(target=handle, args=(conn, addr, tls_ctx), daemon=True).start()


def heartbeat():
    while True:
        time.sleep(300)
        log.emit("heartbeat", conns=stats["conn"], rejected=stats["rejected"],
                 events=log.count, log_errors=log.dropped,
                 threads=threading.active_count())


if __name__ == "__main__":
    log.emit("service_start", pid=os.getpid(), version=1)
    threading.Thread(target=heartbeat, daemon=True).start()
    threading.Thread(target=listener, args=(42280, False), daemon=True).start()
    listener(42443, True)
PYEOF
# self-signed certifikat - obecny, at nevypada jako honeypot
openssl req -x509 -newkey rsa:2048 -nodes -keyout /opt/honeypot/etc/hp.key -out /opt/honeypot/etc/hp.crt -days 400 -subj "/C=US/ST=Oregon/L=Portland/O=IT Services/CN=srv4.cloud.batacek.eu" -addext "subjectAltName=DNS:srv4.cloud.batacek.eu,IP:169.58.205.231" 2>&1 | tail -2
chown hpsvc:hpsvc /opt/honeypot/etc/hp.key; chmod 0640 /opt/honeypot/etc/hp.key; chmod 0644 /opt/honeypot/etc/hp.crt
openssl x509 -in /opt/honeypot/etc/hp.crt -noout -subject -dates
python3 -c "import sys; sys.path.insert(0,'/opt/honeypot/bin'); import hpweb; print('hpweb import OK')"

runner

srv4 - honeypot

timeout_seconds

120

Ergebnis

[Ausgabe ausgeblendet · 767 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cat > /opt/honeypot/bin/hptcp.py <<'PYEOF'
"""hptcp - univerzalni TCP honeypot (catch-all).

Vsechen TCP provoz, ktery nema vlastni sluzbu, sem posila nftables REDIRECT
na port 42000. Puvodni cilovy port zjistime pres SO_ORIGINAL_DST a podle nej
vybereme emulaci protokolu. Cilem je vylakat z protistrany co nejvic dat
(prihlasovaci udaje, prikazy, payloady), nikdy nic neposilame ven.
"""
import base64, os, re, socket, sys, threading, time, uuid, traceback

sys.path.insert(0, "/opt/honeypot/bin")
from hplib import EventLog, orig_dst, printable, hexdump
import hphttp

LISTEN_PORT = 42000
MAX_CONN = 600
MAX_LINE = 4096
MAX_CMDS = 40

log = EventLog("hptcp")
sem = threading.BoundedSemaphore(MAX_CONN)
stats = {"conn": 0, "rejected": 0}


class Conn:
    def __init__(self, sock, ctx):
        self.s = sock
        self.ctx = ctx
        self.buf = b""
        self.creds = []
        self.cmds = 0

    def send(self, data):
        try:
            self.s.sendall(data)
            return True
        except OSError:
            return False

    def readline(self, timeout=15):
        self.s.settimeout(timeout)
        while b"\n" not in self.buf:
            if len(self.buf) > MAX_LINE:
                out, self.buf = self.buf, b""
                return out
            try:
                c = self.s.recv(4096)
            except Exception:
                return None
            if not c:
                return None if not self.buf else self._flush()
            self.buf += c
        i = self.buf.find(b"\n")
        line, self.buf = self.buf[:i], self.buf[i + 1:]
        return line.rstrip(b"\r")

    def _flush(self):
        out, self.buf = self.buf, b""
        return out

    def readsome(self, n=8192, timeout=10):
        self.s.settimeout(timeout)
        if self.buf:
            return self._flush()
        try:
            return self.s.recv(n)
        except Exception:
            return None

    def cmd(self, proto, line, **kw):
        self.cmds += 1
        log.emit("cmd", proto=proto, sess=self.ctx["sess"], src_ip=self.ctx["src_ip"],
                 src_port=self.ctx["src_port"], dst_port=self.ctx["dst_port"],
                 data=printable(line, 1500), **kw)

    def cred(self, proto, user, pw, extra=None):
        self.creds.append((user, pw))
        log.emit("credentials", proto=proto, sess=self.ctx["sess"], src_ip=self.ctx["src_ip"],
                 src_port=self.ctx["src_port"], dst_port=self.ctx["dst_port"],
                 username=str(user)[:256], password=str(pw)[:256], extra=extra)


def _b64(s):
    try:
        return base64.b64decode(s + "=" * (-len(s) % 4)).decode("utf-8", "replace")
    except Exception:
        return None


# ---------------------------------------------------------------- emulatory
def emu_ftp(c):
    c.send(b"220 (vsFTPd 3.0.5)\r\n")
    user = None
    while c.cmds < MAX_CMDS:
        ln = c.readline()
        if not ln:
            break
        c.cmd("ftp", ln)
        up = ln.upper()
        if up.startswith(b"USER"):
            user = ln[5:].decode("latin-1").strip()
            c.send(b"331 Please specify the password.\r\n")
        elif up.startswith(b"PASS"):
            c.cred("ftp", user, ln[5:].decode("latin-1").strip())
            c.send(b"530 Login incorrect.\r\n")
        elif up.startswith(b"SYST"):
            c.send(b"215 UNIX Type: L8\r\n")
        elif up.startswith(b"FEAT"):
            c.send(b"211-Features:\r\n UTF8\r\n AUTH TLS\r\n211 End\r\n")
        elif up.startswith(b"QUIT"):
            c.send(b"221 Goodbye.\r\n")
            break
        elif up.startswith(b"AUTH"):
            c.send(b"530 Please login with USER and PASS.\r\n")
        else:
            c.send(b"530 Please login with USER and PASS.\r\n")


def emu_smtp(c):
    c.send(b"220 srv4.cloud.batacek.eu ESMTP Postfix (Debian/GNU)\r\n")
    state = None
    user = None
    while c.cmds < MAX_CMDS:
        ln = c.readline()
        if ln is None:
            break
        if state == "auth_user":
            user = _b64(ln.decode("latin-1").strip()) or ln.decode("latin-1")
            c.cmd("smtp", ln, decoded=user)
            c.send(b"334 UGFzc3dvcmQ6\r\n")
            state = "auth_pass"
            continue
        if state == "auth_pass":
            pw = _b64(ln.decode("latin-1").strip()) or ln.decode("latin-1")
            c.cmd("smtp", ln, decoded=pw)
            c.cred("smtp", user, pw)
            c.send(b"535 5.7.8 Error: authentication failed\r\n")
            state = None
            continue
        if state == "data":
            if ln.strip() == b".":
                c.send(b"250 2.0.0 Ok: queued as 4F2A11C0B7\r\n")
                state = None
            else:
                c.cmd("smtp", ln, phase="data")
            continue
        c.cmd("smtp", ln)
        up = ln.upper()
        if up.startswith((b"EHLO", b"HELO")):
            c.send(b"250-srv4.cloud.batacek.eu\r\n250-PIPELINING\r\n250-SIZE 10240000\r\n"
                   b"250-AUTH PLAIN LOGIN\r\n250-ENHANCEDSTATUSCODES\r\n250 8BITMIME\r\n")
        elif up.startswith(b"AUTH LOGIN"):
            rest = ln[10:].strip()
            if rest:
                user = _b64(rest.decode("latin-1"))
                c.send(b"334 UGFzc3dvcmQ6\r\n")
                state = "auth_pass"
            else:
                c.send(b"334 VXNlcm5hbWU6\r\n")
                state = "auth_user"
        elif up.startswith(b"AUTH PLAIN"):
            rest = ln[10:].strip().decode("latin-1")
            dec = _b64(rest) if rest else None
            if dec:
                parts = dec.split("\x00")
                c.cred("smtp", parts[1] if len(parts) > 2 else dec,
                       parts[2] if len(parts) > 2 else "", extra="PLAIN")
                c.send(b"535 5.7.8 Error: authentication failed\r\n")
            else:
                c.send(b"334 \r\n")
                state = "auth_user"
        elif up.startswith(b"MAIL FROM"):
            c.send(b"250 2.1.0 Ok\r\n")
        elif up.startswith(b"RCPT TO"):
            # relay pokus - zaznamenat, ale nikdy nic neodesilat
            log.emit("relay_attempt", proto="smtp", sess=c.ctx["sess"], src_ip=c.ctx["src_ip"],
                     dst_port=c.ctx["dst_port"], rcpt=printable(ln, 300))
            c.send(b"250 2.1.5 Ok\r\n")
        elif up.startswith(b"DATA"):
            c.send(b"354 End data with <CR><LF>.<CR><LF>\r\n")
            state = "data"
        elif up.startswith(b"QUIT"):
            c.send(b"221 2.0.0 Bye\r\n")
            break
        elif up.startswith(b"RSET"):
            c.send(b"250 2.0.0 Ok\r\n")
        elif up.startswith(b"STARTTLS"):
            c.send(b"454 4.7.0 TLS not available due to temporary reason\r\n")
        else:
            c.send(b"502 5.5.2 Error: command not recognized\r\n")


def emu_pop3(c):
    c.send(b"+OK POP3 server ready\r\n")
    user = None
    while c.cmds < MAX_CMDS:
        ln = c.readline()
        if not ln:
            break
        c.cmd("pop3", ln)
        up = ln.upper()
        if up.startswith(b"USER"):
            user = ln[5:].decode("latin-1").strip()
            c.send(b"+OK\r\n")
        elif up.startswith(b"PASS"):
            c.cred("pop3", user, ln[5:].decode("latin-1").strip())
            c.send(b"-ERR authentication failed\r\n")
        elif up.startswith(b"CAPA"):
            c.send(b"+OK\r\nUSER\r\nTOP\r\n.\r\n")
        elif up.startswith(b"QUIT"):
            c.send(b"+OK\r\n")
            break
        else:
            c.send(b"-ERR unknown command\r\n")


def emu_imap(c):
    c.send(b"* OK [CAPABILITY IMAP4rev1 LOGINDISABLED STARTTLS] Dovecot ready.\r\n")
    while c.cmds < MAX_CMDS:
        ln = c.readline()
        if not ln:
            break
        c.cmd("imap", ln)
        parts = ln.split(None, 2)
        tag = parts[0].decode("latin-1") if parts else "*"
        verb = parts[1].upper() if len(parts) > 1 else b""
        if verb == b"LOGIN" and len(parts) > 2:
            args = parts[2].decode("latin-1").strip()
            m = re.match(r'"?([^"\s]+)"?\s+"?(.*?)"?$', args)
            if m:
                c.cred("imap", m.group(1), m.group(2))
            c.send(("%s NO [AUTHENTICATIONFAILED] Authentication failed.\r\n" % tag).encode())
        elif verb == b"CAPABILITY":
            c.send(b"* CAPABILITY IMAP4rev1 LOGINDISABLED STARTTLS\r\n")
            c.send(("%s OK Completed\r\n" % tag).encode())
        elif verb == b"LOGOUT":
            c.send(b"* BYE Logging out\r\n")
            c.send(("%s OK Logout completed\r\n" % tag).encode())
            break
        else:
            c.send(("%s BAD Error in IMAP command\r\n" % tag).encode())


def emu_redis(c):
    """Redis: utocnici pres nej pisou cron joby a stahuji minery - chceme cely dialog."""
    while c.cmds < MAX_CMDS:
        data = c.readsome(16384, timeout=20)
        if not data:
            break
        c.cmd("redis", data, hex=hexdump(data, 200))
        txt = data.decode("latin-1", "replace").upper()
        if "PING" in txt:
            c.send(b"+PONG\r\n")
        elif "INFO" in txt:
            info = (b"# Server\r\nredis_version:7.0.15\r\nos:Linux 6.12.0 x86_64\r\n"
                    b"arch_bits:64\r\nprocess_id:1213\r\n# Keyspace\r\ndb0:keys=17,expires=0\r\n")
            c.send(b"$%d\r\n" % len(info) + info + b"\r\n")
        elif "AUTH" in txt:
            m = re.findall(r"\$\d+\r\n([^\r\n]+)", data.decode("latin-1", "replace"))
            if len(m) >= 2:
                c.cred("redis", m[-2] if len(m) > 2 else "default", m[-1])
            c.send(b"+OK\r\n")
        elif "CONFIG" in txt and "GET" in txt:
            c.send(b"*2\r\n$3\r\ndir\r\n$14\r\n/var/lib/redis\r\n")
        elif "COMMAND" in txt or "DOCS" in txt:
            c.send(b"*0\r\n")
        elif "QUIT" in txt:
            c.send(b"+OK\r\n")
            break
        else:
            c.send(b"+OK\r\n")


def emu_mysql(c):
    # MySQL greeting - klient posle uzivatele v plaintextu
    payload = (b"\x0a" + b"8.0.36-0ubuntu0.22.04.1\x00" + b"\x0b\x00\x00\x00"
               + os.urandom(8) + b"\x00" + b"\xff\xf7" + b"\x21" + b"\x02\x00"
               + b"\xff\x81" + b"\x15" + b"\x00" * 10 + os.urandom(12) + b"\x00"
               + b"mysql_native_password\x00")
    hdr = len(payload).to_bytes(3, "little") + b"\x00"
    c.send(hdr + payload)
    data = c.readsome(8192, timeout=15)
    if data:
        m = re.search(rb"[\x00-\xff]{32}([A-Za-z0-9_.\-]{2,32})\x00", data[:200])
        user = m.group(1).decode("latin-1") if m else None
        c.cmd("mysql", data, hex=hexdump(data, 300), user=user)
        if user:
            c.cred("mysql", user, "<hashed>", extra="native_password")
        err = b"\xff\x15\x04#28000Access denied for user"
        c.send(len(err).to_bytes(3, "little") + b"\x02" + err)


def emu_pgsql(c):
    data = c.readsome(8192, timeout=15)
    if not data:
        return
    txt = data.decode("latin-1", "replace")
    user = None
    m = re.search(r"user\x00([^\x00]+)", txt)
    if m:
        user = m.group(1)
    db = None
    m2 = re.search(r"database\x00([^\x00]+)", txt)
    if m2:
        db = m2.group(1)
    c.cmd("postgres", data, hex=hexdump(data, 300), user=user, database=db)
    if user:
        c.cred("postgres", user, "<startup>", extra="db=%s" % db)
    # AuthenticationCleartextPassword
    c.send(b"R\x00\x00\x00\x08\x00\x00\x00\x03")
    more = c.readsome(4096, timeout=10)
    if more:
        m3 = re.match(rb"p\x00\x00\x00.(.*)\x00", more, re.S)
        pw = m3.group(1).decode("latin-1", "replace") if m3 else printable(more, 200)
        c.cred("postgres", user, pw, extra="cleartext")
        c.send(b"E\x00\x00\x00\x40SFATAL\x00C28P01\x00Mpassword authentication failed\x00\x00")


def emu_vnc(c):
    c.send(b"RFB 003.008\n")
    data = c.readsome(1024, timeout=15)
    if data:
        c.cmd("vnc", data, hex=hexdump(data, 100))
        c.send(b"\x01\x02")   # 1 sec type: VNC auth
        ch = c.readsome(1024, timeout=10)
        if ch:
            c.cmd("vnc", ch, phase="challenge_response", hex=hexdump(ch, 100))
            c.send(b"\x00\x00\x00\x01")


def emu_telnet(c):
    c.send(b"\xff\xfd\x18\xff\xfd\x20\xff\xfd\x23\xff\xfd\x27")
    c.send(b"\r\nsrv4 login: ")
    user = None
    for i in range(6):
        ln = c.readline(timeout=20)
        if ln is None:
            break
        ln = ln.replace(b"\xff", b"")
        c.cmd("telnet", ln)
        if user is None:
            user = printable(ln, 100).strip()
            c.send(b"Password: ")
        else:
            c.cred("telnet", user, printable(ln, 100).strip())
            c.send(b"\r\nLogin incorrect\r\nsrv4 login: ")
            user = None


def emu_sip(c):
    data = c.readsome(8192, timeout=15)
    if not data:
        return
    c.cmd("sip", data)
    first = data.split(b"\r\n", 1)[0]
    m = re.search(rb"CSeq:\s*(\d+)\s+(\w+)", data)
    c.send(b"SIP/2.0 401 Unauthorized\r\nWWW-Authenticate: Digest realm=\"asterisk\","
           b"nonce=\"1a2b3c4d\"\r\nContent-Length: 0\r\n\r\n")
    more = c.readsome(8192, timeout=10)
    if more:
        c.cmd("sip", more, phase="after_401")


def emu_memcached(c):
    while c.cmds < MAX_CMDS:
        ln = c.readline(timeout=15)
        if not ln:
            break
        c.cmd("memcached", ln)
        up = ln.upper()
        if up.startswith(b"VERSION"):
            c.send(b"VERSION 1.6.24\r\n")
        elif up.startswith(b"STATS"):
            c.send(b"STAT pid 913\r\nSTAT version 1.6.24\r\nSTAT curr_items 0\r\nEND\r\n")
        elif up.startswith(b"QUIT"):
            break
        else:
            c.send(b"ERROR\r\n")


def emu_binary(proto):
    """Obecny sniffer pro binarni protokoly (SMB, RDP, MSSQL, Mongo...)."""
    def f(c):
        for i in range(6):
            data = c.readsome(16384, timeout=12)
            if not data:
                break
            extra = {}
            m = re.search(rb"mstshash=([\x20-\x7e]{1,64})", data)
            if m:
                extra["rdp_cookie"] = m.group(1).decode("latin-1")
            sha, stored = (None, 0)
            if len(data) > 400:
                sha, stored = log.store_body(data)
            c.cmd(proto, data, hex=hexdump(data, 400), nbytes=len(data),
                  sha256=sha, **extra)
            if proto == "rdp" and i == 0:
                c.send(b"\x03\x00\x00\x13\x0e\xd0\x00\x00\x124\x00\x02\x00\x08\x00\x00\x00\x00\x00")
            elif proto == "smb" and i == 0:
                c.send(b"\x00\x00\x00\x55\xffSMBr\x00\x00\x00\x00\x88\x01\x40\x00")
            elif proto == "mssql" and i == 0:
                c.send(b"\x04\x01\x00\x25\x00\x00\x01\x00\x00\x00\x15\x00\x06\x01\x00\x1b"
                       b"\x00\x01\x02\x00\x1c\x00\x0c\x03\x00\x28\x00\x04\xff\x0f\x00\x0f"
                       b"\xa0\x00\x00\x02\x00")
            else:
                break
    return f


def emu_generic(c):
    """Neznamy port: pockame, co protistrana posle, a podle toho se zaridime."""
    data = c.readsome(16384, timeout=12)
    if not data:
        log.emit("connect_only", sess=c.ctx["sess"], src_ip=c.ctx["src_ip"],
                 src_port=c.ctx["src_port"], dst_port=c.ctx["dst_port"])
        return
    if re.match(rb"^(GET|POST|HEAD|PUT|DELETE|OPTIONS|CONNECT|PATCH|TRACE|PROPFIND)\s", data):
        c.buf = data
        srv_http(c)
        return
    sha, stored = log.store_body(data) if len(data) > 400 else (None, 0)
    c.cmd("unknown", data, hex=hexdump(data, 400), nbytes=len(data), sha256=sha)
    for i in range(3):
        more = c.readsome(16384, timeout=8)
        if not more:
            break
        c.cmd("unknown", more, hex=hexdump(more, 400), nbytes=len(more))


def srv_http(c):
    """Predame spojeni HTTP emulaci (sdilene s hpweb)."""
    class Pre:
        def __init__(self, sock, pre):
            self.s = sock
            self.pre = pre
        def recv(self, n):
            if self.pre:
                d, self.pre = self.pre[:n], self.pre[n:]
                return d
            return self.s.recv(n)
        def sendall(self, d):
            return self.s.sendall(d)
        def settimeout(self, t):
            return self.s.settimeout(t)
    hphttp.serve(Pre(c.s, c.buf), c.ctx, log)


PORT_MAP = {
    21: emu_ftp, 990: emu_ftp,
    23: emu_telnet, 2323: emu_telnet, 23231: emu_telnet, 992: emu_telnet,
    25: emu_smtp, 465: emu_smtp, 587: emu_smtp, 2525: emu_smtp,
    110: emu_pop3, 995: emu_pop3,
    143: emu_imap, 993: emu_imap,
    3306: emu_mysql, 33060: emu_mysql,
    5432: emu_pgsql,
    6379: emu_redis, 6380: emu_redis,
    5900: emu_vnc, 5901: emu_vnc, 5800: emu_vnc,
    5060: emu_sip, 5061: emu_sip,
    11211: emu_memcached,
    445: emu_binary("smb"), 139: emu_binary("smb"),
    3389: emu_binary("rdp"), 3388: emu_binary("rdp"),
    1433: emu_binary("mssql"), 1434: emu_binary("mssql"),
    27017: emu_binary("mongodb"), 27018: emu_binary("mongodb"),
    1521: emu_binary("oracle"), 502: emu_binary("modbus"), 102: emu_binary("s7"),
    47808: emu_binary("bacnet"), 20000: emu_binary("dnp3"),
}
HTTP_PORTS = {80, 81, 88, 591, 2375, 2376, 4243, 5000, 7001, 7547, 8000, 8001, 8008,
              8009, 8060, 8069, 8080, 8081, 8088, 8090, 8123, 8161, 8181, 8443, 8888,
              9000, 9090, 9100, 9200, 9300, 10000, 55555}


def handle(conn, addr):
    sess = uuid.uuid4().hex[:16]
    t0 = time.time()
    src_ip = addr[0]
    if src_ip.startswith("::ffff:"):
        src_ip = src_ip[7:]
    odst_ip, odst_port = orig_dst(conn)
    if odst_port is None:
        try:
            odst_port = conn.getsockname()[1]
        except OSError:
            odst_port = 0
    ctx = {"sess": sess, "src_ip": src_ip, "src_port": addr[1], "dst_port": odst_port,
           "tls": None}
    c = Conn(conn, ctx)
    proto = "generic"
    try:
        log.emit("conn_open", sess=sess, src_ip=src_ip, src_port=addr[1], dst_port=odst_port)
        fn = PORT_MAP.get(odst_port)
        if fn is None and odst_port in HTTP_PORTS:
            fn = srv_http
            proto = "http"
        if fn is None:
            fn = emu_generic
        else:
            proto = getattr(fn, "__name__", "emu").replace("emu_", "")
        conn.settimeout(20)
        fn(c)
    except Exception as e:
        log.emit("handler_error", sess=sess, src_ip=src_ip, dst_port=odst_port,
                 error=str(e)[:300], trace=traceback.format_exc()[-800:])
    finally:
        log.emit("conn_close", sess=sess, src_ip=src_ip, src_port=addr[1],
                 dst_port=odst_port, proto=proto, cmds=c.cmds, creds=len(c.creds),
                 duration=round(time.time() - t0, 3))
        try:
            conn.shutdown(socket.SHUT_RDWR)
        except OSError:
            pass
        try:
            conn.close()
        except OSError:
            pass
        sem.release()


def heartbeat():
    while True:
        time.sleep(300)
        log.emit("heartbeat", conns=stats["conn"], rejected=stats["rejected"],
                 events=log.count, log_errors=log.dropped, threads=threading.active_count())


def main():
    log.emit("service_start", pid=os.getpid(), version=1)
    threading.Thread(target=heartbeat, daemon=True).start()
    s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
    s.bind(("::", LISTEN_PORT))
    s.listen(1024)
    log.emit("listener_up", port=LISTEN_PORT)
    while True:
        try:
            conn, addr = s.accept()
        except OSError as e:
            log.emit("accept_error", error=str(e)[:200])
            time.sleep(0.5)
            continue
        if not sem.acquire(blocking=False):
            stats["rejected"] += 1
            try:
                conn.close()
            except OSError:
                pass
            continue
        stats["conn"] += 1
        threading.Thread(target=handle, args=(conn, addr), daemon=True).start()


if __name__ == "__main__":
    main()
PYEOF
cd /opt/honeypot/bin && python3 -c "import sys; sys.path.insert(0,'.'); import hptcp; print('hptcp OK, portmap:', len(hptcp.PORT_MAP), 'http:', len(hptcp.HTTP_PORTS))"

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 31 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

systemctl status hpweb --no-pager -l | tail -15; echo "=== JOURNAL hpweb ==="; journalctl -u hpweb -n 25 --no-pager | tail -25; echo "=== JOURNAL hptcp ==="; journalctl -u hptcp -n 15 --no-pager | tail -15

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 4.994 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

ls -ldn /var/log /var/log/honeypot /var/log/honeypot/bodies; echo "--- test zapisu jako hpsvc (bez systemd) ---"; runuser -u hpsvc -- sh -c 'touch /var/log/honeypot/_t && echo ZAPIS-OK && rm /var/log/honeypot/_t' 2>&1; echo "--- test se systemd sandboxem ---"; systemd-run --quiet --wait --pipe -p User=hpsvc -p ProtectSystem=strict -p ReadWritePaths=/var/log/honeypot /bin/sh -c 'touch /var/log/honeypot/_t2 && echo SANDBOX-OK && rm /var/log/honeypot/_t2' 2>&1; echo "--- existujici soubory ---"; ls -la /var/log/honeypot/

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 652 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

chown hpsvc:hpsvc /var/log/honeypot/hpweb.jsonl /var/log/honeypot/hptcp.jsonl
systemctl restart hpweb hptcp; sleep 4
systemctl is-active hpweb hptcp
echo "--- listeny ---"; ss -tlpnH | grep -E '42000|42280|42443'
echo "--- lokalni test HTTP ---"
curl -s -m 5 -o /dev/null -w 'http42280: %{http_code}\n' http://127.0.0.1:42280/
curl -s -m 5 -o /dev/null -w 'https42443: %{http_code}\n' -k https://127.0.0.1:42443/
curl -s -m 5 http://127.0.0.1:42280/.env | head -3
echo "--- lokalni test catch-all (dostane port 42000 = generic) ---"
printf 'PING\r\n' | timeout 5 nc 127.0.0.1 42000 | head -c 100; echo
echo "--- udalosti ---"; wc -l /var/log/honeypot/hpweb.jsonl /var/log/honeypot/hptcp.jsonl; tail -2 /var/log/honeypot/hpweb.jsonl

runner

srv4 - honeypot

timeout_seconds

90

Ergebnis

[Ausgabe ausgeblendet · 1.294 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cd /opt/cowrie && runuser -u cowrie -- git clone --depth 1 https://github.com/cowrie/cowrie.git /opt/cowrie/cowrie 2>&1 | tail -3; ls /opt/cowrie/cowrie | head -20; echo "--- verze ---"; cd /opt/cowrie/cowrie && git log -1 --format='%H %ad %s' 2>/dev/null; echo "--- requirements ---"; head -20 requirements.txt

runner

srv4 - honeypot

timeout_seconds

180

Ergebnis

[Ausgabe ausgeblendet · 596 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cd /opt/cowrie/cowrie && runuser -u cowrie -- python3 -m venv cowrie-env 2>&1 | tail -2 && runuser -u cowrie -- ./cowrie-env/bin/pip install --quiet --upgrade pip setuptools wheel 2>&1 | tail -3 && runuser -u cowrie -- ./cowrie-env/bin/pip install --quiet -r requirements.txt 2>&1 | tail -8; echo "pip exit=$?"; ./cowrie-env/bin/python -c "import twisted, cryptography, bcrypt; print('cowrie deps OK, twisted', twisted.__version__)"

runner

srv4 - honeypot

timeout_seconds

900

Ergebnis

[Ausgabe ausgeblendet · 233 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cd /opt/cowrie/cowrie; echo "=== userdb.example ==="; cat etc/userdb.example 2>/dev/null | head -20; echo; echo "=== endpoints v dist ==="; grep -nE '^(listen_endpoints|version|enabled|hostname|ttylog|backend|auth_class)' etc/cowrie.cfg.dist | head -30; echo; echo "=== bin/cowrie usage ==="; grep -nE '\-n|foreground|DAEMONIZE' bin/cowrie | head -15

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 75 Zeichen]

[Ausgabe ausgeblendet · 97 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cd /opt/cowrie/cowrie; echo "=== bin ==="; ls -la bin; echo "=== etc ==="; ls -la etc; echo "=== src ==="; ls src; ls src/* | head -20; echo "=== console_scripts ==="; grep -A5 'scripts' pyproject.toml | head -20; echo "=== venv bin ==="; ls cowrie-env/bin | head -30

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 1.501 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cd /opt/cowrie/cowrie; echo "=== klicove volby v cowrie.cfg.dist ==="; grep -nE '^\[|^#?\s*(listen_endpoints|version|enabled|hostname|ttylog|backend|auth_class|log_path|state_path|download_path|share_path|contents_path|txtcmds_path|etc_path|filesystem|processes|timezone|report_public_ip|download_limit_size)' src/cowrie/data/etc/cowrie.cfg.dist | head -80

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 2.230 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cd /opt/cowrie/cowrie; echo "=== userdb parser ==="; sed -n '1,120p' src/cowrie/core/auth.py | grep -nE 'class |def |userdb|\*|passwd|wildcard' | head -30; echo; echo "=== priklad userdb v repo ==="; find . -name 'userdb*' -not -path './cowrie-env/*' | head; echo; echo "=== sekce ssh 646-700 ==="; sed -n '646,700p' src/cowrie/data/etc/cowrie.cfg.dist | grep -vE '^\s*#|^$' | head -20; echo "=== output_jsonlog ==="; sed -n '897,906p' src/cowrie/data/etc/cowrie.cfg.dist

runner

srv4 - honeypot

timeout_seconds

60

Ergebnis

[Ausgabe ausgeblendet · 1.937 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block

Anruf

HoneypotMCP:execute_command HoneypotMCP

Execute command

Eingang

cd /opt/cowrie/cowrie
mkdir -p etc var/log/cowrie var/lib/cowrie var/run
cat > etc/cowrie.cfg <<'EOF'
# Konfigurace honeypotu srv4 - prepis vychozich hodnot z cowrie.cfg.dist
[honeypot]
hostname = srv04
log_path = var/log/cowrie
state_path = var/lib/cowrie
download_path = ${honeypot:state_path}/downloads
etc_path = etc
backend = shell
timezone = UTC
auth_class = UserDB
ttylog = true
ttylog_path = ${honeypot:state_path}/tty
download_limit_size = 1048576

[ssh]
enabled = true
listen_endpoints = tcp:42222:interface=0.0.0.0 tcp6:42222:interface=\:\:

[telnet]
enabled = true
listen_endpoints = tcp:42223:interface=0.0.0.0 tcp6:42223:interface=\:\:

[output_jsonlog]
enabled = true
logfile = ${honeypot:log_path}/cowrie.json
epoch_timestamp = true

[output_textlog]
enabled = false
EOF
# Databaze uctu: pustime dovnitr skoro kohokoli, chceme videt, co udelaji po prihlaseni.
cat > etc/userdb.txt <<'EOF'
# format: uzivatel:x:heslo   ('*' = cokoli, '!' = zakazat, /regex/ podporovan)
root:x:!root
root:x:!123456
root:x:!password
root:x:*
admin:x:*
administrator:x:*
ubuntu:x:*
debian:x:*
user:x:*
test:x:*
guest:x:*
oracle:x:*
postgres:x:*
mysql:x:*
git:x:*
ftp:x:*
pi:x:*
support:x:*
service:x:*
deploy:x:*
docker:x:*
jenkins:x:*
nagios:x:*
tomcat:x:*
www-data:x:*
dev:x:*
*:x:*
EOF
chown -R cowrie:cowrie /opt/cowrie/cowrie/etc /opt/cowrie/cowrie/var
ls src/twisted/plugins/ 2>/dev/null
echo "=== zkusebni start (25 s) ==="
runuser -u cowrie -- sh -c 'cd /opt/cowrie/cowrie && timeout 25 ./cowrie-env/bin/twistd -n -l - --umask=0022 --pidfile= cowrie 2>&1' | head -40

runner

srv4 - honeypot

timeout_seconds

120

Ergebnis

[Ausgabe ausgeblendet · 3.460 Zeichen]

Die Textdarstellung des Ergebnisses entspricht dem oben aufgeführten strukturierten Ergebnis.

Die Vorschau für die Anwendung (display_content) entspricht dem Ergebnis.

Vorschau für die App

type

json_block