E.g.
I created a folder in /var called ‘.a’ and dropped the script in there and then ran the following command:The above command will copy the directory listing on the machine, by running it from ‘/var/.a’ the script won’t be somewhere the attacker would detect the file so is another way of avoiding the honeypot being identified. For install purposes we are just interested in the deploy command.Back in Azure create a new device, again I didn’t go crazy allocating space for this device, the OS was Linux Ubuntu 18.04 and I went with 40GB HD and 2 GB RAM.For the initial setup I only opened port 22 and again used a newly created SSH key for access.
It also shows the bash script that will be run in the background.
The reason being that I wanted to customise my Cowrie sensor so that it wasn’t obvious to any attackers that I had a vanilla cowrie install.I decided I would make the honeypot look like an Ubuntu machine. The attackers are able to download malware into the honeypot however it is siphoned off and the attackers are unable to run it.Digging a little deeper I came across something called MHN (Modern Honey Network). in VirtualBox, you then have to choose the If you decide to run T-Pot on dedicated hardware, just follow these steps:The installation requires very little interaction, only a locale and keyboard setting has to be answered for the basic linux installation. Dionaea creates a large amount of log data, so I suggest making the following changes to your config.The config file should be in the following location:Edit the config so that the logging level is set to ‘error’ only:The bistreams logs fill up very quickly so log rotation will need to be implemented.
The following username/password combinations are used by default and found in I decided that some of these could potentially be used to check for a honeypot environment, so I created a new file called userdb.txt and just used the following combination for ‘root’ access:I’ve found that attackers will often check the passwd or shadow file for evidence of vanilla cowrie builds, the reason being is the presence of the user ‘richard’.In order to get around this I loaded up a fresh Ubuntu install in VMware and created a few different users and then copied the output of the passwd file into the ‘passwd’ file provided by cowrie.I did the same with the shadow file, be sure to remove any legit account names that you are using if it is not a clean install you are copying.From here you can also change the motd, I used the following:Once I made the changes to the shadow and passwd file though I found that the attacker could still check the users listed in the home directory and that punk ‘richard’ is still trying to give the game away by having his name there and nobody else.To get around this there is a script called ‘createfs’ that can be used to create a fake filesystem for cowrie. The system will reboot and please maintain an active internet connection.
Without open source and the fruitful development community we are proud to be a part of, T-Pot would not have been possible! What the attacker had downloaded was stored in the following location:Being able to capture these TTP’s I think is a really cool and powerful way to start generating your own threat intel and come across samples you might not normally see.Output of attack I captured (This honeypot is no longer live and my new one has a different config/setup):The ‘jpeg’ file that was dropped was a Linux tar file, once extracted this contained some Linux ELF files and some scripts. The following guide I used was from kangaroosecurity.com which I found worked a treat.Next create a cron job which will run a small script to compress and delete the bistreams:Add the following line to call the script we just created:Next I started to play around with the Cowrie sensor, this was really fun and I will outline how to customise your honeypot so that it’s not immediately obvious to an attacker that they have accessed an SSH honeypot. Our thanks are extended but not limited to the following people and organizations:We will be releasing a new version of T-Pot about every 6-12 months.Coffee just does not cut it anymore which is why we needed a different caffeine source and consumed The sessions are stored in the following location and are replayed back in real time on the command line:These can then be played back using the playlog tool:Using this I found that somebody had logged into my honeypot, checked they were root and then downloaded some malware and scripts to my honeypot. On the console you may login with the All honeypot services are preconfigured and are starting automatically.Make sure your system is reachable through the internet.