+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: Tutorial Detecting Kippo honeypots (/Thread-Tutorial-Detecting-Kippo-honeypots)
Detecting Kippo honeypots - tropic - 02-22-2014
Kippo is a popular python based SSH honeypot. Typically, authbind is used to allow Kippo to run on port 22, or iptables can be setup to redirect traffic going to port 22 to the port used by Kippo (default: 2222).
However, its very easy to tell if you're inside Kippo.
Kippo logs all login attempts and commands entered by the attacker. By default, Kippo uses the passwords "root" and "123456". When an attacker logs into SSH using one of those passes, they will see something like this:
Code:
login as: root
Using keyboard-interactive authentication.
Password:
nas3:~#
nas3:~# uname -a
Linux nas3 2.6.26-2-686 #1 SMP Wed Nov 4 20:45:37 UTC 2009 i686 GNU/Linux
nas3:~#Doesn't seem out of the ordinary - but wait!
Code:
nas3:~# echo $PATH
$PATH
nas3:~#It seems that the $PATH variable hasn't been set, but since we logged in without disabling the TTY/pseudo terminal, this shouldn't be the case. Upon further inspection, it seems that no environmental variables are set at all.
Code:
nas3:~# env
bash: env: command not found
nas3:~#A cursory look at the filesystem reveals further irregularities (and developer laziness).
Code:
nas3:~# ls -al
drwxr-xr-x 1 root root 4096 2014-02-22 21:23 .
drwxr-xr-x 1 root root 4096 2014-02-22 21:23 ..
-rw-r--r-- 1 root root 140 2013-04-05 11:52 .profile
drwx------ 1 root root 4096 2013-04-05 12:05 .ssh
drwx------ 1 root root 4096 2013-04-05 11:58 .aptitude
-rw-r--r-- 1 root root 570 2013-04-05 11:52 .bashrc
nas3:~# cat .profile
cat: /root/.profile: No such file or directory
nas3:~# cd .ssh
nas3:~/.ssh# ls
known_hosts
nas3:~/.ssh# cat known_hosts
cat: /root/.ssh/known_hosts: No such file or directory
nas3:~/.ssh# cd ..
nas3:~# cat .aptitude
cat: /root/.aptitude: Is a directory
nas3:~# clear
nas3:~# ls -al
drwxr-xr-x 1 root root 4096 2014-02-22 21:24 .
drwxr-xr-x 1 root root 4096 2014-02-22 21:24 ..
-rw-r--r-- 1 root root 140 2013-04-05 11:52 .profile
drwx------ 1 root root 4096 2013-04-05 12:05 .ssh
drwx------ 1 root root 4096 2013-04-05 11:58 .aptitude
-rw-r--r-- 1 root root 570 2013-04-05 11:52 .bashrc
nas3:~# cat .profile
cat: /root/.profile: No such file or directory
nas3:~# cd .ssh
nas3:~/.ssh# ls
known_hosts
nas3:~/.ssh# cat known_hosts
cat: /root/.ssh/known_hosts: No such file or directory
nas3:~/.ssh# cd ..
nas3:~# cd .aptitude
nas3:~/.aptitude# ls
config
nas3:~/.aptitude# cat config
cat: /root/.aptitude/config: No such file or directory
nas3:~/.aptitude# cd ..
nas3:~# cat .bashrc
cat: /root/.bashrc: No such file or directory
nas3:~#Pipes don't work either.
Code:
nas3:~# echo "test" > test
test > test
nas3:~# cat test
cat: test: No such file or directory
nas3:~#If we look at the system binaries, we will notice that some of them aren't even faked by Kippo.
Code:
nas3:~# cd /bin
nas3:/bin# ls
stty true setupcon sleep tailf
openvt rm zdiff egrep sync
dnsdomainname cpio echo more pwd
ypdomainname znew kmod zfgrep mt
uname mount zless rnano tempfile
grep busybox ps zcmp df
lsmod ping6 nisdomainname which pidof
chvt dd ip rmdir ls
date hostname readlink false zgrep
kbd_mode fgrep chmod setfont open
sed netstat unicode_start nano dir
ss domainname dmesg sh mv
zforce lsblk cp findmnt zmore
zegrep chown zcat run-parts mktemp
nc loadkeys nc.traditional cat mknod
uncompress ping sh.distrib mt-gnu gzexe
kill gzip chgrp netcat ln
vdir umount bash mountpoint dash
su rbash gunzip mkdir tar
login fgconsole touch dumpkeys
nas3:/bin# ln
bash: ln: command not found
nas3:/bin# netstat
bash: netstat: command not found
nas3:/bin# apt-get
E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
E: Unable to lock the list directory
nas3:/bin#
nas3:/bin# cd ~
bash: cd: ~: No such file or directory
nas3:/bin#Of course, commands such as wget will actually work since people who run these honeypots want to collect shitty skid tools, which they save so they can blog about it and feel superior.
Another thing about Kippo is that it spoofs the SSH banner (usually Ubuntu or Debian) and uses a 1024 bit host key which is no longer considered secure (2048 bits has become standard).
Code:
PORT STATE SERVICE VERSION
2222/tcp open ssh OpenSSH 5.1p1 Debian 5 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:kernelI could go on and on about other ways to tell if your inside a Kippo, there's probably many ways I haven't even thought of, but the bottom line is that if you're not a complete retarded fucking skid, it should be obvious.
RE: [Tutorial] Detecting Kippo honeypots - Reiko - 02-22-2014
Here's another oneliner for Kippo detection. It's missing redirection in the shell as well as some core utilities.
Code:
nice honeypot >xRE: Detecting Kippo honeypots - Adorapuff - 02-22-2014
Not only do the admins who deploy honeypots like to do this:
Quote: Of course, commands such as wget will actually work since people who run these honeypots want to collect shitty skid tools, which they save so they can blog about it and feel superior.They also like to post playbacks on youtube for some odd reason.
Ex: http://www.youtube.com/watch?v=smvwW3vW5rM
Detecting Kippo honeypots - Adorapuff - 02-23-2014
Also, I found that it lets you ssh into any box using any password. I did ssh root@Google.com and gay as password inside the honeypot. It gives you the illusion that you are inside Google, but really it's an easy way to fingerprint the box.
RE: Detecting Kippo honeypots - Eclipse - 05-31-2014
I guess this is gravedigging, but I just wanted to say that this tutorial is amazing. Helped me out a lot. Thank you!
(02-23-2014, 11:46 PM)Adorapuff Wrote: Also, I found that it lets you ssh into any box using any password. I did ssh root@Google.com and gay as password inside the honeypot. It gives you the illusion that you are inside Google, but really it's an easy way to fingerprint the box.
Wow...
RE: Detecting Kippo honeypots - Alexaider - 06-14-2014
Yeah I agree, nice tutorial
RE: Detecting Kippo honeypots - Equinox - 06-14-2014
(06-14-2014, 01:28 PM)Alexaider Wrote: Yeah I agree, nice tutorial
MFW you gravedug like 69 threads...
Can you, like, not?
RE: Detecting Kippo honeypots - ProfessorChill - 06-19-2014
(06-14-2014, 01:40 PM)Duubz Wrote: MFW you gravedug like 69 threads...
Can you, like, not?
Dig dug is a good game though ;-;