0×00 前言
0×01 安装Python
0×02 部署依赖
2.1 安装PIP
2.2 安装VirtualEnv
2.3 创建Python虚拟环境
2.4 安装Opencananry
0×03 管理配置
from opencanary.modules import CanaryServicefrom twisted.application import internetfrom twisted.protocols.ftp import FTPFactory, FTPRealm, FTP,USR_LOGGED_IN_PROCEED, GUEST_LOGGED_IN_PROCEED, IFTPShell,AuthorizationErrorfrom twisted.cred.portal import Portalfrom zope.interface import implementsfrom twisted.cred.checkers import ICredentialsCheckerfrom twisted.python import failurefrom twisted.cred import error as cred_error, credentialsFTP_PATH = "/briar/data/ftp"class DenyAllAccess:implements(ICredentialsChecker)credentialInterfaces = (credentials.IAnonymous, credentials.IUsernamePassword)def requestAvatarId(self, credentials):return failure.Failure(cred_error.UnauthorizedLogin())class LoggingFTP(FTP):#ripped from main FTP class, overridden to extract connection infodef ftp_PASS(self, password):"""Second part of login. Get the password the peer wants toauthenticate with."""if self.factory.allowAnonymous and self._user == self.factory.userAnonymous:# anonymous logincreds = credentials.Anonymous()reply = GUEST_LOGGED_IN_PROCEEDelse:# user logincreds = credentials.UsernamePassword(self._user, password)reply = USR_LOGGED_IN_PROCEEDlogdata = {'USERNAME': self._user, 'PASSWORD': password}self.factory.canaryservice.log(logdata, transport=self.transport)del self._userdef _cbLogin((interface, avatar, logout)):assert interface is IFTPShell, "The realm is busted, jerk."self.shell = avatarself.logout = logoutself.workingDirectory = []self.state = self.AUTHEDreturn replydef _ebLogin(failure):failure.trap(cred_error.UnauthorizedLogin, cred_error.UnhandledCredentials)self.state = self.UNAUTHraise AuthorizationErrord = self.portal.login(creds, None, IFTPShell)d.addCallbacks(_cbLogin, _ebLogin)return dclass CanaryFTP(CanaryService):NAME = 'ftp'def __init__(self,config=None, logger=None):CanaryService.__init__(self, config=config, logger=logger)self.banner = config.getVal('ftp.banner', default='FTP Ready.').encode('utf8')self.port = config.getVal('ftp.port', default=21)# find a place to check that logtype is initialised# find a place to check that factory has service attachedself.logtype = logger.LOG_FTP_LOGIN_ATTEMPTself.listen_addr = config.getVal('device.listen_addr', default='')def getService(self):p = Portal(FTPRealm(FTP_PATH), [DenyAllAccess()])f = FTPFactory(p)f.protocol = LoggingFTPf.welcomeMessage = self.bannerf.canaryservice = selfreturn internet.TCPServer(self.port, f, interface=self.listen_addr)
ftp监听服代码在80多行，就完成模拟服务，可以看到使用twisted库。
from twisted.application import internetfrom twisted.protocols.ftp import FTPFactory, FTPRealm, FTP,USR_LOGGED_IN_PROCEED, GUEST_LOGGED_IN_PROCEED, IFTPShell,AuthorizationError
{"device.node_id": "opencanary-1","git.enabled": false,"git.port" : 9418,"ftp.enabled": true,"ftp.port": 21,"ftp.banner": "FTP server ready","http.banner": "Apache/2.2.22 (Ubuntu)","http.enabled": false,"http.port": 80,"http.skin": "nasLogin","http.skin.list": [{"desc": "Plain HTML Login","name": "basicLogin"},{"desc": "Synology NAS Login","name": "nasLogin"}],"httpproxy.enabled" : false,"httpproxy.port": 8080,"httpproxy.skin": "squid","httproxy.skin.list": [{"desc": "Squid","name": "squid"},{"desc": "Microsoft ISA Server Web Proxy","name": "ms-isa"}],"logger": {"class": "PyLogger","kwargs": {"formatters": {"plain": {"format": "%(message)s"}},"handlers": {"console": {"class": "logging.StreamHandler","stream": "ext://sys.stdout"},"file": {"class": "logging.FileHandler","filename": "/var/tmp/opencanary.log"}}}},"portscan.enabled": false,"portscan.logfile":"/var/log/kern.log","portscan.synrate": 5,"portscan.nmaposrate": 5,"portscan.lorate": 3,"smb.auditfile": "/var/log/samba-audit.log","smb.enabled": false,"mysql.enabled": false,"mysql.port": 3306,"mysql.banner": "5.5.43-0ubuntu0.14.04.1","ssh.enabled": false,"ssh.port": 22,"ssh.version": "SSH-2.0-OpenSSH_5.1p1 Debian-4","redis.enabled": false,"redis.port": 6379,"rdp.enabled": false,"rdp.port": 3389,"sip.enabled": false,"sip.port": 5060,"snmp.enabled": false,"snmp.port": 161,"ntp.enabled": false,"ntp.port": "123","tftp.enabled": false,"tftp.port": 69,"tcpbanner.maxnum":10,"tcpbanner.enabled": false,"tcpbanner_1.enabled": false,"tcpbanner_1.port": 8001,"tcpbanner_1.datareceivedbanner": "","tcpbanner_1.initbanner": "","tcpbanner_1.alertstring.enabled": false,"tcpbanner_1.alertstring": "","tcpbanner_1.keep_alive.enabled": false,"tcpbanner_1.keep_alive_secret": "","tcpbanner_1.keep_alive_probes": 11,"tcpbanner_1.keep_alive_interval":300,"tcpbanner_1.keep_alive_idle": 300,"telnet.enabled": false,"telnet.port": "23","telnet.banner": "","telnet.honeycreds": [{"username": "admin","password": "$pbkdf2-sha512$19000$bG1NaY3xvjdGyBlj7N37Xw$dGrmBqqWa1okTCpN3QEmeo9j5DuV2u1EuVFD8Di0GxNiM64To5O/Y66f7UASvnQr8.LCzqTm6awC8Kj/aGKvwA"},{"username": "admin","password": "admin1"}],"mssql.enabled": false,"mssql.version": "2012","mssql.port":1433,"vnc.enabled": false,"vnc.port":5000}
opencanaryd --start当所有的模拟监听服务都打开的时候，会出现类似下面的进程信息。
netstat -plunttcp 0 0 0.0.0.0:2222 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:1433 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:3389 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:8001 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:5000 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:9418 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN 12683/pythontcp 0 0 0.0.0.0:6379 0.0.0.0:* LISTEN 12683/pythonudp 0 0 0.0.0.0:57197 0.0.0.0:* 8994/pythonudp 0 0 0.0.0.0:5060 0.0.0.0:* 12683/pythonudp 0 0 0.0.0.0:69 0.0.0.0:* 12683/pythonudp 0 0 0.0.0.0:123 0.0.0.0:* 12683/pythonudp 0 0 0.0.0.0:161 0.0.0.0:* 12683/python
重启服务
opencanaryd --restartopencanaryd --stopopencanaryd --help0×04 报警日志
[root@localhost opencanary]# ftp 192.168.0.6Connected to 192.168.0.6 (192.168.0.6).220 FTP server readyName (192.168.0.6:root): test331 Password required for test.Password:530 Sorry, Authentication failed.Login failed.ftp>
这个过程交互结束之后，就会生成一条json数据，json日志数据如下：
{"src_port": 35990, "logdata": {"USERNAME": "test", "PASSWORD": "123456"}, "logtype": 2000, "dst_host": "192.168.0.6", "dst_port": 21, "src_host": "192.168.0.5"}4.1 HTTP
curl 0.0.0.0:80日志数据
{"dst_host": "172.18.200.58", "dst_port": 80, "local_time": "2019-01-07 13:47:45.817940", "logdata": {"HOSTNAME": "172.18.200.58", "PASSWORD": "admin888", "PATH": "/index.html", "SKIN": "nasLogin", "USERAGENT": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:61.0) Gecko/20100101 Firefox/61.0", "USERNAME": "admin"}, "logtype": 3001, "node_id": "opencanary-1", "src_host": "172.18.205.14", "src_port": 54488}
4.2 FTP
ftp 172.12.200.58日志数据
{"dst_host": "172.18.200.58", "dst_port": 80, "local_time": "2019-01-07 13:47:45.817940", "logdata": {"HOSTNAME": "172.18.200.58", "PASSWORD": "admin888", "PATH": "/index.html", "SKIN": "nasLogin", "USERAGENT": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:61.0) Gecko/20100101 Firefox/61.0", "USERNAME": "admin"}, "logtype": 3001, "node_id": "opencanary-1", "src_host": "172.18.205.14", "src_port": 54488}4.3 SSH
ssh root@172.18.200.58日志
{"dst_host": "172.18.200.58", "dst_port": 2222, "local_time": "2019-01-07 13:54:27.811101", "logdata": {"SESSION": "3"}, "logtype": 4000, "node_id": "opencanary-1", "src_host": "172.18.205.14", "src_port": 54639}
4.4 Telnet
telnet 172.18.200.58日志数据
{"dst_host": "172.18.200.58", "dst_port": 23, "honeycred": false, "local_time": "2019-01-07 13:56:45.341785", "logdata": {"PASSWORD": "admin888", "USERNAME": "admin123"}, "logtype": 6001, "node_id": "opencanary-1", "src_host": "172.18.205.14", "src_port": 54676}4.5 Mysql
mysql -h172.18.200.58 -uroot -p日志数据
{"dst_host": "172.18.200.58", "dst_port": 3306, "local_time": "2019-01-07 13:58:25.922257", "logdata": {"PASSWORD": "18076c09615de80ddb2903191b783714918b4c4f", "USERNAME": "root"}, "logtype": 8001, "node_id": "opencanary-1", "src_host": "172.18.220.253", "src_port": 46662}
4.6 Git
git clone git://192.168.1.7:9418/tmp.git
日志数据
{"dst_host": "192.168.1.7", "dst_port": 9418, "local_time": "2019-01-05 15:38:46.368627", "logdata": {"HOST": "192.168.1.7:9418", "REPO": "tmp.git"}, "logtype": 16001, "node_id": "opencanary-1", "src_host": "192.168.1.3", "src_port": 57606}4.7 NTP
git clone git://192.168.1.7:9418/tmp.git日志数据
{"dst_host": "0.0.0.0", "dst_port": 123, "local_time": "2019-01-05 15:58:52.075987", "logdata": {"NTP CMD": "monlist"}, "logtype": 11001, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": 57886}4.8 Redis
(env) [root@honeypot Honeypot]日志数据
{"dst_host": "192.168.1.7", "dst_port": 6379, "local_time": "2019-01-05 16:05:11.637269", "logdata": {"ARGS": "", "CMD": "COMMAND"}, "logtype": 17001, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": 34471}
4.9 TCP
telnet 192.168.1.6 8001日志
{"dst_host": "192.168.1.6", "dst_port": 8001, "local_time": "2019-01-05 17:18:51.601478", "logdata": {"BANNER_ID": "1", "DATA": "", "FUNCTION": "CONNECTION_MADE"}, "logtype": 18002, "node_id": "opencanary-1", "src_host": "192.168.1.3", "src_port": 59176}4.10 VNC
{"dst_host": "192.168.1.7", "dst_port": 5000, "local_time": "2019-01-06 08:21:28.951940", "logdata": {"VNC Client Response": "58c00be9ee5b7f3b666771dd2bda9309", "VNC Password": "<Password was not in the common list>", "VNC Server Challenge": "953e2dff7e4d3a3114527c282817ce1d"}, "logtype": 12001, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": 54634}
4.11 RDP
{"dst_host": "192.168.1.7", "dst_port": 3389, "local_time": "2019-01-06 08:59:13.890934", "logdata": {"DOMAIN": "", "HOSTNAME": "HelloHost", "PASSWORD": "helloword", "USERNAME": "administrator1"}, "logtype": 14001, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": 59955}4.12 SIP
hydra -l adminsip -p password 192.168.1.7 sip日志格式
{"dst_host": "0.0.0.0", "dst_port": 5060, "local_time": "2019-01-06 09:55:12.578148", "logdata": {"HEADERS": {"call-id": ["[email protected]"], "content-length": ["0"], "cseq": ["1 REGISTER"], "from": ["<sip:[email protected]>"], "to": ["<sip:[email protected]>"], "via": ["SIP/2.0/UDP 10.0.2.15:46759;received=192.168.1.7"]}}, "logtype": 15001, "node_id": "opencanary-1", "src_host": "192.168.1.7", "src_port": 46759}
4.13 SNMP
hydra -p password 192.168.1.7 snmp日志数据
{"dst_host": "0.0.0.0", "dst_port": 161, "local_time": "2019-01-06 11:17:27.266214", "logdata": {"COMMUNITY_STRING": "password", "REQUESTS": ["1.3.6.1.2.1.1.1"]}, "logtype": 13001, "node_id": "opencanary-1", "src_host": "192.168.1.7", "src_port": 47112}
4.14 NMAP
sudo nmap -v -Pn -O 192.168.1.7日志数据
{"dst_host": "192.168.1.7", "dst_port": "21", "local_time": "2019-01-06 16:35:24.356080", "logdata": {"FIN": "", "ID": "37499", "IN": "eth1", "LEN": "60", "MAC": "08:00:27:da:4c:e2:6c:96:cf:dd:ee:bd:08:00", "OUT": "", "PREC": "0x00", "PROTO": "TCP", "PSH": "", "RES": "0x00", "SYN": "", "TOS": "0x00", "TTL": "56", "URG": "", "URGP": "0", "WINDOW": "256"}, "logtype": 5002, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": "40098"}
4.15 SYN探测
sudo nmap -sS 192.168.1.7
日志数据
{"dst_host": "192.168.1.7", "dst_port": "21", "local_time": "2019-01-06 16:35:24.190176", "logdata": {"ID": "51918", "IN": "eth1", "LEN": "56", "MAC": "08:00:27:da:4c:e2:6c:96:cf:dd:ee:bd:08:00", "OUT": "", "PREC": "0x00", "PROTO": "TCP", "RES": "0x00", "SYN": "", "TOS": "0x00", "TTL": "58", "URGP": "0", "WINDOW": "512"}, "logtype": 5001, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": "40088"}
4.16 FIN探测
sudo nmap -sF 192.168.1.7
日志数据
{"dst_host": "192.168.1.7", "dst_port": "23", "local_time": "2019-01-06 16:46:18.336954", "logdata": {"FIN": "", "ID": "29768", "IN": "eth1", "LEN": "40", "MAC": "08:00:27:da:4c:e2:6c:96:cf:dd:ee:bd:08:00", "OUT": "", "PREC": "0x00", "PROTO": "TCP", "RES": "0x00", "TOS": "0x00", "TTL": "59", "URGP": "0", "WINDOW": "1024"}, "logtype": 5005, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": "35116"}
4.17 XmasTree探测
sudo nmap -sX 192.168.1.7{"dst_host": "192.168.1.7", "dst_port": "139", "local_time": "2019-01-06 16:48:46.225539", "logdata": {"FIN": "", "ID": "19984", "IN": "eth1", "LEN": "40", "MAC": "08:00:27:da:4c:e2:6c:96:cf:dd:ee:bd:08:00", "OUT": "", "PREC": "0x00", "PROTO": "TCP", "PSH": "", "RES": "0x00", "TOS": "0x00", "TTL": "56", "URG": "", "URGP": "0", "WINDOW": "1024"}, "logtype": 5004, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": "50913"}4.18 Null探测
sudo nmap -sN 192.168.1.7{"dst_host": "192.168.1.7", "dst_port": "5060", "local_time": "2019-01-06 16:51:07.789903", "logdata": {"ID": "26441", "IN": "eth1", "LEN": "40", "MAC": "08:00:27:da:4c:e2:6c:96:cf:dd:ee:bd:08:00", "OUT": "", "PREC": "0x00", "PROTO": "TCP", "RES": "0x00", "TOS": "0x00", "TTL": "50", "URGP": "0", "WINDOW": "1024"}, "logtype": 5003, "node_id": "opencanary-1", "src_host": "192.168.1.6", "src_port": "58015"}4.19 MSSQL
{"dst_host": "172.18.200.58", "dst_port": 1433, "local_time": "2019-01-07 09:04:58.690137", "logdata": {"AppName": "SQLPro for MSSQL (hankinsoft.com)", "CltIntName": "DB-Library", "Database": "test", "HostName": "Piroguehost", "Language": "us_english", "Password": "sa123456", "ServerName": "172.18.200.58:1433", "UserName": "sa"}, "logtype": 9001, "node_id": "opencanary-1", "src_host": "172.18.205.14", "src_port": 64344}4.20 HTTPProxy
{"dst_host": "172.18.200.58", "dst_port": 8080, "local_time": "2019-01-07 13:26:47.761297", "logdata": {"PASSWORD": "passsquid", "USERNAME": "squidadmin"}, "logtype": 7001, "node_id": "opencanary-1", "src_host": "172.18.205.14", "src_port": 53798}0×05 Opencanary的功能扩展
/usr/lib/python2.7/site-packages/opencanarydef log(self, logdata, retry=True):import syslog_clientgraylog = syslog_client.Syslog("198.168.0.8")graylog.send(json.dumps(logdata), syslog_client.Level.INFO)logdata = self.sanitizeLog(logdata)self.logger.warn(json.dumps(logdata, sort_keys=True))
下面这句话是写日志，
self.logger.warn(json.dumps(logdata, sort_keys=True))我们另外加入几行转发syslog的日志处理：
import syslog_clientgraylog = syslog_client.Syslog("198.168.0.8")graylog.send(json.dumps(logdata), syslog_client.Level.INFO)
"logger": {"class": "PyLogger","kwargs": {"formatters": {"plain": {"format": "%(message)s"}},"handlers": {"console": {"class": "logging.StreamHandler","stream": "ext://sys.stdout"},"file": {"class": "logging.FileHandler","filename": "/var/tmp/opencanary.log"}}}},
from opencanary.modules import CanaryServicefrom twisted.internet.protocol import Protocolfrom twisted.internet.protocol import Factoryfrom twisted.application import internetclass Example0Protocol(Protocol):"""Example (Fictional) Protocol$ nc localhost 8007Welcome!password: wrong0password: wrong1password: wrong2Bad passwords$"""def __init__(self):self.prompts = 0def connectionMade(self):self.transport.write("Welcome!rnpassword: ")self.prompts += 1def dataReceived(self, data):"""Careful, data recieved here is unbuffered. See example1for how this can be better handled."""password = data.strip("rn")logdata = {"PASSWORD" : password}self.factory.log(logdata, transport=self.transport)if self.prompts < 3:self.transport.write("rnpassword: ")self.prompts += 1else:self.transport.write("rnBad passwordsrn")self.transport.loseConnection()class CanaryExample0(Factory, CanaryService):NAME = 'example0'protocol = Example0Protocoldef __init__(self, config=None, logger=None):CanaryService.__init__(self, config, logger)self.port = 8007self.logtype = logger.LOG_BASE_EXAMPLECanaryServiceFactory = CanaryExample0
还有一种方式，我们在logger文件中直接加一个handler处理，把FileHandler变成syslog的SyslogHandler。
class DemoHandler(logging.Handler):def __init__(self, demo_userid, demo_authkey, allowed_ports):logging.Handler.__init__(self)self.demo_userid = str(demo_userid)self.demo_authkey = str(demo_authkey)try:# Extract the list of allowed portsself.allowed_ports = map(int, str(allowed_ports).split(','))except:# By default, report only port 22self.allowed_ports = [ 22 ]def emit(self, record):...
再修改opencanary.conf配置文件。
"logger": {"class" : "PyLogger","kwargs" : {"formatters": {"plain": {"format": "%(message)s"}},"handlers": {"dshield": {"class": "opencanary.logger.DemoHandler","demo_userid": "test","demo_authkey": "$%$##$#%$%","allowed_ports": "22,23"}}}}
0×06 蜜罐与威胁情报
0×07 蜜罐的集中管理
hpfeeds-client --host localhost -p 10000 -i honeymap -s cfdd6a68be69464666ae60b66dae69f6 -c geoloc.events publish "{countrycode:'NA', latitude:37.7749, longitude:-122.4194, city:'San Francisco'}"
0×08 总结：
原文链接：https://blog.csdn.net/u012206617/article/details/102776634侵权请私聊公众号删文
热文推荐
欢迎关注LemonSec
觉得不错点个“赞”、“在看”哦
原文始发于微信公众号（LemonSec）：基于开源蜜罐的实践与功能扩展
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论