[h3r0]

HoneyPy is a tool (Written in the span of an hour) designed to place a passive port on your server that, when scanned for open ports/finger printed, will block the IP of a possible attacker. This requires IPTables, Python, and Linux.


I know it is hypocritical of me to not use github for this, but I don't want to link h3r0/hc to my real life work.

Let me know if you find any bugs/feature requests.

UPDATE: I have updated HoneyPy to work A LOT smoother. I found a bug where generic scans (nmap 192.168.1.*) would not trigger a connection due to SYN methods. Also using sudo nmap would completely bypass the honeypot, this has also been fixed in the newest version.

Code:

#!/usr/bin/env python import socket, os, sys, getopt from struct import * print "\033[95m /\\ /\\/ __\\" print " / /_/ / / Honeypy - A HoneyPot for port scans" print "/ __ / /___ Made for http://HackCommunity.com by H3R0" print "\\/ /_/\\____/ \033[0m" print "Usage: ./honeypy -p 1337\n" if not os.geteuid() == 0: sys.exit('\033[91mScript must be run as root\033[0m') ops, args = getopt.getopt(sys.argv[1:],"p:h:l:") h,p,noblock = '', 5000, False for o, a in ops: if o == '-h': h = a if o == '-p': p = int(a) if o == '-l': noblock = True ls, s = socket.socket(socket.AF_INET, socket.SOCK_STREAM), socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP) ls.bind((h, p)) print '\033[92mStarted on listening on port \033[0m' + str(p) ls.listen(5) while 1: packet = s.recvfrom(500) packet = packet[0] iph = packet[0:20] iph = unpack('!BBHHHBBH4s4s' , iph) version = iph[0] >> 4 ihl = iph[0] & 0xF iph_length = ihl * 4 s_addr,d_addr = socket.inet_ntoa(iph[8]), socket.inet_ntoa(iph[9]); tcp_header = packet[iph_length:iph_length+20] tcph = unpack('!HHLLBBHHH' , tcp_header) dest_port,length = tcph[1], tcph[4] >> 4 if (str(dest_port) == str(p)): print '\033[93mINDAVER DETECTED:\033[0m ', str(s_addr) if (noblock == False): print 'Blocking IP...' os.system("iptables -A INPUT -s " + str(s_addr) + " -j DROP")

Notes:
Iptables will restart if your computer restarts
To flush ip table settings run

Code:

sudo iptables -F

To unblock an ip run

Code:

sudo iptables -D INPUT -s 127.0.0.1 -j DROP

[Ligeti]

I like it... it is a cute tool, of course this will work on LAN unless you configure your router and add your machine IP address to be a DMZ (in case you don't want to play with ports forwarding).

You seem to be active and that makes me happy! I never had the chance to welcome you properly... so welcome to HC

Good job, keep it up!

Peace

[h3r0]

You seem to be active and that makes me happy! I never had the chance to welcome you properly... so welcome to HC

Good job, keep it up!

Haha, thank you Ligeti. Just carving out a little spot for myself but at the same time trying not to spam ahah.

But yeah honeypy was just something I thought up while in the shower.. And I never worked with python sockets before... So why not. And in theory it could work on a server that was directly accessible from the internet, but if you're behind a router you might have some issues. I haven't tried testing that scenario.

[lady_godiva]

The idea is not bad, but this is very basic in my opinion and there would some workarounds. Just to make a distinction this is more something like a little firewall than a honeypot A honeypot would be much more complex, it's a system which is quite easy to get into, which is used to keep the attacker away from DMZ or internal network (depending on security policy and configuration). Also a honeypot would possibly be used to gather information on the attacker so it does the opposite: easily let the attacker in to keep him there!

[Ex094]

For checking more than one port, can we use multi threading?

[Isaac]

This is quie an impressive concept, the only problem is that we won't know which port the attacker might be scanning, but in that case I guess we can select one port within a typical scanning range that a normal attacker would use. That way the attacker would sooner or later have to scan the honeypot port eventually.

This is a fine piece of work mate, Good Job

[h3r0]

For checking more than one port, can we use multi threading?

Hmm that could be a very interesting feature. Currently though you could just technically run

Code:

~# ./honeypy -p 81 & ~# ./honeypy -p 82 & etc

[Cheshire]

This is really cool, thanks for sharing. I love tools that are simple but still effective.

[Mikasa]

Simple, sweet and effective. Has its used and looks like it gets the job done. Nice share.

[h3r0]

HoneyPy has been updated and a lot better. I found a few bugs in it and fixed them (See update message in original post). The script in addition to a TCP/IP Socket (To open the port). There is a raw socket to listen generically and catch passive scans!