带你走进T-Pot:多蜜罐平台革命
T-Pot 19.03 T-Pot 19.03 runs on Debian (Sid), is based heavily on docker, docker-compose and includes dockerized versions of the following honeypots adbhoney, ciscoasa, conpot, cowrie, dionaea, elasticpot, glastopf, glutton, heralding, honeypy, honeytrap, mailoney, medpot, rdpy, snare, tanner Furthermore we use the following tools Cockpit for a lightweight, webui for…
目录
0x00简述篇
项目简介
DTAG 社区蜜罐项目:http://dtag-dev-sec.github.io
官方简介:https://dtag-dev-sec.github.io/mediator/feature/2019/04/01/tpot-1903.html
项目地址:https://github.com/dtag-dev-sec/tpotce
系统架构
T-pot MuMulti-Honeypot-Platform-Revolution 的系统架构图
态势概览
实时统计各项攻击行为,清晰的各种报表统计,准确定位攻击源IP与真实地理位置.
技术概念
T-Pot基于linux的网络安装程序。蜜罐守护程序以及正在使用的其他支持组件已使用Docker进行容器化。这允许我们在同一网络接口上运行多个蜜罐守护进程,同时保持较小的占用空间并限制每个蜜罐在其自己的环境中。
Dockerized Honeypots
在T-pot中含有以下各种dockerized honeypots
-
adbhoney
低交互工控蜜罐,提供一系列通用工业控制协议, 能够模拟复杂的工控基础设施。 -
ciscoasa
基于kippo更改的中交互ssh蜜罐, 可以对暴力攻击账号密码等记录,并提供伪造的文件系统环境记录黑客操作行为, 并保存通过wget/curl下载的文件以及通过SFTP、SCP上传的文件。 -
conpot
低交互工控蜜罐,提供一系列通用工业控制协议, 能够模拟复杂的工控基础设施。 -
cowrie
基于kippo更改的中交互ssh蜜罐, 可以对暴力攻击账号密码等记录,并提供伪造的文件系统环境记录黑客操作行为, 并保存通过wget/curl下载的文件以及通过SFTP、SCP上传的文件。 -
dionaea
Dionaea是运行于Linux上的一个应用程序,将程序运行于网络环境下,它开放Internet常见服务的默认端口,当有外来连接时,模拟正常服务给予反馈,同时记录下出入网络数据流。网络数据流经由检测模块检测后按类别进行处理,如果有 shellcode 则进行仿真执行;程序会自动下载 shellcode 中指定或后续攻击命令指定下载的恶意文件。 -
elasticpot
模拟elastcisearch RCE漏洞的蜜罐,通过伪造函数在/,/_search, /_nodes的请求上回应脆弱ES实例的JSON格式消息。 -
glastopf
低交互型Web应用蜜罐, Glastopf蜜罐它能够模拟成千上万的web漏洞,针对攻击的不同攻击手段来回应攻击者,然后从对目标Web应用程序的攻击过程中收集数据。它的目标是针对自动化漏洞扫描/利用工具,通过对漏洞利用方式进行归类,针对某一类的利用方式返回对应的合理结果,以此实现低交互。 -
glutton
所有吃蜜罐,可喂食蜜罐。 -
heralding
一个捕获蜜罐的凭证。 -
honeypy
一种低交互蜜罐能力,具有更强的媒体交互能力。 HoneyPy是用 python 编写的,目的是便于使用: 部署,使用插件扩展功能,并应用自定义配置。 交互的级别由插件的功能决定。 可以创建插件来模拟基于UDP或者基于TCP的服务,从而提供更多交互。 默认情况下,所有活动都记录到文件中,但将蜜罐活动发布到 Twitter 或者web服务端点也可以. -
honeytrap
观察针对TCP或UDP服务的攻击,作为一个守护程序模拟一些知名的服务,并能够分析攻击字符串,执行相应的下载文件指令。 -
mailoney
SMTP蜜罐,开放继电器,通过 python 编写的信誉收集器。 -
rdpy
Rdpy 是一个用 Python 实现的 RDP 和 VNC 协议,可以用作服务端以及客户端,同时也提供 RDP 的蜜罐,用于记录 RDP 的过程 -
snare
Snare/Tanner是web蜜罐Glastopf 的继任者。SNARE是一个Web应用程序蜜罐传感器,可以吸引来自Internet的各种恶意。 -
tanner
Snare/Tanner是web蜜罐Glastopf 的继任者。TANNER是一种远程数据分析和分类服务,用于评估HTTP请求并组成SNARE事件服务的响应。
Further Tools
在主机上同时安装了以下几种工具
- Cockpit
for a lightweight, webui for docker, os, real-time performance monitoring and web terminal.Cockpit 使得 Linux 系统管理员、系统维护员和开发者能轻松地管理他们的服务器并执行一些简单的任务,例如管理存储、检测日志、启动或停止服务以及一些其它任务。它的报告界面添加了一些很好的功能使得可以轻松地在终端和 Web 界面之间切换。另外,它不仅使得管理一台服务器变得简单,更重要的是只需要一个单击就可以在一个地方同时管理多个通过网络连接的服务器. - Cyberchef
a web app for encryption, encoding, compression and data analysis.英国情报机构-英国情报机构政府通信总部(GCHQ)发布了一款新型的开源Web工具,这款工具可以帮助安全研究人员更好地分析和解密数据。这款工具名为CyberChef,而它也被GCHQ誉为网络版的“瑞士军刀”。CyberChef是一款非常简单且直观的Web应用,使用者可以在一个Web浏览器中完成各种各样的网络操作。这些操作包括创建hexdump,进行XOR或Base64等简单的编码,进行类似AES、DES和Blowfish等复杂的加密处理,数据压缩或解压缩,计算哈希和校验值,以及对IPv6和X.509数据进行解析等等。” - ELK stack
to beautifully visualize all the events captured by T-Pot.优雅地可视化T-Pot捕获到的攻击事件 - Elasticsearch Head
a web front end for browsing and interacting with an Elastic Search cluster.一个web前端来浏览和操作ElasticSearch集群. - Spiderfoot
a open source intelligence automation tool.SpiderFoot是一个Python编写的免费开源的网站信息收集类工具,并且支持跨平台运行,适用于Linux、*BSD和Windows系统。此外,它还为用户提供了一个易于使用的GUI界面。在功能方面SpiderFoot也为我们考虑的非常周全,通过SpiderFoot我们可以获取相关目标的各种信息,例如网站子域、电子邮件地址、web服务器版本等等。SpiderFoot简单的基于Web的界面,使你能够在安装后立即启动扫描 – 只需简单的设置扫描目标域名,并启用相应的扫描模块即可。 - Suricata
a Network Security Monitoring engine.开源的网络安全威胁检测引擎。
0x01安装篇
1.环境准备
-
先安装主机系统,官方指定Debian系统,建议9.7及更新版本,测试过程使用的是:debian-9.9.0-amd64-xfce ,各个版本Debian下载地址:Debian release)
-
6-8 GB RAM (less RAM is possible but might introduce swapping)
-
128 GB SSD (smaller is possible but limits the capacity of storing events)
-
Network via DHCP
-
A working, non-proxied, internet connection
2.项目下载
git clone https://github.com/dtag-dev-sec/tpotce
3.脚本安装
cd tpotce/iso/installer/
su root
- 3.1 方法一:手动配置
./install.sh --type=user
- 3.2 方法二:自动配置
cp tpot.conf.dist tpot.conf
./install.sh --type=auto --conf=tpot.conf
# 配置文件里面含有64297端口进行Web管理的用户名和密码
# 即用户名webuser,密码w3b$ecret
因需下载文件多来自国外的源,安装过程需要很久的等待,安装完成过后,系统将自动重启。
3.首次运行
- SSH and Web Access
Browser and access the Admin UI:https://<your.ip>:64294
SSH to access the command line:ssh -l username -p 64295 <your.ip>
user: [tsec or user] you chose during one of the post Debian install methods
pass: [password] you chose during the Debian installation
- Kibana Dashboard
Browser and access the Web UI:https://<your.ip>:64297
user: [user] you chose during the installation,according to tpot.conf
pass: [password] you chose during the installation,according to tpot.conf
即用户名webuser,密码w3b$ecret
0x02使用篇
服务器管理:Web Access
系统
Cockpit Overview
容器
Cockpit Containers
需要将登录用户添加到docker用户组中。
# 将当前用户加入docker组:
$ sudo usermod -aG docker $USER
终端
Cockpit Terminal
Tools
Cyberchef
ES Head Plugin
Spiderfoot
蜜罐可视化:Kibana Dashboard
涉及较多的Kibana可视化配置,
0x03优化篇
Updates
For the ones of you who want to live on the bleeding edge of T-Pot development we introduced an update feature which will allow you to update all T-Pot relevant files to be up to date with the T-Pot master branch. If you made any relevant changes to the T-Pot relevant config files make sure to create a backup first.
- The Update script will
- merciless overwrite local changes to be in sync with the T-Pot master branch
- upgrade the system to the packages available in Debian (Sid)
- update all resources to be in-sync with the T-Pot master branch
- ensure all T-Pot relevant system files will be patched / copied into the original T-Pot state
You simply run the update script:
cd /opt/tpot/
./update.sh -y
0x04更新日志
20 Aug 2020
T-Pot Version 20.06 released
20 Aug 2020
On June, 30th 2020 we finally released T-Pot 20.06 after an extensive period of testing to ensure the update process (which is still in beta) is not likely to break things. With T-Pot 20.06 released we are proud to see that T-Pot is now growing faster than before. T-Pot 20.06 comes with new honeypots, such as Dicompot, a new Elasticpot and HoneySAP. All of which have Kibana dashboards readily available to get you covered…
Upgrade from 19.03.x
If you are running T-Pot 19.x you can upgrade to T-Pot 20.06.0 by running /opt/tpot/update.sh. Please be aware upgrades can break things, so please backup all of your data or take snapshot of your machine before you run the update procedure.
To protect possible changes of your Kibana objects you need to manually export (backup) your objects and manually import (overwrite) the provided T-Pot Kibana Objects after upgrading.
Changelog
- Release T-Pot 20.06.0
After 4 months of public testing with
the NextGen edition T-Pot 20.06 can finally be released.- Debian Buster
With the release of Debian Buster T-Pot now has access to all packages required right out of the box.- Add new honeypots
①Dicompot by @nsmfoo is a low interaction honeypot for the Dicom protocol which is the international standard to process medical imaging information. Together with Medpot which supports the HL7 protocol T-Pot is now offering a Medical Installation type.
②Honeysap by SecureAuthCorp is a low interaction honeypot for the SAP services, in case of T-Pot configured for the SAP router.
③Elasticpot by Vesselin Bontchev replaces ElasticpotPY as a low interaction honeypot for Elasticsearch with more features, plugins and scripted responses.- Rebuild Images
All docker images were rebuilt based on the latest (and stable running) versions of the tools and honeypots. Mostly the images now run on Alpine 3.12 / Debian Buster. However some honeypots / tools still reuire Alpine 3.11 / 3.10 to run properly.- Install Types
All docker-compose files (/opt/tpot/etc/compose) were remixed and most of
the NextGen honeypots are now available in Standard. There is now a
Medical Installation Type with Dicompot and Medpot which will be of
most interest for medical institutions to get started with T-Pot.- Update Tools
Connecting to T-Pot via https://:64297 brings you to
the T-Pot Landing Page now which is based on Heimdall and the latest
NGINX enforcing TLS 1.3. The ELK stack was updated to 7.8.0 and
stripped down to the necessary core functions (where possible) for
T-Pot while keeping ELK RAM requirements to a minimum (8GB of RAM is
recommended now). The number of index pattern fields was reduced to
697 which increases performance significantly. There are 22 Kibana
Dashboards, 397 Kibana Visualizations and 24 Kibana Searches readily
available to cover all your needs to get started and familiar with
T-Pot. Cyberchef was updated to 9.21.0. Elasticsearch Head was updated
to the latest version available on GitHub. Spiderfoot was updated to
latest 3.1 dev.- Landing Page
After logging into T-Pot via web you are now greeted with a beautifully designed landing page.
Countless Tweaks and improvements Under the hood lots of tiny tweaks, improvements and a few bugfixes will increase your overall experience with T-Pot.