T-Pot 22.04.0

2022 Version of T-Pot has dropped.  

Lots of new visualisations.

Looks like I will be updating my systems!

T-Pot 20 has new visualisations.

Attacks collected Heat Map.

MHN Live Attack Map

Collecting from

• Dionaea
• Corrie

Everyone likes a Pew Pew map to show the attacks.

Looking for deception

The deception port is identified as   --- Port 365

Does anyone use it ?



nmap -iR 0   -p 365


nmap -iR 10000   --dns-servers 9.9.9.9 -p 365   --reason -vv  | find "open port"




----
https://nmap.org/book/man-target-specification.html

Docker - Install MHN

docker run -p 10000:10000 -p 80:80 -p 3000:3000 -p 8089:8089 --name mhn -t -i ubuntu:14.04.2 /bin/bash




Plus more ports later ?




Next, create and run the following script:

#!/bin/bash

set -x

apt-get update 
apt-get upgrade -y 
apt-get install git wget gcc supervisor -y 
cd /opt/ 
git clone https://github.com/threatstream/mhn.git 
cd mhn

cat > /etc/supervisor/conf.d/mhntodocker.conf <<EOF
[program:mongod]
command=/usr/bin/mongod
stdout_logfile=/var/log/supervisor/%(program_name)s.log
stderr_logfile=/var/log/supervisor/%(program_name)s.log
autorestart=true
autostart=true

[program:nginx]
command=/usr/sbin/nginx
stdout_events_enabled=true
stderr_events_enabled=true
autostart=true
autorestart=true

EOF

mkdir -p /data/db /var/log/mhn /var/log/supervisor

supervisord &

#Starts the mongod service after installation
echo supervisorctl start mongod >> /opt/mhn/scripts/install_mongo.sh

./install.sh

supervisorctl restart all




Run the container with a range of ports, 




docker stop image 

docker commit image newimage







docker run -p 1-10000:1-100000 - --name mhn -t -i newimage /bin/bash




docker run -p 7000-8000:7000-8000

---
Thanks


https://github.com/threatstream/mhn/wiki/Running-MHN-in-Docker
https://stackoverflow.com/questions/28717464/docker-expose-all-ports-or-range-of-ports-from-7000-to-8000

Docker - Rename Container

To add port forwardings, I always follow these steps,

1. stop running container

   docker stop test01
   

2. commit the container

   docker commit test01 test02
   

   NOTE: The above, test02 is a new image that I'm constructing from the test01 container.
3. re-run from the commited image

   docker run -p 8080:8080 -td test02
   

Where the first 8080 is the local port and the second 8080 is the container port.

---
Thanks

https://stackoverflow.com/questions/19335444/how-do-i-assign-a-port-mapping-to-an-existing-docker-container

Docker Honeypots - Conpot

Via a pre-built image

1. Install Docker
2. Run docker pull honeynet/conpot
3. Run docker run -it -p 80:80 -p 102:102 -p 502:502 -p 161:161/udp --network=bridge honeynet/conpot:latest /bin/sh
4. Finally run conpot --template default

Navigate to http://MY_IP_ADDRESS to confirm the setup.

Conpot is an ICS honeypot with the goal to collect intelligence about the motives and methods of adversaries targeting industrial control systems

---
Thanks

https://hub.docker.com/r/honeynet/conpot/

Uninstalling P0F from MHN

# as root
rm /etc/supervisor/conf.d/p0f.conf
supervisorctl update
rm -rf /var/empty/p0f /opt/p0f /var/log/p0f.*

===
Thanks

https://github.com/threatstream/mhn/wiki/Uninstalling-Honeypots

Deleting logs from MHN

After installing  Dionaea, Snort, P0f and Khipo ... my my views of the MHN Server Website gave P0f logs ... so to tidy up

Remove the P0f Sensor from view sensors

mongo mnemosyne
> db.session.remove({})
> db.metadata.remove({})
> db.counts.remove({})
> db.file.remove({})
> db.hpfeed.remove({})
> db.dork.remove({})
> db.url.remove({})
> db.daily_stats.remove({})

===
Thanks

https://github.com/threatstream/mhn/wiki/Deleting-Data-from-MHN

Experiments with T-Pot

http://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html




http://sicherheitstacho.eu/?lang=en

plink -ssh -P 64295 198.51.100.152  -L 8080:127.0.0.1:64296



To turn in SSH

https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

sudo gedit /etc/ssh/sshd_config

PasswordAuthentication yes

sudo restart ssh

Raspberry Pi on QEMU

---Thanks---

https://sourceforge.net/projects/honeeepi/?source=typ_redirect

http://techny.tumblr.com/post/36589722093/quick-guide-on-emulating-a-raspberry-pi-in-windows

Ubuntu 14.04.5 LTS (Trusty Tahr) and Modern Honey Network

Getting much better results now installing onto Ubuntu 14.04

sudo apt-get install git -y

cd /opt/
sudo git clone https://github.com/threatstream/mhn.git
cd mhn/

sudo ./install.sh

MHN mnemosyne FATAL status

I found this page

http://webcache.googleusercontent.com/search?q=cache:luZNj4e2uL4J:www.malovisky.com/&num=1&hl=en&gl=uk&strip=1&vwsrc=0

The application mnemosyne is responsible for informing the attacks suffered by the honeypot and without her the operation framework becomes somewhat inoperable.
 If the terminal give the command #python-V you will check that the python version is 2.7.3 and for the application's operation it must be to 2.7.4.

Some more naughty already would drop an apt-get upgrade but from what I have researched the
python 2.7.4 is not part of the source list for ubuntu 12.04.5 only from the 13.

From then on will work.  I hit my head more than a week to fix this problem


wget https://www.python.org/ftp/python/2.7.4/Python-2.7.4.tgz
tar -zxvf Python-2.7.4.tgz
cd Python-2.7.4/
./configure
make
make install
shutdown -r now


cd /opt
rm -rv mnemosyne
cd /opt/mhn/scripts
./install_mnemosyne.sh
shutdown -r now


===
Thanks to https://github.com/malovisky

MHN and Raspberry Pi

Pi Bits

Back up NOOBs

load up
turn on SSH
note the IP address



Ubuntu MHN install

https://github.com/threatstream/mhn

cd /opt/
sudo apt-get install git -y
sudo git clone https://github.com/threatstream/mhn.git
cd mhn/
sudo ./install.sh




https://github.com/threatstream/mhn/wiki/Deploying-Dionaea-on-a-Raspberry-Pi



Browse from a Windows PC

https://www.bitvise.com/ssh-client-download


Test 1

MHN Troubleshooting

PyMongo Connection Refused 

sudo rm -r /opt/hpfeeds

sudo rm -r /opt/mnemosyne

mongod --repair

./install.sh

Check if firewall port redirects are causing this trouble.

edit the /etc/mongod.conf file and set your bind_ip = 0.0.0.0 in order to make connections externally.

Thanks----


http://stackoverflow.com/questions/24899849/connection-refused-to-mongodb-errno-111

MHN - Celery Worker is not working

I needed to navigate to


cd /opt/mhn/servers


Then


cd $MHN_HOME/server
sudo chown www-data mhn.log
sudo supervisorctl start mhn-celery-worker








==Thanks==


https://github.com/threatstream/mhn/wiki/MHN-Troubleshooting-Guide

My Live Test

MHN Dionaea ThreatMap

http://194.80.168.1:3000/

Set MHN for local rfc1918 addresses

#!/bin/bash

# LocalMHN to set MHN for rfc1918 private / local networks CEM 29/Oct/2014

cd /opt/mnemosyne/
git fetch origin
git stash
git merge origin/master
git stash pop

sed -i 's/ignore_rfc1918 = True/ignore_rfc1918 = False/g' mnemosyne.cfg

supervisorctl restart mnemosyne

supervisorctl status

====take two ===

#!/bin/bash

# LocalMHN to set MHN for rfc1918 private / local networks CEM 22/Sept/2014
# Also trap mac addresses in Dionaea for analysis

cd /opt/mnemosyne/
git fetch origin
git stash
git merge origin/master
git stash pop

sed -i 's/ignore_rfc1918 = True/ignore_rfc1918 = False/g' mnemosyne.cfg

sed -i 's/lookup_ethernet_addr = "no"/lookup_ethernet_addr = "yes"/g' /etc/dionaea/dionaea.conf


supervisorctl restart mnemosyne


sudo supervisorctl restart dionaea


supervisorctl status

Enable MHN Dionaea Sandbox submission

Regarding the sandbox submission, we don't have this enabled now. Do do so, you need to do a couple things.  

sudo gedit /etc/dionaea/dionaea.conf
.

1. find the line that looks like this (in the ihandlers section):
// "virustotal",
and uncomment it.

2. Find the section that looks like this:
virustotal = {
     apikey = "........." // grab it from your virustotal account at My account -> Inbox -> Public API
     file = "var/dionaea/vtcache.sqlite"
}
and fill in your API key.

2f226f10dfe3a6b2d==

f0102876b42070cd2==

7f86543ae28d79443==

bdd98eb539708

3 Save dionaea.conf and restart

sudo supervisorctl restart dionaea

--

Thanks 

Jason @ Threatstream

cd /opt/mhn

source env/bin/activate

sudo pip install --upgrade -r server/requirements.txt 

sudo supervisorctl status