Monday, June 1, 2015 at 6:57PM Wow, it has been a long time since I have posted. I plan to rectify my posting frequency problems, starting now. Last weekend @p4r4n0y1ng and I (@TekDefense) gave a presentation on Honeypots called "Catch More Honeys when you are fly" at BSidesNola. See the slides below:
I will be publishing a more detailed article on SSHPsychos soon!
Sunday, July 20, 2014 at 8:31PM UPDATE: After posting @ikoniaris of Honeydrive and Bruteforce fame recommended running these. Here are the results of kippo-stats.pl created by Tomasz Miklas and Miguel jacq.
As many of you know from previous posts, I am a big fan of honeypots, particularly Kippo. My main Kippo instance sitting in AWS has been online for over a year now. Let's take a look at what we have captured and learned over this past year. If you want to validate any of these statistics I have made the raw logs available for download.
Unique values (135526 connections):
*Map Generated with JCSOCAL's GIPC
Top 11 Countries
China: 699
United States: 654
Brazil: 76
Russian Federation: 69
Germany: 65
Korea, Republic of: 57
Romania: 56
Egypt: 52
Japan: 50
India: 41
Indonesia: 41
Unique Usernames: 8600 (Username list)
Unique Passwords: 75780 (wordlist)
Unique Sources: 1985 (list of IPs)
One of my favorite uses of kippo data is to generate wordlists from login attempts. I wrote a quick script to parse the kippo logs and pull out all passwords and unique them into a wordlist. Feel free to grab. Additionally I made the wordlists available for download.
Using Pipal I performed analysis of all the login attempts over this year:
Two items of note here are that over 60% of password attempts were 1-8 characters. 40% of attempts were for lowercase alpha characters only. The most used password was 123456. This is the default pass for Kippo.
If a user attempts to create an account or change the root password in a Kippo session those passwords are captured and added to the allowed credentials list. The following credentials were created:
root:0:albertinoalbert123root:0:fgashyeq77dhshfaroot:0:florian12euroot:0:hgd177q891999wwwwwe1.dONroot:0:iphone5root:0:kokotroot:0:noperoot:0:picvinaroot:0:scorpi123root:0:testroot:0:xiaozheroot:0:12345root:0:bnn318da9031kdamfaihheq1faroot:0:lsroot:0:neonhostt1root:0:wget123
20131030113401_http___198_2_192_204_22_disknyp20131103183232_http___61_132_227_111_8080_meimei20131104045744_http___198_2_192_204_22_disknyp20131114214017_http___www_unrealircd_com_downloads_Unreal3_2_8_1_tar_gz20131116130541_http___198_2_192_204_22_disknyp20131129165151_http___dl_dropboxusercontent_com_s_1bxj9ak8m1octmk_ktx_c20131129165438_http___dl_dropboxusercontent_com_s_66gpt66lvut4gdu_ktx20131202040921_http___198_2_192_204_22_disknyp20131207123419_http___packetstorm_wowhacker_com_DoS_juno_c20131216143108_http___www_psybnc_at_download_beta_psyBNC_2_3_2_7_tar_gz20131216143208_http___X_hackersoft_org_scanner_gosh_jpg20131216143226_http___download_microsoft_com_download_win2000platform_SP_SP3_NT5_EN_US_W2Ksp3_exe20131217163423_http___ha_ckers_org_slowloris_slowloris_pl20131217163456_http___www_lemarinel_net_perl20131222084315_http___maxhub_com_auto_bill_pipe_bot20140103142644_http___ftp_gnu_org_gnu_autoconf_autoconf_2_69_tar_gz20140109170001_http___sourceforge_net_projects_cpuminer_files_pooler_cpuminer_2_3_2_linux_x86_tar_gz20140120152204_http___111_39_43_54_5555_dos3220140122202342_http___layer1_cpanel_net_latest20140122202549_http___linux_duke_edu_projects_yum_download_2_0_yum_2_0_7_tar_gz20140122202751_http___www_ehcp_net_ehcp_latest_tgz20140201131804_http___www_suplementar_com_br_images_stories_goon_pooler_cpuminer_2_3_2_tar_gz20140201152307_http___nemo_rdsor_ro_darwin_jpg20140208081358_http___www_youtube_com_watch_v_6hVQs5ll06420140208184835_http___sharplase_ru_x_txt20140215141909_http___tenet_dl_sourceforge_net_project_cpuminer_pooler_cpuminer_2_3_2_tar_gz20140215142830_http___sourceforge_net_projects_cpuminer_files_pooler_cpuminer_2_3_2_tar_gz20140219072721_http___www_psybnc_at_download_beta_psyBNC_2_3_2_7_tar_gz20140328031725_http___dl_dropboxusercontent_com_u_133538399_multi_py20140409053322_http___www_c99php_com_shell_c99_rar20140409053728_http___github_com_downloads_orbweb_PHP_SHELL_WSO_wso2_5_1_php20140413130110_http___www_iphobos_com_hb_unixcod_rar20140416194008_http___linux_help_bugs3_com_Camel_mail_txt20140419143734_http___www_activestate_com_activeperl_downloads_thank_you_dl_http___downloads_activestate_com_ActivePerl_releases_5_18_2_1802_ActivePerl_5_18_2_1802_x86_64_linux_glibc_2_5_298023_tar_gz20140419144043_http___ha_ckers_org_slowloris_slowloris_pl20140420104056_http___downloads_metasploit_com_data_releases_archive_metasploit_4_9_2_linux_x64_installer_run20140420104325_http___nmap_org_dist_nmap_6_46_1_i386_rpm20140505073503_http___116_255_239_180_888_00720140505093229_http___119_148_161_25_805_sd3220140505111511_http___112_117_223_10_280_120140515091557_http___112_117_223_10_280__bash_6_phpmysql20140519193800_http___www_unrealircd_com_downloads_Unreal3_2_8_1_tar_gz20140523120411_http___lemonjuice_tk_netcat_sh20140610174516_http___59_63_183_193_280__etc_Test888820140614200901_http___kismetismy_name_ktx20140625032113_http___ftp_mirrorservice_org_sites_ftp_wiretapped_net_pub_security_packet_construction_netcat_gnu_netcat_netcat_0_7_1_tar_gz20140720005010_http___www_bl4ck_viper_persiangig_com_p8_localroots_2_6_x_cw7_3
AWSWeb:~# adduseradduser: Only one or two names allowed.AWSWeb:~# useraddadduser: Only one or two names allowed.AWSWeb:~# lsAWSWeb:~# pwdrootAWSWeb:~# cd /[1D[1P[1D[1P[1D[1P[1D[1Pcat /etc/passwdroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shrichard:x:1000:1000:richard,,,:/home/richard:/bin/bashsshd:x:101:65534::/var/run/sshd:/usr/sbin/nologinAWSWeb:~# userbash: user: command not foundAWSWeb:~# adduser obzAdding user `obz' ...Adding new group `obz' (1001) ...Adding new user `obz' (1001) with group `obz' ...Creating home directory `/home/obz' ...Copying files from `/etc/skel' ...Password:Password again:Changing the user information for obzEnter the new value, or press ENTER for the defaultUsername []:Must enter a value!Username []: obzFull Name []: l[1D[1Padmin obzRoom Number []: 1Work Phone []: 1234567890Home Phone []:Must enter a value!Home Phone []: 0Mobile Phone []: 0Country []: cnCity []: xangLanguage []: mandFavorite movie []: 1Other []: 1Is the information correct? [Y/n] yERROR: Some of the information you entered is invalidDeleting user `obz' ...Deleting group `obz' (1001) ...Deleting home directory `/home/obz' ...Try again? [Y/n] yChanging the user information for obzEnter the new value, or press ENTER for the defaultUsername []: obxFull Name []: obx toorRoom Number []: 1Work Phone []: 1[1D[1P9089543121Home Phone []: 9089342135Mobile Phone []: 9089439012Country []: cnCity []: xangLanguage []: man[1D[1P[1D[1P[1D[1PenglishFavorite movie []: oneOther []: two[1D[1P[1D[1P[1D[1PfourIs the information correct? [Y/n] yERROR: Some of the information you entered is invalidDeleting user `obz' ...Deleting group `obz' (1001) ...Deleting home directory `/home/obz' ...Try again? [Y/n] nAWSWeb:~# cat adduser obz user cat /etc/passwdroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shrichard:x:1000:1000:richard,,,:/home/richard:/bin/bashsshd:x:101:65534::/var/run/sshd:/usr/sbin/nologinAWSWeb:~# cat /etc/shadowcat: /etc/shadow: No such file or directoryAWSWeb:~# /etc/init.d\[1D[1P[1D[1PD/ssh startbash: /etc/init.D/ssh: command not foundAWSWeb:~# [K/etc/init.D/ssh start[1D[1D[1D[1D[1D[1D[1D[1D[1D[1D[1D[1Pdbash: /etc/init.d/ssh: command not foundAWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~# exitcConnection to server closed.localhost:~# exitConnection to server closed.localhost:~# byebash: bye: command not foundlocalhost:~# exitConnection to server closed.localhost:~# adminbash: admin: command not foundlocalhost:~# sulocalhost:~# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:11 .drwxr-xr-x 1 root root 4096 2013-02-03 17:11 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrclocalhost:~# pwd/rootlocalhost:~# cd /localhost:/# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:11 .drwxr-xr-x 1 root root 4096 2013-02-03 17:11 ..drwxr-xr-x 1 root root 0 2009-11-20 08:19 sysdrwxr-xr-x 1 root root 4096 2009-11-08 15:42 bindrwxr-xr-x 1 root root 4096 2009-11-06 11:08 mntdrwxr-xr-x 1 root root 4096 2009-11-06 11:08 medialrwxrwxrwx 1 root root 25 2009-11-06 11:16 vmlinuz -> /boot/vmlinuz-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-06 11:09 optlrwxrwxrwx 1 root root 11 2009-11-06 11:08 cdrom -> /media/cdrom0drwxr-xr-x 1 root root 4096 2009-11-06 11:08 selinuxdrwxrwxrwx 1 root root 4096 2009-11-20 08:19 tmpdr-xr-xr-x 1 root root 0 2009-11-20 08:19 procdrwxr-xr-x 1 root root 4096 2009-11-08 15:41 sbindrwxr-xr-x 1 root root 4096 2009-11-20 08:20 etcdrwxr-xr-x 1 root root 3200 2009-11-20 08:20 devdrwxr-xr-x 1 root root 4096 2009-11-06 11:09 srvlrwxrwxrwx 1 root root 28 2009-11-06 11:16 initrd.img -> /boot/initrd.img-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-08 15:46 libdrwxr-xr-x 1 root root 4096 2009-11-06 11:22 homedrwxr-xr-x 1 root root 4096 2009-11-06 11:09 vardrwxr-xr-x 1 root root 4096 2009-11-08 15:46 usrdrwxr-xr-x 1 root root 4096 2009-11-08 15:39 bootdrwxr-xr-x 1 root root 4096 2009-11-20 09:08 rootdrwx------ 1 root root 16384 2009-11-06 11:08 lost+foundlocalhost:/# cd /homelocalhost:/home# ls -lldrwxr-xr-x 1 root root 4096 2013-02-03 17:11 .drwxr-xr-x 1 root root 4096 2013-02-03 17:11 ..drwxr-xr-x 1 1000 1000 4096 2009-11-06 11:22 richardlocalhost:/home# exitConnection to server closed.localhost:~#localhost:~#localhost:~#localhost:~#localhost:~#localhost:~#localhost:~# ssh -D root@http://60.250.65.112/ 1337The authenticity of host '60.250.65.112 (60.250.65.112)' can't be established.RSA key fingerprint is 9d:30:97:8a:9e:48:0d:de:04:8d:76:3a:7b:4b:30:f8.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '60.250.65.112' (RSA) to the list of known hosts.root@60.250.65.112's password:Linux localhost 2.6.26-2-686 #1 SMP Wed Nov 4 20:45:37 UTC 2009 i686Last login: Sat Feb 2 07:07:11 2013 from 192.168.9.4localhost:~# uname -aLinux localhost 2.6.24-2-generic #1 SMP Thu Dec 20 17:36:12 GMT 2007 i686 GNU/Linuxlocalhost:~# pwd/rootlocalhost:~# cd /localhost:/# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:19 .drwxr-xr-x 1 root root 4096 2013-02-03 17:19 ..drwxr-xr-x 1 root root 0 2009-11-20 08:19 sysdrwxr-xr-x 1 root root 4096 2009-11-08 15:42 bindrwxr-xr-x 1 root root 4096 2009-11-06 11:08 mntdrwxr-xr-x 1 root root 4096 2009-11-06 11:08 medialrwxrwxrwx 1 root root 25 2009-11-06 11:16 vmlinuz -> /boot/vmlinuz-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-06 11:09 optlrwxrwxrwx 1 root root 11 2009-11-06 11:08 cdrom -> /media/cdrom0drwxr-xr-x 1 root root 4096 2009-11-06 11:08 selinuxdrwxrwxrwx 1 root root 4096 2009-11-20 08:19 tmpdr-xr-xr-x 1 root root 0 2009-11-20 08:19 procdrwxr-xr-x 1 root root 4096 2009-11-08 15:41 sbindrwxr-xr-x 1 root root 4096 2009-11-20 08:20 etcdrwxr-xr-x 1 root root 3200 2009-11-20 08:20 devdrwxr-xr-x 1 root root 4096 2009-11-06 11:09 srvlrwxrwxrwx 1 root root 28 2009-11-06 11:16 initrd.img -> /boot/initrd.img-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-08 15:46 libdrwxr-xr-x 1 root root 4096 2009-11-06 11:22 homedrwxr-xr-x 1 root root 4096 2009-11-06 11:09 vardrwxr-xr-x 1 root root 4096 2009-11-08 15:46 usrdrwxr-xr-x 1 root root 4096 2009-11-08 15:39 bootdrwxr-xr-x 1 root root 4096 2009-11-20 09:08 rootdrwx------ 1 root root 16384 2009-11-06 11:08 lost+foundlocalhost:/# cd /rootlocalhost:~# ls -lldrwxr-xr-x 1 root root 4096 2013-02-03 17:19 .drwxr-xr-x 1 root root 4096 2013-02-03 17:19 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrclocalhost:~# cd /ho[1D[1P[1D[1P[1D[1P[1D[1P[1D[1P[1D[1Pcd /home/localhost:/home# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:20 .drwxr-xr-x 1 root root 4096 2013-02-03 17:20 ..drwxr-xr-x 1 1000 1000 4096 2009-11-06 11:22 richardlocalhost:/home# exitConnection to server closed.localhost:~# exitConnection to server closed.localhost:~#
After a year with Kippo, I have learned a lot about what these basic attackers do when connecting to seemingly open ssh hosts. There is plenty more to learn though. I have some plans on building out a larger honeypot infrastructure, and automating some of the data collection and parsing. Additionally I would like to spend more time analyzing the sessions and malware for further trends. I'll keep you all posted!
*Big thanks to Bruteforce Labs for their tools and expertise in honeypots.
Tuesday, March 5, 2013 at 11:38AM kippo@MyAWSHoneypot:~/kippo/log/tty$ ~/kippo/utils/playlog.py 20130225-042834-4525.logAWSWeb:~# ls -ladrwxr-xr-x 1 root root 4096 2013-02-25 04:29 .drwxr-xr-x 1 root root 4096 2013-02-25 04:29 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrcAWSWeb:~# ls -ladrwxr-xr-x 1 root root 4096 2013-02-25 04:29 .drwxr-xr-x 1 root root 4096 2013-02-25 04:29 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrcAWSWeb:~# pwd/rootAWSWeb:~# uname -aLinux AWSWeb 2.6.24-2-generic #1 SMP Thu Dec 20 17:36:12 GMT 2007 i686 GNU/LinuxAWSWeb:~# wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-installer.run--2013-02-25 04:33:42-- http://downloads.metasploit.com/data/releases/metasploit-latest-linux-installer.runConnecting to downloads.metasploit.com:80... connected.HTTP request sent, awaiting response... 200 OKLength: 208374041 (198M) [text/plain]Saving to: `metasploit-latest-linux-installer.run100%[======================================>] 208,374,041 10270K/s eta 0s2013-02-25 04:34:02 (10270 KB/s) - `metasploit-latest-linux-installer.run' saved [208374041/208374041]AWSWeb:~# sh metasploit-latest-linux-installer.runAWSWeb:~# ./metasploit-latest-linux-installer.runbash: ./metasploit-latest-linux-installer.run: command not foundAWSWeb:~# dirbash: dir: command not foundAWSWeb:~# ls -ladrwxr-xr-x 1 root root 4096 2013-02-25 04:34 .drwxr-xr-x 1 root root 4096 2013-02-25 04:34 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrc-rw-r--r-- 1 root root 208374041 2013-02-25 04:34 metasploit-latest-linux-installer.runAWSWeb:~# sh metasploit-latest-linux-installer.runAWSWeb:~# shAWSWeb:~# run metasploit-latest-linux-installer.runbash: run: command not foundAWSWeb:~# ./metasploit-latest-linux-installer.runbash: ./metasploit-latest-linux-installer.run: command not foundAWSWeb:~# metasploit-latest-linux-installer.runbash: metasploit-latest-linux-installer.run: command not foundAWSWeb:~# ls -ladrwxr-xr-x 1 root root 4096 2013-02-25 04:35 .drwxr-xr-x 1 root root 4096 2013-02-25 04:35 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrc-rw-r--r-- 1 root root 208374041 2013-02-25 04:34 metasploit-latest-linux-installer.runAWSWeb:~# chmod 777 metasploit-latest-linux-installer.runAWSWeb:~# sh metasploit-latest-linux-installer.runAWSWeb:~# clearAWSWeb:~# wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run--2013-02-25 04:36:03-- http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.runConnecting to downloads.metasploit.com:80... connected.HTTP request sent, awaiting response... 200 OKLength: 208792036 (199M) [text/plain]Saving to: `metasploit-latest-linux-x64-installer.run100%[======================================>] 208,792,036 6647K/s eta 0s2013-02-25 04:36:34 (6647 KB/s) - `metasploit-latest-linux-x64-installer.run' saved [208792036/208792036]AWSWeb:~# sh metasploit-latest-linux-x64-installer.runAWSWeb:~# chmod +x metasploit-latest-linux-installer.runAWSWeb:~# sudo ./metasploit-latest-linux-installer.rubash: sudo: command not foundAWSWeb:~# sudo ./metasploit-latest-linux-installer.runbash: sudo: command not foundAWSWeb:~# sh metasploit-latest-linux-installer.runAWSWeb:~# sudo apt-get install ruby libopenssl-ruby libyaml-ruby libdl-rubybash: sudo: command not foundAWSWeb:~# sudo apt-get install ruby libopenssl-ruby libyaml-ruby libdl-rubylibiconv-ruby libreadline-ruby irb ri rubygemsbash: sudo: command not foundAWSWeb:~# install rpm shbash: install: command not foundAWSWeb:~# rpm -ivh shbash: rpm: command not foundAWSWeb:~# apt-get updateE: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)E: Unable to lock the list directoryAWSWeb:~# iduid=0(root) gid=0(root) groups=0(root)AWSWeb:~# rpmbuild -ts httpd-2.4.x.tar.bz2bash: rpmbuild: command not foundAWSWeb:~# wget -O /etc/yum.repos.d/epel-erlang.repo http://repos.fedorapeople.org/repos/peter/erlang/epel-erlang.repo--2013-02-25 04:58:51-- http:///etc/yum.repos.d/epel-erlang.repoConnecting to :80... connected.HTTP request sent, awaiting response... Connection was refused by other side: 111: Connection refused.AWSWeb:~# yum install erlangbash: yum: command not foundAWSWeb:~# rpm --import http://www.rabbitmq.com/rabbitmq-signing-key-public.ascbash: rpm: command not foundAWSWeb:~# yum install rabbitmq-server-3.0.2-1.noarch.rpmbash: yum: command not foundAWSWeb:~# sudo apt-get install alienbash: sudo: command not foundAWSWeb:~# sudo apt-get install alien dpkg-dev debhelper build-essentialbash: sudo: command not foundAWSWeb:~# yum apt-get install alien dpkg-dev debhelper build-essentialbash: yum: command not foundAWSWeb:~# yum install sudobash: yum: command not foundAWSWeb:~# wget http://linux.duke.edu/projects/yum/download/2.0/yum-2.0.7.tar.gz--2013-02-25 05:10:07-- http://linux.duke.edu/projects/yum/download/2.0/yum-2.0.7.tar.gzConnecting to linux.duke.edu:80... connected.HTTP request sent, awaiting response... 200 OKLength: 174080 (170K) [application/x-gzip]Saving to: `yum-2.0.7.tar.gz100%[======================================>] 174,080 76K/s eta 1s2013-02-25 05:10:09 (76 KB/s) - `yum-2.0.7.tar.gz' saved [174080/174080]AWSWeb:~# tar -xvzf yum-2.0.7.tar.gzyum-2.0.7yum-2.0.7/callback.pyyum-2.0.7/nevral.pyyum-2.0.7/configureyum-2.0.7/translate.pyyum-2.0.7/py-compileyum-2.0.7/COPYINGyum-2.0.7/etcyum-2.0.7/etc/yum.cronyum-2.0.7/etc/yum.logrotateyum-2.0.7/etc/Makefile.inyum-2.0.7/etc/yum.confyum-2.0.7/etc/yum.inityum-2.0.7/pkgaction.pyyum-2.0.7/archwork.pyyum-2.0.7/mkinstalldirsyum-2.0.7/failover.pyyum-2.0.7/lilo.pyyum-2.0.7/logger.pyyum-2.0.7/i18n.pyyum-2.0.7/progress_meter.pyyum-2.0.7/configure.inyum-2.0.7/yum.specyum-2.0.7/docsyum-2.0.7/docs/yum.conf.5yum-2.0.7/docs/Makefile.inyum-2.0.7/docs/yum.8yum-2.0.7/docs/yum-arch.8yum-2.0.7/checkbootloader.pyyum-2.0.7/yumlock.pyyum-2.0.7/binyum-2.0.7/bin/yum-archyum-2.0.7/bin/Makefile.inyum-2.0.7/bin/yumyum-2.0.7/up2datetheft.pyyum-2.0.7/urlgrabber.pyyum-2.0.7/install-shyum-2.0.7/bootloadercfg.pyyum-2.0.7/grubcfg.pyyum-2.0.7/Makefile.inyum-2.0.7/INSTALLyum-2.0.7/serverStuff.pyyum-2.0.7/poyum-2.0.7/po/uk.poyum-2.0.7/po/pygettext.pyyum-2.0.7/po/cs.poyum-2.0.7/po/ru.poyum-2.0.7/po/es.poyum-2.0.7/po/Makefile.inyum-2.0.7/po/yum.potyum-2.0.7/rpmUtils.pyyum-2.0.7/pullheaders.pyyum-2.0.7/READMEyum-2.0.7/keepalive.pyyum-2.0.7/ChangeLogyum-2.0.7/yummain.pyyum-2.0.7/comps.pyyum-2.0.7/iutil.pyyum-2.0.7/clientStuff.pyyum-2.0.7/yumcomps.pyyum-2.0.7/config.pyyum-2.0.7/AUTHORSyum-2.0.7/lilocfg.pyyum-2.0.7/TODOAWSWeb:~# cd yum-2.0.7AWSWeb:~/yum-2.0.7# ./configureShall we play a game? yesA strange game. The only winning move is not to play. How about a nice game of chess?AWSWeb:~/yum-2.0.7# ./configureShall we play a game? noA strange game. The only winning move is not to play. How about a nice game of chess?AWSWeb:~/yum-2.0.7# ./configureShall we play a game?A strange game. The only winning move is not to play. How about a nice game of chess?AWSWeb:~/yum-2.0.7# makebash: make: command not foundAWSWeb:~/yum-2.0.7# make installbash: make: command not foundAWSWeb:~/yum-2.0.7# dirbash: dir: command not foundAWSWeb:~/yum-2.0.7# ls -ladrwxr-xr-x 1 root root 4096 2013-02-25 05:11 .drwxr-xr-x 1 root root 4096 2013-02-25 05:11 ..-rw-rw-r-- 1 root root 3527 2004-05-07 04:58 callback.py-rw-rw-r-- 1 root root 22517 2004-05-07 04:58 nevral.py-rwxrwxr-x 1 root root 69467 2004-05-07 04:58 configure-rw-rw-r-- 1 root root 8309 2004-05-07 04:58 translate.py-rwxrwxr-x 1 root root 1478 2004-05-07 04:58 py-compile-rw-rw-r-- 1 root root 17976 2004-05-07 04:58 COPYINGdrwxrwxr-x 1 root root 4096 2004-05-07 04:58 etc-rw-rw-r-- 1 root root 25478 2004-05-07 04:58 pkgaction.py-rw-rw-r-- 1 root root 3045 2004-05-07 04:58 archwork.py-rwxrwxr-x 1 root root 729 2004-05-07 04:58 mkinstalldirs-rw-rw-r-- 1 root root 3588 2004-05-07 04:58 failover.py-rw-rw-r-- 1 root root 9784 2004-05-07 04:58 lilo.py-rw-rw-r-- 1 root root 15812 2004-05-07 04:58 logger.py-rw-r--r-- 1 root root 690 2004-05-07 04:58 i18n.py-rw-rw-r-- 1 root root 5528 2004-05-07 04:58 progress_meter.py-rw-rw-r-- 1 root root 636 2004-05-07 04:58 configure.in-rw-rw-r-- 1 root root 3636 2004-05-07 04:58 yum.specdrwxrwxr-x 1 root root 4096 2004-05-07 04:58 docs-rw-rw-r-- 1 root root 4607 2004-05-07 04:58 checkbootloader.py-rw-rw-r-- 1 root root 541 2004-05-07 04:58 yumlock.pydrwxrwxr-x 1 root root 4096 2004-05-07 04:58 bin-rw-rw-r-- 1 root root 1206 2004-05-07 04:58 up2datetheft.py-rw-rw-r-- 1 root root 19254 2004-05-07 04:58 urlgrabber.py-rwxrwxr-x 1 root root 5598 2004-05-07 04:58 install-sh-rw-rw-r-- 1 root root 1331 2004-05-07 04:58 bootloadercfg.py-rw-rw-r-- 1 root root 2188 2004-05-07 04:58 grubcfg.py-rw-rw-r-- 1 root root 4611 2004-05-07 04:58 Makefile.in-rw-rw-r-- 1 root root 320 2004-05-07 04:58 INSTALL-rw-rw-r-- 1 root root 3723 2004-05-07 04:58 serverStuff.pydrwxrwxr-x 1 root root 4096 2004-05-07 04:58 po-rw-r--r-- 1 root root 12223 2004-05-07 04:58 rpmUtils.py-rw-rw-r-- 1 root root 11884 2004-05-07 04:58 pullheaders.py-rw-rw-r-- 1 root root 1655 2004-05-07 04:58 README-rw-rw-r-- 1 root root 14083 2004-05-07 04:58 keepalive.py-rw-rw-r-- 1 root root 39484 2004-05-07 04:58 ChangeLog-rwxr-xr-x 1 root root 14959 2004-05-07 04:58 yummain.py-rwxrwxr-x 1 root root 11923 2004-05-07 04:58 comps.py-rw-rw-r-- 1 root root 7709 2004-05-07 04:58 iutil.py-rwxr-xr-x 1 root root 54626 2004-05-07 04:58 clientStuff.py-rwxrwxr-x 1 root root 13876 2004-05-07 04:58 yumcomps.py-rw-rw-r-- 1 root root 15758 2004-05-07 04:58 config.py-rw-rw-r-- 1 root root 888 2004-05-07 04:58 AUTHORS-rw-rw-r-- 1 root root 13304 2004-05-07 04:58 lilocfg.py-rw-rw-r-- 1 root root 76 2004-05-07 04:58 TODOAWSWeb:~/yum-2.0.7# ./INSTALL___{o,o}|)__)-"-"-O RLY?___{o,o}|)__)-"-"-O RLY? yes___{o,o}(__(|-"-"-NO WAI!AWSWeb:~/yum-2.0.7# INSTALLbash: INSTALL: command not foundAWSWeb:~/yum-2.0.7# ./INSTALL___{o,o}|)__)-"-"-O RLY? y___{o,o}(__(|-"-"-NO WAI!AWSWeb:~/yum-2.0.7# ./INSTALL___{o,o}|)__)-"-"-O RLY? n___{o,o}|)__)-"-"-O RLY? n___{o,o}|)__)-"-"-O RLY? ./configure___{o,o}|)__)-"-"-O RLY?___{o,o}|)__)-"-"-O RLY? y___{o,o}(__(|-"-"-NO WAI!AWSWeb:~/yum-2.0.7# ./configureShall we play a game? yA strange game. The only winning move is not to play. How about a nice game of chess?AWSWeb:~/yum-2.0.7# ./mkinstalldirsShall we play a game?A strange game. The only winning move is not to play. How about a nice game of chess?AWSWeb:~/yum-2.0.7# mkdir setupsAWSWeb:~/yum-2.0.7# cd setupsAWSWeb:~/yum-2.0.7/setups# wget http://linux.duke.edu/projects/yum/download/2.0/yum-2.0.7.tar.gz--2013-02-25 05:15:07-- http://linux.duke.edu/projects/yum/download/2.0/yum-2.0.7.tar.gzConnecting to linux.duke.edu:80... connected.HTTP request sent, awaiting response... 200 OKLength: 174080 (170K) [application/x-gzip]Saving to: `yum-2.0.7.tar.gz100%[======================================>] 174,080 91K/s eta 0s2013-02-25 05:15:09 (91 KB/s) - `yum-2.0.7.tar.gz' saved [174080/174080]AWSWeb:~/yum-2.0.7/setups# tar -xvzf yum-2.0.7.tar.gzyum-2.0.7yum-2.0.7/callback.pyyum-2.0.7/nevral.pyyum-2.0.7/configureyum-2.0.7/translate.pyyum-2.0.7/py-compileyum-2.0.7/COPYINGyum-2.0.7/etcyum-2.0.7/etc/yum.cronyum-2.0.7/etc/yum.logrotateyum-2.0.7/etc/Makefile.inyum-2.0.7/etc/yum.confyum-2.0.7/etc/yum.inityum-2.0.7/pkgaction.pyyum-2.0.7/archwork.pyyum-2.0.7/mkinstalldirsyum-2.0.7/failover.pyyum-2.0.7/lilo.pyyum-2.0.7/logger.pyyum-2.0.7/i18n.pyyum-2.0.7/progress_meter.pyyum-2.0.7/configure.inyum-2.0.7/yum.specyum-2.0.7/docsyum-2.0.7/docs/yum.conf.5yum-2.0.7/docs/Makefile.inyum-2.0.7/docs/yum.8yum-2.0.7/docs/yum-arch.8yum-2.0.7/checkbootloader.pyyum-2.0.7/yumlock.pyyum-2.0.7/binyum-2.0.7/bin/yum-archyum-2.0.7/bin/Makefile.inyum-2.0.7/bin/yumyum-2.0.7/up2datetheft.pyyum-2.0.7/urlgrabber.pyyum-2.0.7/install-shyum-2.0.7/bootloadercfg.pyyum-2.0.7/grubcfg.pyyum-2.0.7/Makefile.inyum-2.0.7/INSTALLyum-2.0.7/serverStuff.pyyum-2.0.7/poyum-2.0.7/po/uk.poyum-2.0.7/po/pygettext.pyyum-2.0.7/po/cs.poyum-2.0.7/po/ru.poyum-2.0.7/po/es.poyum-2.0.7/po/Makefile.inyum-2.0.7/po/yum.potyum-2.0.7/rpmUtils.pyyum-2.0.7/pullheaders.pyyum-2.0.7/READMEyum-2.0.7/keepalive.pyyum-2.0.7/ChangeLogyum-2.0.7/yummain.pyyum-2.0.7/comps.pyyum-2.0.7/iutil.pyyum-2.0.7/clientStuff.pyyum-2.0.7/yumcomps.pyyum-2.0.7/config.pyyum-2.0.7/AUTHORSyum-2.0.7/lilocfg.pyyum-2.0.7/TODOAWSWeb:~/yum-2.0.7/setups# cd yum-2.0.7AWSWeb:~/yum-2.0.7/setups/yum-2.0.7# ./configureShall we play a game? yA strange game. The only winning move is not to play. How about a nice game of chess?AWSWeb:~/yum-2.0.7/setups/yum-2.0.7# makebash: make: command not foundAWSWeb:~/yum-2.0.7/setups/yum-2.0.7# make installbash: make: command not foundAWSWeb:~/yum-2.0.7/setups/yum-2.0.7# yum updatebash: yum: command not foundAWSWeb:~/yum-2.0.7/setups/yum-2.0.7# cd ..AWSWeb:~/yum-2.0.7/setups# cd..bash: cd..: command not foundAWSWeb:~/yum-2.0.7/setups# cd ..AWSWeb:~/yum-2.0.7# cd ..AWSWeb:~# dirbash: dir: command not foundAWSWeb:~# ls -ladrwxr-xr-x 1 root root 4096 2013-02-25 05:16 .drwxr-xr-x 1 root root 4096 2013-02-25 05:16 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrc-rw-r--r-- 1 root root 208374041 2013-02-25 04:34 metasploit-latest-linux-installer.run-rw-r--r-- 1 root root 208792036 2013-02-25 04:36 metasploit-latest-linux-x64-installer.run-rw-r--r-- 1 root root 174080 2013-02-25 05:10 yum-2.0.7.tar.gzdrwxrwxr-x 1 root root 4096 2004-05-07 04:58 yum-2.0.7AWSWeb:~# rpm -e yumbash: rpm: command not foundAWSWeb:~# wget ftp://rpmfind.net/linux/fedora/core/4/i386/os/Fedora/RPMS/yum-2.3.2-7.noarch.rpmftp://rpmfind.net/linux/fedora/core/4/i386/os/Fedora/RPMS/yum-2.3.2-7.noarch.rpm: Unsupported scheme.
Kippo, honeypot, metasploit, ssh in News Sunday, February 10, 2013 at 12:28PM In this episode of TekTip, I am going to show a unique method to drive traffic to your Honeypot. While I use Kippo as the example this approach will work for any Honeypot.
*If you do not know what Kippo is, shame on you. Watch this, this, and this to get caught up.
Now let's get to it. The first thing we need to do is prep our Kippo Instance so that we can measure the results of the approach. Log into your Kippo Honeypot, probably on HoneyDrive. Once logged in go to your kippo install directory and navigate to the data folder.
If using Honeydrive it will look something like this:
cd /opt/kippo/data
Now use the cat command to see what you currently have as allowable credentials in your userdb.txt.
cat userdb.txtroot:0:123456root:0:abc123root:0:p@ssw0rd
This is what I have. As you can see I allow 3 of the top 10 most used passwords. Now we want to add credentials that will be unique enough that they should not be attempted by your average attacker. Open userdb.txt in your favorite text editor and add a new line with the credentials you want to use. I added one for root:0:IamSo1337!. Running "cat userdb.txt" again shows the following:
cat userdb.txt
root:0:123456root:0:abc123root:0:p@ssw0rdroot:0:IamSo1337!
That takes care of the prep. Now if you are doing this with something other than Kippo, those previous steps won't apply. If whatever Honeypot you are using has the ability to let attackers authenticate you will want to set up a unique set of credentials for the experiment. If not, press on.
We will now use Social Networks against are attackers. To put it simply we are going to post login information for our Honeypot on a public site like pastebin, and then alert attackers to the information by posting a link to the paste file on social networks like Twitter.
You may want to keep the rest of the activity as anonymous as possible, so fire up Tor Browser or use proxychains to hide your IP information. Once anonymized go to pastebin.com.
The trick to getting this to work properly is to utilize keywords that attackers may have PasteLerts set up for. For instance you will want to include keywords such as ssh, login, username, password, root, and many others. Make sure you use some of these keywords in the title as well. Here is a sample one I put together:
Submit this and get your pastebin url. Now this will be enough to bring in a few extra hits already, from people who are monitoring pastebin. To get even more folks to see this though we will need to take it a step further.
While still anonymizing your activity create a throwaway twitter account. As many people as there are that monitor pastebin, there are even more that monitor twitter (at least I am guessing so). In particular there are certain twitter users and list that people follow to get password dumps as they occur. My favorite of these is @PastebinDorks.
With your new twitter account create a tweet that mentions @PastebinDorks or another account like that. Have it say something along the lines of, "Check out this one! http://pastebin.com/qi7wzp8h". Now anyone that follows @PastebinDorks will see your post. You may get lucky enough to have someone retweet it a few times.
Now you can just sit back and wait for the conenctions to roll in. While I used twitter and pastebin in my example, this can be done with any like tools. The point is to get the data out there in the public and then use social networks to increase exposure.
To monitor your kippo logs to see when attackers use the user/pass combination you specified in the userdb.txt. navigate to your kippo logs directory and and do the following:
honeydrive@honeydrive:/opt/kippo/log$ cat kippo.log | grep 'login attempt'
2013-02-10 13:04:46+0000 [SSHService ssh-userauth on HoneyPotTransport,9237,193.200.88.100] login attempt [root/abcd1234] failed
2013-02-10 13:04:48+0000 [SSHService ssh-userauth on HoneyPotTransport,9238,193.200.88.100] login attempt [root/1234] failed
2013-02-10 13:04:53+0000 [SSHService ssh-userauth on HoneyPotTransport,9239,193.200.88.100] login attempt [root/redhat] failed
2013-02-10 13:04:59+0000 [SSHService ssh-userauth on HoneyPotTransport,9240,193.200.88.100] login attempt [oracle/oracle] failed
2013-02-10 13:05:02+0000 [SSHService ssh-userauth on HoneyPotTransport,9241,193.200.88.100] login attempt [test/test] failed
2013-02-10 13:05:04+0000 [SSHService ssh-userauth on HoneyPotTransport,9242,193.200.88.100] login attempt [root/1] failed
2013-02-10 13:05:07+0000 [SSHService ssh-userauth on HoneyPotTransport,9243,193.200.88.100] login attempt [root/123] failed
2013-02-10 13:05:09+0000 [SSHService ssh-userauth on HoneyPotTransport,9244,193.200.88.100] login attempt [root/123456789] failed
2013-02-10 13:05:12+0000 [SSHService ssh-userauth on HoneyPotTransport,9245,193.200.88.100] login attempt [root/12345678] failed
2013-02-10 13:05:14+0000 [SSHService ssh-userauth on HoneyPotTransport,9246,193.200.88.100] login attempt [root/1234567] failed
2013-02-10 13:05:17+0000 [SSHService ssh-userauth on HoneyPotTransport,9247,193.200.88.100] login attempt [root/12345] failed
2013-02-10 13:05:20+0000 [SSHService ssh-userauth on HoneyPotTransport,9248,193.200.88.100] login attempt [teamspeak/teamspeak] failed
2013-02-10 13:05:22+0000 [SSHService ssh-userauth on HoneyPotTransport,9249,193.200.88.100] login attempt [teamspeak/ts3] failed
2013-02-10 13:05:25+0000 [SSHService ssh-userauth on HoneyPotTransport,9250,193.200.88.100] login attempt [nagios/nagios] failed
2013-02-10 13:05:28+0000 [SSHService ssh-userauth on HoneyPotTransport,9251,193.200.88.100] login attempt [postgres/postgres] failed
2013-02-10 13:05:30+0000 [SSHService ssh-userauth on HoneyPotTransport,9252,193.200.88.100] login attempt [root/qwe] failed
2013-02-10 13:05:33+0000 [SSHService ssh-userauth on HoneyPotTransport,9253,193.200.88.100] login attempt [root/1q2w3e] failed
2013-02-10 13:05:40+0000 [SSHService ssh-userauth on HoneyPotTransport,9254,193.200.88.100] login attempt [root/1q2w3e4r] failed
2013-02-10 13:05:43+0000 [SSHService ssh-userauth on HoneyPotTransport,9255,193.200.88.100] login attempt [root/qweqwe123] failed
2013-02-10 13:05:45+0000 [SSHService ssh-userauth on HoneyPotTransport,9256,193.200.88.100] login attempt [root/qazwsxedc] failed
2013-02-10 13:05:48+0000 [SSHService ssh-userauth on HoneyPotTransport,9257,193.200.88.100] login attempt [root/1qa2ws3ed] failed
2013-02-10 13:05:57+0000 [SSHService ssh-userauth on HoneyPotTransport,9258,193.200.88.100] login attempt [root/123123] failed
2013-02-10 13:06:00+0000 [SSHService ssh-userauth on HoneyPotTransport,9259,193.200.88.100] login attempt [root/abcd1234] failed
2013-02-10 13:06:03+0000 [SSHService ssh-userauth on HoneyPotTransport,9260,193.200.88.100] login attempt [root/qazwsx123] failed
2013-02-10 13:06:05+0000 [SSHService ssh-userauth on HoneyPotTransport,9261,193.200.88.100] login attempt [root/abc123] succeeded
2013-02-10 13:06:22+0000 [SSHService ssh-userauth on HoneyPotTransport,9262,193.200.88.100] login attempt [root/toor] failed
2013-02-10 13:015:24+0000 [SSHService ssh-userauth on HoneyPotTransport,9263,64.185.229.236] login attempt [root/IamSo1337!] succeeded
If you have any other tips or tricks like this, let me know by leaving a comment or sending me an email at 1aN0rmus@TekDefense.com
Honeydrive, Kippo, honeypot, ssh in TekTip Friday, February 8, 2013 at 3:02PM In this episode of the Kippo Kroicles we replay the attack of the most advanced of all attackers, the APT Attacker. Okay, not quite. In fact calling this guy (or maybe gal) an APT'er is like calling your chubby friend slim. I get typing dir in once on accident, but to repeatedly try to type dir in linux, come on now. Anyways, I have a ton of logs stored up and ready to videotize. More to come.