[phe0nix404]

Hello folks, I'm quite new here and I came here with a motive to grasp and share knowledge with like minded people. Therefore here I'm making my first thread about how to setup SSH Honeypot. This tutorial is for educational purpose only and I'm totally not responsible what you do with this information.
Original source: SSH Honeypot: Kippo, Kali, and Raspberry-PI by Javier Nieto

First Kippo is a SSH Honeypot. Kippo is designed to log SSH brute force attacks and the entire shell interaction performed by an attacker when the attack is successful.

The main features of this software are:

• To record the usernames and password which the attacker is trying to perform a brute-force attack.
  
• To create a valid username/password like "root/root" to offer the attacker a fake filesystem (resembling a Debian 5.0) with the ability to add or remove files and save the command executed by the attacker.
  
• To save suspicious files downloaded (via wget) by the attacker.
  
• Possibility of adding a /etc/passwd file so the attacker can 'cat' it.
  

Things needed for this setup:

1. Raspberry-PI
   
2. Kali Linux
   
3. Kippo installation
   

Step 1 Installing Kali Linux in a Raspberry-PI

For this first you need to buy a Raspberry-PI which you can get it around 50$ which is quite cheap. Now, a HoneyNet should be available 24x7x365 because the longer it is available, the more events will be captured.
Currently, Kali Linux is available for Raspberry-PI. I think is a good idea to install our HoneyNet on it. We will have the opportunity to use all tools hosted in this distribution at the same time our Kippo is running.

You can download Kali Linux for Raspberry-PI here: Kali linux image(Choose as per you device)

To install the Kali Linux version connect the SD mem to your computer. In my case I have a 8gb SD mem and I can detect where it is mounted by using the command below.

sudo fdisk -l

When you already know where your SD mem is mounted, execute this command to copy Kali Linux to the mem and wait for a while (the time estimated to copy it will depend on how speedy your mem is).

sudo dd if=kali-linux-2.0-armel-rpi.img of=/dev/sdb bs=512k
(check your image name it might be different so make necessary changes.)

Step 2 Install Kippo

We won't only install Kippo, we will also install a MySQL database to save the events and Kippo-Graph to look at these events in a Web interface.

Please, follow the next steps to install Kippo.

sudo apt-get install subversion python-twisted python-mysqldb apache2

1. Install MySQL

root@kali:/# apt-get install mysql-server
root@kali:/# apt-get install mysql-client

2. Create the database and a user named Kippo with all privileges.

root@kali:/# mysql -h localhost -u root -p
mysql> create database kippo;
mysql> GRANT ALL ON kippo.* TO 'kippo'@localhost IDENTIFIED BY 'Kippo-password';
exit

3. Download Kippo and uncompress it at /usr/local/src/.
Kippo direct download link

4. Create the tables using the user just created.

root@kali:/# cd /usr/local/src/kippo-0.8/doc/sql/
mysql> mysql -u kippo -p
mysql> use kippo;
mysql> source mysql.sql;
mysql> show tables;
exit

5. Add to kippo.cfg the lines bellow.

[database_mysql]
host = localhost
database = kippo
username = kippo
password = Kippo-password

6. Create an unprivileged user to start Kippo and give him access to the folder.

root@kali: useradd -d /home/kippo -s /bin/bash -m kippo -g sudo
root@kali:/usr/local/src# chown -R kippo kippo-0.8/

7. Install the packages required for Kippo-Graph.

sudo apt-get update
sudo apt-get install libapache2-mod-php5 php5-cli php5-common php5-cgi php5-mysql php5-gd

8. Download Kippo-Graph

root@kali:/# wget http://bruteforce.gr/wp-content/uploads/...ph-0.8.tar
root@kali:/# mv kippo-graph-0.8.tar /var/www/
root@kali:/var/www# tar xvf kippo-graph-0.8.tar --no-same-permissions
chmod 777 generated-graphs
vim config.php #enter the appropriate values
sudo /etc/init.d/apache2 restart

9. Start Kippo

root@kali:/usr/local/src/kippo-0.8# su kippo
kippo@kali:/usr/local/src/kippo-0.8# ./start.sh

With Kippo just installed, you need to publish the service in the Internet. By default, Kippo listens in the port 2222. You can publish it by setting a PAT, I mean, redirecting in your router the port 22 from the external IP to the port 2222 of the Kippo's internal (private) IP.

Looking at the graphs

To see the graphics, just get access to http://Raspberry-Pi_IP_Address/kippo-graph/

You will see these graphics:

• Top 10 passwords
  
• Top 10 usernames
  
• Top 10 user-pass combos
  
• Success ratio
  
• Successes per day/week
  
• Connections per IP for previous month
  
• Successful logins from the same IP
  
• Probes per day/week
  
• Top 10 SSH clients
  
• Human activity inside the honeypot
  
• Top 10 input (overall)
  
• Top 10 successful input
  
• Top 10 failed input
  
• passwd commands
  
• wget commands
  
• Executed scripts
  
• Interesting commands
  
• apt-get commands
  
• Top 10 IP addresses probing the system for previous month
  
• Total IP addresses probing the system per top 10 countries
  

Here are some example images:

The best feature in my opinion.

In my opinion, the best Kippo feature is the capability of offering the attacker a fake filesystem and saving the commands which were executed by the intruder by just allowing him to get access to the system when the "successful" attack was produced.

Here you can get several malware samples and new scripts created by hackers. You will have a great opportunity to learn new hacker trends!!!

In the file "/usr/local/src/kippo-0.8/data/userdb.txt" you can set the username/password "allowed" to get access to the fake system. You could set the password "root:0:root" or whatever you want to allow the hacker get access to.

Thank you very much for reading this and I'll be happy if this could be of use to any of you.

[insidious]

This is pretty cool. If i still ran a dynamic site with a server that used PHP rather than a static HTML/CSS site, I would probably implement something like this to get back at those attackers

nice job though. Thanks for sharing.

[phe0nix404]

This is pretty cool. If i still ran a dynamic site with a server that used PHP rather than a static HTML/CSS site, I would probably implement something like this to get back at those attackers

nice job though. Thanks for sharing.

Totally my pleasure

[haccur]

Very nice guide but here is my "tips" of this guide:
Don't use Kippo is old and when the attacker try to login it to access to the shell is like 35/40 seconds for access to it so maybe the bruteforce script they using detect the shell as pinged out so you don't can collect anything of the attacker only failed logins use Cowrie instead here's the link
Use the ultimate version of kippo-graph i don't try it with cowrie but i think is working well since cowrie is a fork of kippo
Change the SSH banner to something "new" a box running debian 5.0 on 2016 is suspicious as hell so maybe the attacker skip that boxes since is kippo default banner
Kali Linux is not necessary at all just use raspbian lite of other distro you like

[phe0nix404]

Very nice guide but here is my "tips" of this guide:
Don't use Kippo is old and when the attacker try to login it to access to the shell is like 35/40 seconds for access to it so maybe the bruteforce script they using detect the shell as pinged out so you don't can collect anything of the attacker only failed logins use Cowrie instead here's the link
Use the ultimate version of kippo-graph i don't try it with cowrie but i think is working well since cowrie is a fork of kippo
Change the SSH banner to something "new" a box running debian 5.0 on 2016 is suspicious as hell so maybe the attacker skip that boxes since is kippo default banner
Kali Linux is not necessary at all just use raspbian lite of other distro you like

Thanks mate for the link and the tip. I'll definitely look into that and yeah kali is not necessary but people often use kali for pen testing so made the tutorial on that.

[The High Roller]

He reworded this whole tutorial http://www.behindthefirewalls.com/2014/0...ry-pi.html

Please give credit to the real author: Javier Nieto

[phe0nix404]

Sorry folks I missed out the source to mansion!! Was just wanted to be helpful..

[Astroz]

Thanks for all the help xD

[Pirate]

We need more HQ tutorials like this.
Thank's for your contribution sir.

[phe0nix404]

We need more HQ tutorials like this.
Thank's for your contribution sir.

My pleasure and please don't call me sir, I don't deserve to have that reputation yet..