<pre id="vvttv"><mark id="vvttv"><progress id="vvttv"></progress></mark></pre>
    <pre id="vvttv"></pre>
      <p id="vvttv"></p>

          

          <p id="vvttv"></p>
                <p id="vvttv"></p>
                

                <pre id="vvttv"><cite id="vvttv"><progress id="vvttv"></progress></cite></pre>
                  
<output id="vvttv"><dfn id="vvttv"><th id="vvttv"></th></dfn></output>
                    <p id="vvttv"></p>
                    
				
                    原文地址:http://drops.wooyun.org/papers/4584
                    
				
      
                    
        
                    0x00 前言
                    


                    


                    測試了一下dionaea這個蜜罐,算是一篇總結吧
                    


                    0x01 環境
                    


                    


                    CentOS release 6.2 (Final)
                    


                    Linux www.centos.com 2.6.32-220.el6.x86_64 #1 SMP Tue Dec 6 19:48:22 GMT 2011 x86_64 x86_64 x86_64 GNU/Linux
                    




                    0x02 依賴性
                    


                    


                    libev >=4.04
                    


                    libglib >=2.20
                    


                    libssl
                    


                    liblcfg
                    


                    libemu
                    


                    python >=3.2
                    


                    sqlite >=3.3.6
                    


                    readline >=3
                    


                    cython >0.14.1
                    


                    libudns
                    


                    libcurl >=7.18
                    


                    libpcap >=1.1.1
                    


                    libnl(可選,不加也沒啥影響)
                    


                    libgc >=6.8
                    


                    0x03 安裝
                    


                    


                    #!bash
mkdir /opt/dionaea
yum install git autoconf* libtool-*

                    


                    liblcfg
                    


                    #!bash
git clone git://git.carnivore.it/liblcfg.git liblcfg
cd liblcfg/code
autoreconf -vi
./configure --prefix=/opt/dionaea
make install

                    


                    libemu
                    


                    #!bash
git clone git://git.carnivore.it/libemu.git libemu
cd libemu
autoreconf -vi
./configure --prefix=/opt/dionaea
make install

                    


                    libev
                    


                    #!bash
wget http://dist.schmorp.de/libev/Attic/libev-4.04.tar.gz
tar xfz libev-4.04.tar.gz
cd libev-4.04
./configure --prefix=/opt/dionaea
make install

                    


                    Python 3.2
                    


                    #!bash
yum groupinstall "Development tools"
yum install zlib-devel bzip2-devel openssl-devel ncurses-devel sqlite-devel readline-devel tk-devel
wget http://www.python.org/ftp/python/3.2.2/Python-3.2.2.tgz
tar xfz Python-3.2.2.tgz
cd Python-3.2.2/
./configure --enable-shared --prefix=/opt/dionaea --with-computed-gotos --enable-ipv6 LDFLAGS="-Wl,-rpath=/opt/dionaea/lib/ -L/usr/lib/x86_64-linux-gnu/"
make
make install

                    


                    Cython
                    


                    #!bash
wget http://cython.org/release/Cython-0.15.tar.gz
tar xfz Cython-0.15.tar.gz
cd Cython-0.15
/opt/dionaea/bin/python3 setup.py install

                    


                    udns
                    


                    #!bash
wget http://www.corpit.ru/mjt/udns/old/udns_0.0.9.tar.gz
tar xfz udns_0.0.9.tar.gz
cd udns-0.0.9/
./configure
make shared
cp udns.h /opt/dionaea/include
cp *.so* /opt/dionaea/lib/
cd /opt/dionaea/lib
ln -s libudns.so.0 libudns.so

                    


                    libpcap
                    


                    #!bash
wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz
tar xfz libpcap-1.1.1.tar.gz
cd libpcap-1.1.1
./configure --prefix=/opt/dionaea
make
make install

                    


                    libcurl
                    


                    #!bash
#可以源碼編譯,也可以直接安裝
git clone https://github.com/bagder/curl.git curl
cd curl
autoreconf -vi
./configure --prefix=/opt/dionaea
make
make install

                    


                    dionaea
                    


                    #!bash
#nl模塊會出問題,各種問題....
#實在不行/usr/include/netlink/netlink.h,mv到其他目錄,
#安裝好了再復原了
git clone git://git.carnivore.it/dionaea.git dionaea
cd dionaea
autoreconf -vi
./configure --with-lcfg-include=/opt/dionaea/include/ \
      --with-lcfg-lib=/opt/dionaea/lib/ \
      --with-python=/opt/dionaea/bin/python3.2 \
      --with-cython-dir=/opt/dionaea/bin \
      --with-udns-include=/opt/dionaea/include/ \
      --with-udns-lib=/opt/dionaea/lib/ \
      --with-emu-include=/opt/dionaea/include/ \
      --with-emu-lib=/opt/dionaea/lib/ \
      --with-gc-include=/usr/include/gc \
      --with-ev-include=/opt/dionaea/include \
      --with-ev-lib=/opt/dionaea/lib \
      --with-curl-config=/usr/bin/ \
      --with-pcap-include=/opt/dionaea/include \
      --with-pcap-lib=/opt/dionaea/lib/ 
make
make install

                    


                    創建指定特定的用戶和組,用來運行dionaea
                    


                    #!bash
groupadd dionaea
useradd -g dionaea -s /usr/sbin/nologin dionaea
chown -R dionaea:dionaea /opt/dionaea/

                    


                    運行測試,沒報錯,使用netstat -antple 看到好多dionaea開放的端口,證明安裝成功
                    


                    #!bash
cd /opt/dionaea/bin
./dionaea -c /opt/dionaea/etc/dionaea/dionaea.conf -u dionaea -g dionaea

                    


                    enter image description here
                    


                    0x04 圖形化
                    


                    


                    Python 2.7
                    


                    #!bash
yum groupinstall "Development tools"
yum install zlib-devel bzip2-devel openssl-devel ncurses-devel sqlite-devel readline-devel tk-devel
wget http://www.python.org/ftp/python/2.7.6/Python-2.7.6.tar.xz
tar -Jxvf Python-2.7.6.tar.xz
cd Python-2.7.6
./configure --with-threads --enable-shared --prefix=/usr/local
make
make altinstall
ln -s /usr/local/lib/libpython2.7.so.1.0 /lib64/

                    


                    pip
                    


                    #!bash
wget http://pypi.python.org/packages/source/d/distribute/distribute-0.6.49.tar.gz
tar zxvf distribute-0.6.49.tar.gz
cd distribute-0.6.49
python2.7 setup.py install
easy_install-2.7 pip

                    


                    django
                    


                    #!bash
pip2.7 install Django pygeoip django-pagination django-tables2 django-compressor 
django-htmlmin django-filter
wget https://github.com/benjiec/django-tables2-simplefilter/archive/master.zip -O 
django-tables2-simplefilter.zip
unzip django-tables2-simplefilter.zip
mv django-tables2-simplefilter-master/ 
django-tables2-simplefilter/
cd django-tables2-simplefilter/
python2.7 setup.py install

                    


                    python-netaddr
                    


                    #!bash
wget https://pypi.python.org/packages/source/n/netaddr/netaddr-0.7.11.tar.gz
tar xzvf netaddr-0.7.11.tar.gz
cd netaddr-0.7.11
python2.7 setup.py install

                    


                    PySubnetTree
                    


                    #!bash
git clone git://git.bro-ids.org/pysubnettree.git
cd pysubnettree/
python2.7 setup.py install

                    


                    Nodejs
                    


                    #!bash
wget http://nodejs.org/dist/v0.8.16/node-v0.8.16.tar.gz
tar xzvf node-v0.8.16.tar.gz
cd node-v0.8.16
./configure
make
make install
npm install -g less

cd /opt/
wget https://github.com/RootingPuntoEs/DionaeaFR/archive/master.zip -O DionaeaFR.zip
unzip DionaeaFR.zip
mv DionaeaFR-master/ DionaeaFR

                    


                    GeoIP&&GeoLiteCity
                    


                    #!bash
cd /opt/DionaeaFR/DionaeaFR/static
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
gunzip GeoLiteCity.dat.gz
gunzip GeoIP.dat.gz

                    


                    運行圖形界面
                    


                    #!bash
cd /opt/DionaeaFR/
python2.7 manage.py collectstatic #type yes when asked

                    


                    可能提示要運行一次python manage.py migrate, 提示就運行一次,有時候報錯,但是好像不影響使用..........
                    


                    #!bash
python2.7 manage.py runserver 0.0.0.0:8000
Validating models...

                    


                    0x05 debug
                    


                    


                    更改時區,默認是美國的
                    


                    settings.py
TIME_ZONE = 'Asia/Shanghai'

                    


                    更改時間格式,一直沒有生效,不知道是為啥
                    


                    訪問web的時候
                    


                    Error: Cannot find module 'promise'

                    


                    運行
                    


                    npm install -g promise

                    


                    訪問DionaeaFR的GRAPHS頁面報
                    


                    TypeError: __init__() got an unexpected keyword argument 'mimetype'

                    


                    修改/opt/DionaeaFR/Web/views/graph.py，
                    


                    mimetype="application/json"全部修改成
                    


                    content_type="application/json"。
                    


                    訪問http://ip:8000
                    


                    enter image description here
                    


                    Nessus掃描
                    


                    enter image description here
                    


                    主機識別的結果
                    


                    enter image description here
                    


                    0x06 結構
                    


                    


                    命令格式
                    


                    


                    Dionaea 具體的命令格式如下：
                    


                    dionaea [-c, --config=FILE] [-D, --daemonize] [-g, --group=GROUP]
        [-h, --help] [-H, --large-help][-l, --log-levels=WHAT] [-L, --log-domains=WHAT]    
        [-u, --user=USER][-p, --pid-file=FILE] [-r, --chroot=DIR] [-V, --version]
        [-w, --workingdir=DIR]

                    


                    選項的意義分別是： -c：指定運行程序所使用的配置文件，默認下配置文件是/opt/dionaea/etc/dionaea.conf。 -D：后臺運行。 -g：指定啟動后切換到某個用戶組，默認下保持當前組。 -h：幫助信息。 -H：幫助信息，包括默認值信息。 -l：選擇事件記錄級別，可以選擇 all, debug, info, message, warning, critical, error 這些值，多選使用“,”做分隔，排除使用“-”。 -L：選擇域，支持通配符“*”和“?”，多選使用“,”，排除使用“-”。 -u：指定啟動后切換到某個用戶，默認下保持當前用戶。 -p：記錄 pid 到指定文件。 -r：指定啟動后切換根目錄到指定目錄，默認下不切換。 -V：顯示版本信息。 -w：設定進程工作目錄，默認下為/opt/dionaea。
                    


                    例子:
                    


                    dionaea -l all,-debug -L '*'
dionaea -l all,-debug -L 'con*,py*'
dionaea -u nobody -g nogroup -w /opt/dionaea -p /opt/dionaea/var/run/dionaea.pid

                    


                    配置文件
                    


                    


                    默認配置文件/opt/dionaea/etc/dionaea/dionaea.conf
                    


                    里面包含以下幾個模塊
                    


                    logging: 普通日志和錯誤日志存放的位置,等級和所屬的域.
                    


                    processors: 處理器 processors 部分配置 libemu 和用于導出數據流的模塊 streamdumper. libemu 部分可增減允許的協議,配置 shellcode 檢測時支持的最大流大小、跟蹤步數限制和并發執行數等性能參數。streamdumper 部分配置導出數據流時允許和拒絕的協議,數據流保存的位置。
                    


                    downloads: 文件下載保存的位置 bistreams: 配置數據流保存的位置 submit: 指定惡意文件自動提交的網址 listen: 指定監聽的IP和接口
                    


                        一共有三種模式:

    getifaddrs:對所有的ip上都開啟相關端口的監聽,127.0.0.1也會監聽,默認的選項
    manual:只在指定ip上開啟端口監聽
    nl:指定監聽的接口
    配置子接口,一個網卡上多個IP被監測

listen =
{
        mode = "manual"
        addrs = { eth0 = ["10.1.2.3", "11.1.2.3"]}
}

                    


                    modules: 配置各種模塊的工作參數.部分"必須模塊": curl、libemu、pcap模擬的服務等信息
                    


                        pcap:用來拒絕連接的請求.

    curl:用來傳輸文件,下載文件或者向第三方站點提交樣本

    emu:用來檢測或者模擬shellcode執行

    python:被dionaea調用,來模擬服務

                    


                    0x07 端口指紋信息修改
                    


                    


                    提供以下這些服務
                    


                    enter image description here
                    


                    nmap -sV端口識別,信息太明顯,顯示" Dionaea honeypot"等字樣
                    


                    enter image description here
                    


                    修改配置文件,變更指紋信息 SMB的445端口指紋: /opt/dionaea/lib/dionaea/python/dionaea/smb/include/smbfields.py 中
                    


                    MConditionalField(UnicodeNullField("OemDomainName", "WORKGROUP")
ConditionalField(UnicodeNullField("ServerName", "HOMEUSER-3AF6FE")

                    


                    WORKGROUP和HOMEUSER-3AF6FE,變更信息
                    


                    MSSQL的1433端口指紋: /opt/dionaea/lib/dionaea/python/dionaea/mssql/mssql.py的 r.VersionToken.TokenType = 0x00修改為0xAA
                    


                    FTP的21端口指紋: /opt/dionaea/lib/dionaea/python/dionaea/ftp.py self.reply(WELCOME_MSG, "Welcome to the ftp service") 修改為 self.reply(WELCOME_MSG, "Welcome to the svn service")
                    


                    識別為正常的服務
                    


                    enter image description here
                    


                    0x08 通過uwsgi+nginx來發布頁面
                    


                    


                    配置uwsgi
                    


                    


                    安裝pip
                    


                    #!bash
curl -O https://raw.github.com/pypa/pip/master/contrib/get-pip.py
python get-pip.py

                    


                    安裝uwsgi
                    


                    #!bash
export LDFLAGS="-Xlinker --no-as-needed"
pip install uwsgi

                    


                    測試uwsgi是否安裝成功
                    


                    #!bash
vim test.py

# test.pydef application(env, start_response):    start_response('200 OK', [('Content-Type','text/html')])    return "Hello World"

                    


                    執行shell命令
                    


                    #!bash
uwsgi --http :8001 --wsgi-file test.py

                    


                    訪問http://ip:8001是否有Hello World
                    


                    配置django
                    


                    


                    編輯django_wsgi.py
                    


                    #!python
# coding: utf-8
import os
import sys
reload(sys)
sys.setdefaultencoding('utf8')

                    


                    需要修改的
                    


                    #!python
#os.environ.setdefault("DJANGO_SETTINGS_MODULE", "mysite.settings")
#from django.core.handlers.wsgi import WSGIHandler
#application = WSGIHandler()

os.environ.setdefault("DJANGO_SETTINGS_MODULE", "DionaeaFR.settings")
from django.core.wsgi import get_wsgi_application
application = get_wsgi_application()

                    


                    連接django和uwsgi
                    


                    #!bash
uwsgi --http :8000 --chdir /opt/DionaeaFR --module django_wsgi

                    


                    訪問http://ip:8000,可以看到項目
                    


                    編寫配置文件,來運行uWSGI
                    


                    #!html
vim /opt/DionaeaFR/djangochina_socket.xml

<uwsgi>
        <socket>127.0.0.1:9001</socket>
        <chdir>/opt/DionaeaFR/</chdir>
        <module>django_wsgi</module>
        <processes>1</processes> <!-- 進程數 -->
        <daemonize>/opt/DionaeaFR/var/uwsgi.log</daemonize>
        <pidfile>/opt/DionaeaFR/var/uwsgi.pid</pidfile>
</uwsgi>
mkdir /opt/DionaeaFR/var/

                    


                    配置nginx
                    


                    


                    location / {             include        uwsgi_params;            uwsgi_pass     127.0.0.1:8077;        }

                    


                    配置目錄,要不然css這些就沒有了
                    


                    location /static/ {
alias /opt/DionaeaFR/static/;
        }

                    


                    重新載入nginx配置文件
                    


                    nginx -s reload

                    


                    運行uwsgi
                    


                    cd /opt/DionaeaFR
uwsgi -x djangochina_socket.xml

                    


                    4.簡單的控制腳本
                    


                    #!bash
UWSGI='/usr/local/bin/uwsgi'
UWSGIPID='/opt/DionaeaFR/var/uwsgi.pid'
UWSGIXML='/opt/DionaeaFR/djangochina_socket.xml'
KILL='/bin/kill'
RM='/bin/rm'


#start
start() {
                if [ -f $UWSGIPID ]
                then
                        echo "uwsgi has running"
                        return 1
                fi
                $UWSGI -x $UWSGIXML
                echo "uwsgi have running"
                return 0
        }

#stop
stop() {
                if [ ! -f $UWSGIPID ]
                then
                        echo "uwsgi not running"
                        return 1
                fi
                $KILL -HUP `cat $UWSGIPID` && $RM -f $UWSGIPID
                if [ $? -eq 0 ]
                then
                        echo "uwsgi is stop"
                        return 0
                fi   
                echo "uwsgi stop fail"
                return 1
        }
#status
status() {
                if [ -f $UWSGPID ]
                then
                        echo "running"
                        return 0
                fi
                echo "not running"
                return 0
        }

#see how we were called.
case "$1" in
  start)
        start
        ;;
  stop)
        stop
        ;;
  status)
        status
        ;;
  *)
        echo "Usage: dionaea {start|stop}"
Esac

                    


                    0x09 后記
                    


                    


                    [email protected],收集了一些數據,這個比ssh的蜜罐多了太多!!!!!
                    


                    enter image description here
                    


                    enter image description here
                    


                    enter image description here
                    


                    enter image description here
                    


                    enter image description here
                    


                    有大量的惡意程序,有興趣的可以私信我啊~~~
                    


                    最后給team的博客打個廣告,大家手下留情........ http://www.sigma.ws/
                    


                    參考:
                    


                    http://takahoyo.hatenablog.com/entry/2014/05/26/023409
                    


                    http://takahoyo.hatenablog.com/entry/2014/06/07/233059
                    


                    http://bruteforce.gr/visualizing-dionaeas-results-with-dionaeafr.html
                    


                    http://dionaea.carnivore.it/
                    


                    http://rubenespadas.github.io/DionaeaFR/
                    


                    http://www.freebuf.com/articles/system/12696.html
                    


                    http://www.securityartwork.es/2014/06/05/avoiding-dionaea-service-identification/?lang=en
                    


                    Dionaea低交互式蜜罐介紹.pdf
                          
                    
    
			

                      <pre id="vvttv"><mark id="vvttv"><progress id="vvttv"></progress></mark></pre>
                      <pre id="vvttv"></pre>
                        <p id="vvttv"></p>

                            

                            <p id="vvttv"></p>
                                  <p id="vvttv"></p>
                                  

                                  <pre id="vvttv"><cite id="vvttv"><progress id="vvttv"></progress></cite></pre>
                                    
<output id="vvttv"><dfn id="vvttv"><th id="vvttv"></th></dfn></output>
                                      <p id="vvttv"></p>
                                      

这里只有精品视频