[HC Official] HoneyPy - A port scanner honeypot - Printable Version

[HC Official] HoneyPy - A port scanner honeypot - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.ly/Forum-Hacking-Tools)
+--- Thread: [HC Official] HoneyPy - A port scanner honeypot (/Thread-HC-Official-HoneyPy-A-port-scanner-honeypot)

[HC Official] HoneyPy - A port scanner honeypot - h3r0 - 07-17-2014

HoneyPy is a tool (Written in the span of an hour) designed to place a passive port on your server that, when scanned for open ports/finger printed, will block the IP of a possible attacker. This requires IPTables, Python, and Linux.

I know it is hypocritical of me to not use github for this, but I don't want to link h3r0/hc to my real life work.

Let me know if you find any bugs/feature requests.

UPDATE: I have updated HoneyPy to work A LOT smoother. I found a bug where generic scans (nmap 192.168.1.*) would not trigger a connection due to SYN methods. Also using sudo nmap would completely bypass the honeypot, this has also been fixed in the newest version.

Code:
#!/usr/bin/env python
import socket, os, sys, getopt
from struct import *

print "\033[95m  /\\  /\\/ __\\"
print " / /_/ / /   Honeypy - A HoneyPot for port scans"
print "/ __  / /___ Made for http://HackCommunity.com by H3R0"
print "\\/ /_/\\____/ \033[0m"
print "Usage: ./honeypy -p 1337\n"
if not os.geteuid() == 0:
  sys.exit('\033[91mScript must be run as root\033[0m')
ops, args = getopt.getopt(sys.argv[1:],"p:h:l:")
h,p,noblock = '', 5000, False
for o, a in ops:
  if o == '-h':
    h = a
  if o == '-p':
    p = int(a)
  if o == '-l':
    noblock = True
ls, s = socket.socket(socket.AF_INET, socket.SOCK_STREAM), socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
ls.bind((h, p))
print '\033[92mStarted on listening on port \033[0m' + str(p)
ls.listen(5)
while 1:
  packet = s.recvfrom(500)
  packet = packet[0]
  iph = packet[0:20]
  iph = unpack('!BBHHHBBH4s4s' , iph)
  version = iph[0] >> 4
  ihl = iph[0] & 0xF
  iph_length = ihl * 4
  s_addr,d_addr = socket.inet_ntoa(iph[8]), socket.inet_ntoa(iph[9]);
  tcp_header = packet[iph_length:iph_length+20]
  tcph = unpack('!HHLLBBHHH' , tcp_header)
  dest_port,length = tcph[1], tcph[4] >> 4
  if (str(dest_port) == str(p)):
    print '\033[93mINDAVER DETECTED:\033[0m ', str(s_addr)
    if (noblock == False):
      print 'Blocking IP...'
      os.system("iptables -A INPUT -s " + str(s_addr)  + " -j DROP")

[Image: 2xHDX0o.jpg]

Notes:
Iptables will restart if your computer restarts
To flush ip table settings run

Code:
sudo iptables -F

To unblock an ip run

Code:
sudo iptables -D INPUT -s 127.0.0.1 -j DROP

RE: HC HoneyPy - A port scanner honeypot - Ligeti - 07-17-2014

I like it... it is a cute tool, of course this will work on LAN unless you configure your router and add your machine IP address to be a DMZ (in case you don't want to play with ports forwarding).

You seem to be active and that makes me happy! I never had the chance to welcome you properly... so welcome to HC Smile

Smile

Good job, keep it up!

Peace

RE: HC HoneyPy - A port scanner honeypot - h3r0 - 07-17-2014

(07-17-2014, 12:58 AM)Ligeti Wrote: You seem to be active and that makes me happy! I never had the chance to welcome you properly... so welcome to HC

Good job, keep it up!

Haha, thank you Ligeti. Just carving out a little spot for myself but at the same time trying not to spam ahah.

But yeah honeypy was just something I thought up while in the shower.. And I never worked with python sockets before... So why not. And in theory it could work on a server that was directly accessible from the internet, but if you're behind a router you might have some issues. I haven't tried testing that scenario.

RE: HC HoneyPy - A port scanner honeypot - lady_godiva - 07-17-2014

The idea is not bad, but this is very basic in my opinion and there would some workarounds. Just to make a distinction this is more something like a little firewall than a honeypot Wink

Wink

A honeypot would be much more complex, it's a system which is quite easy to get into, which is used to keep the attacker away from DMZ or internal network (depending on security policy and configuration). Also a honeypot would possibly be used to gather information on the attacker so it does the opposite: easily let the attacker in to keep him there!

RE: HC HoneyPy - A port scanner honeypot - Ex094 - 07-17-2014

For checking more than one port, can we use multi threading?

RE: HC HoneyPy - A port scanner honeypot - Isaac - 07-17-2014

This is quie an impressive concept, the only problem is that we won't know which port the attacker might be scanning, but in that case I guess we can select one port within a typical scanning range that a normal attacker would use. That way the attacker would sooner or later have to scan the honeypot port eventually.

This is a fine piece of work mate, Good Job

RE: HC HoneyPy - A port scanner honeypot - h3r0 - 07-17-2014

(07-17-2014, 02:20 PM)Ex094 Wrote: For checking more than one port, can we use multi threading?

Hmm that could be a very interesting feature. Currently though you could just technically run

Code:
~# ./honeypy -p 81 &
~# ./honeypy -p 82 &
etc

RE: HC HoneyPy - A port scanner honeypot - Cheshire - 07-17-2014

This is really cool, thanks for sharing. I love tools that are simple but still effective.

RE: HC HoneyPy - A port scanner honeypot - Mikasa - 07-18-2014

Simple, sweet and effective. Has its used and looks like it gets the job done. Nice share.

RE: HC HoneyPy - A port scanner honeypot - h3r0 - 07-19-2014

HoneyPy has been updated and a lot better. I found a few bugs in it and fixed them (See update message in original post). The script in addition to a TCP/IP Socket (To open the port). There is a raw socket to listen generically and catch passive scans!