[tropic]

Kippo is a popular python based SSH honeypot. Typically, authbind is used to allow Kippo to run on port 22, or iptables can be setup to redirect traffic going to port 22 to the port used by Kippo (default: 2222).

However, its very easy to tell if you're inside Kippo.

Kippo logs all login attempts and commands entered by the attacker. By default, Kippo uses the passwords "root" and "123456". When an attacker logs into SSH using one of those passes, they will see something like this:

Code:

login as: root Using keyboard-interactive authentication. Password: nas3:~# nas3:~# uname -a Linux nas3 2.6.26-2-686 #1 SMP Wed Nov 4 20:45:37 UTC 2009 i686 GNU/Linux nas3:~#

Doesn't seem out of the ordinary - but wait!

Code:

nas3:~# echo $PATH $PATH nas3:~#

It seems that the $PATH variable hasn't been set, but since we logged in without disabling the TTY/pseudo terminal, this shouldn't be the case. Upon further inspection, it seems that no environmental variables are set at all.

Code:

nas3:~# env bash: env: command not found nas3:~#

A cursory look at the filesystem reveals further irregularities (and developer laziness).

Code:

nas3:~# ls -al drwxr-xr-x 1 root root 4096 2014-02-22 21:23 . drwxr-xr-x 1 root root 4096 2014-02-22 21:23 .. -rw-r--r-- 1 root root 140 2013-04-05 11:52 .profile drwx------ 1 root root 4096 2013-04-05 12:05 .ssh drwx------ 1 root root 4096 2013-04-05 11:58 .aptitude -rw-r--r-- 1 root root 570 2013-04-05 11:52 .bashrc nas3:~# cat .profile cat: /root/.profile: No such file or directory nas3:~# cd .ssh nas3:~/.ssh# ls known_hosts nas3:~/.ssh# cat known_hosts cat: /root/.ssh/known_hosts: No such file or directory nas3:~/.ssh# cd .. nas3:~# cat .aptitude cat: /root/.aptitude: Is a directory nas3:~# clear nas3:~# ls -al drwxr-xr-x 1 root root 4096 2014-02-22 21:24 . drwxr-xr-x 1 root root 4096 2014-02-22 21:24 .. -rw-r--r-- 1 root root 140 2013-04-05 11:52 .profile drwx------ 1 root root 4096 2013-04-05 12:05 .ssh drwx------ 1 root root 4096 2013-04-05 11:58 .aptitude -rw-r--r-- 1 root root 570 2013-04-05 11:52 .bashrc nas3:~# cat .profile cat: /root/.profile: No such file or directory nas3:~# cd .ssh nas3:~/.ssh# ls known_hosts nas3:~/.ssh# cat known_hosts cat: /root/.ssh/known_hosts: No such file or directory nas3:~/.ssh# cd .. nas3:~# cd .aptitude nas3:~/.aptitude# ls config nas3:~/.aptitude# cat config cat: /root/.aptitude/config: No such file or directory nas3:~/.aptitude# cd .. nas3:~# cat .bashrc cat: /root/.bashrc: No such file or directory nas3:~#

Pipes don't work either.

Code:

nas3:~# echo "test" > test test > test nas3:~# cat test cat: test: No such file or directory nas3:~#

If we look at the system binaries, we will notice that some of them aren't even faked by Kippo.

Code:

nas3:~# cd /bin nas3:/bin# ls stty true setupcon sleep tailf openvt rm zdiff egrep sync dnsdomainname cpio echo more pwd ypdomainname znew kmod zfgrep mt uname mount zless rnano tempfile grep busybox ps zcmp df lsmod ping6 nisdomainname which pidof chvt dd ip rmdir ls date hostname readlink false zgrep kbd_mode fgrep chmod setfont open sed netstat unicode_start nano dir ss domainname dmesg sh mv zforce lsblk cp findmnt zmore zegrep chown zcat run-parts mktemp nc loadkeys nc.traditional cat mknod uncompress ping sh.distrib mt-gnu gzexe kill gzip chgrp netcat ln vdir umount bash mountpoint dash su rbash gunzip mkdir tar login fgconsole touch dumpkeys nas3:/bin# ln bash: ln: command not found nas3:/bin# netstat bash: netstat: command not found nas3:/bin# apt-get E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied) E: Unable to lock the list directory nas3:/bin# nas3:/bin# cd ~ bash: cd: ~: No such file or directory nas3:/bin#

Of course, commands such as wget will actually work since people who run these honeypots want to collect shitty skid tools, which they save so they can blog about it and feel superior.

Another thing about Kippo is that it spoofs the SSH banner (usually Ubuntu or Debian) and uses a 1024 bit host key which is no longer considered secure (2048 bits has become standard).

Code:

PORT STATE SERVICE VERSION 2222/tcp open ssh OpenSSH 5.1p1 Debian 5 (protocol 2.0) Service Info: OS: Linux; CPE: cpe:/o:linux:kernel

I could go on and on about other ways to tell if your inside a Kippo, there's probably many ways I haven't even thought of, but the bottom line is that if you're not a complete retarded fucking skid, it should be obvious.

[Reiko]

Here's another oneliner for Kippo detection. It's missing redirection in the shell as well as some core utilities.

Code:

nice honeypot >x

[Adorapuff]

Not only do the admins who deploy honeypots like to do this:

Of course, commands such as wget will actually work since people who run these honeypots want to collect shitty skid tools, which they save so they can blog about it and feel superior.

They also like to post playbacks on youtube for some odd reason.
Ex: http://www.youtube.com/watch?v=smvwW3vW5rM

[Adorapuff]

Also, I found that it lets you ssh into any box using any password. I did ssh root@Google.com and gay as password inside the honeypot. It gives you the illusion that you are inside Google, but really it's an easy way to fingerprint the box.

[Eclipse]

I guess this is gravedigging, but I just wanted to say that this tutorial is amazing. Helped me out a lot. Thank you!

---

Also, I found that it lets you ssh into any box using any password. I did ssh root@Google.com and gay as password inside the honeypot. It gives you the illusion that you are inside Google, but really it's an easy way to fingerprint the box.

Wow...

[Alexaider]

Yeah I agree, nice tutorial

[Equinox]

Yeah I agree, nice tutorial

MFW you gravedug like 69 threads...

Can you, like, not?

[ProfessorChill]

MFW you gravedug like 69 threads...

Can you, like, not?

Dig dug is a good game though ;-;