Honeynet with Linksys Switch

A friend and I are about to set up a Honeynet to do a little original research on time-to-compromise various operating systems (compromise taking the forms of worms, viruses, script kidz, depending on the specific setup). We've done some research from the Honeynet project and their book, Know Your Enemy , but I do have a question you may be able to help with..

My setup currently involves a Linksys BEFSR41 switch. It uses NAT to run multiple PCs on a single DSL/Cable line - will this hinder my ability to place multiple honeypot computers on my local network?

I've got the option of setting a single IP address to the DMZ and expose it to the world, but then that would limit our work to a single computer/OS at time, and prevent us from gathering data relating to compromises across a single small network...

Has anyone any experience with something like this? If the switch is a no-go, is there another type of equipment I could use behind my broadband connection to expose multiple PCs at once?

Thanks,

l00p

What you need is to have the DMZ IP assigned to a second router, and then use that segment for the honeynet. Even better would be to configure it to act as a bridge, but that would require multiple IP's from your ISP.

Excellent point - I'll see if I can't scrounge up a router somewhere around here.. I believe you're the one that gave me the idea to do this in the first place - thanks again.

Now that I think of it, though, wouldn't the hub I add to the switch have to use NAT, also, to assign IP addresses - would I end up with the same problems?

Using NAT isn't a big deal...it's not an issue. They will still be able to "see" the network.

Hey hey,

Your best bet is to use the DMZ and do a single PC at a time. Using NAT there's no way you can have more than one computer fully available to the outside world. This is going to adversely affect the results of your research. If you want a true representation you need them to have access to the entire machine not just certain ports.

You could modify that slightly and have all machines available but you will still end up with skewed results. If you were to use port forwarding you could have all open ports in the wild, however they would not line up with the standards.. For Example

DST Port 21 --> PC 1 Port 21
DST Port 22 --> PC 1 Port 22
DST Port 23 --> PC 1 Port 23
DST Port 25 --> PC 1 Port 25
DST Port 121 --> PC 2 Port 21
DST Port 122 --> PC 2 Port 22
DST Port 123 --> PC 2 Port 23
DST Port 125 --> PC 2 Port 25
DST Port 221 --> PC 3 Port 21
DST Port 222 --> PC 3 Port 22
DST Port 223 --> PC 3 Port 23
DST Port 225 --> PC 3 Port 25
and so on..

The only problem with this is that most canned tools and scanners that skiddies use are set to the specific standard ports, so the only machine that would return accurate results is PC 1. However it would allow you to have all machines theoretically in the wild.

You said DSL/Cable line, which is it? I know around here you only get one IP with cable, but most of the DSL providers will give you up to 8 IPs, they just don't advertise it. If you have DSL, it's entirely possible that you have access to more than just your main IP. You could then connect your honeypot machines seperately and each one would return accurate results. This will also keep the traffic from interfering with your machines that aren't taking part in the honeynet.

I have to disagree with 576869746568617 on this one. The use of NAT is a huge deal for something like this, as it will skew the results. They will "see" that the network is there, but they won't have full access to the machines behind the NAT device. If you were the only ones testing the network then NAT would not play a role, however since I'm guessing you want valid IPs because you are taking these live on the net, you will need to find another solution other than NAT (multiple IP addresses, or one PC at a time).

One last thing to remember is to check with your ISP and see the terms of your AUP. Most ISPs frown on setting up honeypots and honeynets, it can bring a lot of unwanted and malicious traffic into servers and network. You don't want to risk losing your internet access in the name of research.

Peace,
HT

I agree, you should talk to your ISP. Also, If they have no policy on this type of thing, you may look at leasing a few additional IP addresses from them. If not, one at a time would be ok, but not exactly what we are looking for.

The results will not necessarily be skewed if you use NAT. Individual IPs are better, of course, but NAT will still work. The results depend on the logging capabilities of the router you use and the capabilities of the sniffer you use to monitor the subnet.

Remember, we are using two routers....one connected to the internet and one segmenting the honeynet, like this:

Router one: Internet internace puting DMZ traffic to port 4, IP address x.x.x.x (second router IP, all ports and protocols)

Second Router IP configured for NAT only, no firewalling capabilities enabled, allows all traffic inbound and out.

If you sniff the packets in real-time, then correlate this data with the entries in the router's traffic logs, then you can still get all the pertinant info, and still backtrace the attacker.


(Type) Packet from x.x.x.x:xxxx (attacker IP : port) to x.x.x.x:xxxx (router IP : NAT host port) size= x bytes (traffic log)

Type) Packet from x.x.x.x:xxxx (attacker IP: port) to x.x.x.x:xxxx (NAT private IP : port) size= x bytes
(sniffer log)

Size , packet type, source and destination ports, and header match in both logs. It's oversimplified, but i think you get the idea.

Hey Hey,

As far as just capturing incoming packets, I agree completely, won't make that much of a difference. However, they want to do more than that. They want the box to be available to be hacked, the very idea of a honeypot/honeynet. One of the most appealing features of NAT is that a machine on the private side of the network is basically inaccessible to a machine on the public network, unless you've set up specific port forward rules or a DMZ. I demonstrated in my last post that port forwarding will skew the results because common script kiddie tools use specific ports. You'll see mass scans for port 139, or port 23, however if I have 3 PCs with those ports open, I can only forward the traffic inbound on those ports to one machine. I would have to do different external ports for forwarding to the other machines, this will skew the results because you won't get as many canned attacks. As for the DMZ, again you set-up the DMZ and you only have one host to work with. The results will be skewed for the other hosts.

I'm sitting here at the helpdesk right now. If I open up port 80 on this machine and put a vulnerable piece of code on it, that's not going to do any good to anyone outside the college. I have a private IP address and they could never make an HTTP request to my machine. I'd have to have the port forwarded (and unless it's port 80, the results are skewed).

I'm sorry for being repetetive... I'm just trying to get my point across,

Peace,
HT

[Edit]
Sure add stuff while I'm typing my reply :D

Anyways... even if you are using 2 routers, it's not going to affect the results. Setup two routers, the second one being the DMZ off the first one and then try and telnet to a machine behind the second one. You're going to tell me that three machines running a telnet server behind that second router will all respond back and I'll get 3 open telnet sessions, one to each machine? I'd love to see you prove that one.

[/Edit]

I'm going to have to do a trial run wuth a single machine at a time on the DMZ of the router. This will first allow me to test the packet capture and logging abilities, as well as get a feel for what kind of compromise I may be able to expect off the bat.

While true that a Honeynet in its purest definition would be a number of hosts on a compromisible network, that may not actually be the best setup for me since this is my first attempt. Proper configuration for my data capture and protection of any other machines (I'd be sore if I got locked out of my router) should be my first priority this time around..

The idea of multiple hosts behind a single IP is interesting, though. I'm assuming if an intruder did find the private network, they'd map out the subnet and go from there, yes?

(I'm trying to contain my excitment on this project.. I find these nefarious activities so interesting)

l00p

AND >> thanks for the point on the ISP. I'll have to page through my policy to see what they say.. considering the amount of noise broadcasting around the network these days, I doubt they'd notice much in my neck of the woods. I'm going to have to dig me up some software to limit outgoing connections per day and/or bandwidth coming from my honeypot PC. I don't want to be party to a DDoS or spamming to someone else...

Quote:

---

I doubt they'd notice much in my neck of the woods. I'm going to have to dig me up some software to limit outgoing connections per day and/or bandwidth coming from my honeypot PC. I don't want to be party to a DDoS or spamming to someone else...

---

I purchased the books Honeypots and Know your enemy. They include perl scripts to do this on the CDs that accompany the books. If you don't have the CDs, let me know. I'd be glad to compress them for you. Or, I'm sure you can find them online already...

Also, a couple of members here have written things such as fake smtp servers that would also be good. (I think in addicts forum?) I'd have to dig a bit... but there is quite a few scripts/toolz out there to control almost everything you could want to do.

Now that I think about it... they came with the honeypots cd. I have it at work. I can get them for you if you want. just PM me.

phishphreek - thanks for the offer - I've got the CD, too, so I don't need to bother you for the files. I'll check through the other threads, too, for some faux services I may be interested in running.

l00p

Hey Hey,

I'll make one last addition to this thread, I've written some code for some simple things for tutorials, including an SMTP honeypot. I never released the full code (except maybe in addicts), but if it'll help ya out here ya go. It's written in Python and emulates a IIS SMTP Server. It's not very complex and just gives very basic responses, so they'll realize it own't send their mail, however it logs and timestamps the connections and the IP address they come from. With simple python knowledge you could make it write to a file, and adding two or three lines of code would also make it recieve the commands the user types in.

Code:

---

# Demonstrates various methods of importing modules.
from socket import *
import string
import time
import shlex
# create a socket of the basic type.
s = socket(AF_INET, SOCK_STREAM)
# Query the user for their IP Address and set that and the port
HOST = raw_input("Enter IP Address to bind socket to: ")
PORT = 250
s.bind((HOST, PORT)) # Bind the socket to an IP Address and Port
while 1:
    s.listen(5) # Have the socket listen for a connection
    (incomingsocket, address) = s.accept() # Accept an incoming connection
    straddress = str(address) # Convert incoming address to a string
    testlist = string.split(straddress, ",") # Split the tuple into lists
    gethost = string.split(testlist[0], "'") # Split the host portion of the list
    getaddr = string.split(testlist[1], ")") # Split the port portion of the list
    host = gethost[1] # Remove just the address from the list
    incomingport = int(getaddr[0]) # Remove just the port from the list
    # define our responses
    banner = "220 desktop Microsoft ESMTP MAIL Service, Version 6.0.2600.1106 ready at " + time.strftime("%a, %d %b %Y %H:%M:%S %Z") + "\r\n"
    error = "500 5.3.3 Unrecognized command"+ "\r\n"
    help = "214-This server supports the following commands: \r\n 214 HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH BDAT VRFY"+ "\r\n"
    helo =  "250 desktop Hello ["+ str(host)+"]"+ "\r\n"
    invalidaddress = "501 5.5.4 Invalid Address"+ "\r\n"
    ehlo = "250 desktop Hello ["+ str(host)+"] \r\n 250-SIZE 2097152 \r\n 250-PIPELINING\r\n 250-DSN \r\n 250-ENHANCEDSTATUSCODES \r\n 250-8bitmime \r\n 250-BINARYMIME \r\n 250-CHUNKING \r\n 250-VRFY \r\n 250 OK \r\n"
    starttls = "554 5.7.3 Unable to initialize security subsystem"+ "\r\n"
    rcpt = "503 5.5.2 Need Mail From: first"+ "\r\n"
    mail = "501 5.5.4 Argument missing"+ "\r\n"
    datamsg = "503 5.5.2 Need mail command."+ "\r\n"
    rset = "250 2.0.0 Resetting"+ "\r\n"
    auth = "501 5.5.4 No mechanism"+ "\r\n"
    vrfy = "252 2.1.5 Cannot VRFY user"+ "\r\n"
    data = ""
    lastchar = ""
    incomingsocket.send(banner) # Send our banner
    # Print connection information to stdout
    logdata = "Connection attempt on port " + str(PORT) + " from " + str(host) + ":" + str(incomingport) + " @ " + time.strftime("%H:%M:%S - %d %b %Y")
    print logdata
    # define our Warning
    warning = "Illegal Access of this server, your IP [" + host +"] has been logged.\r\n"
    # Listen for incoming data
    while 1 :
        while 1:
            lastchar = incomingsocket.recv(1024)
            if lastchar == "\n": break
            elif lastchar == "\r\n": break
            else: data = data + lastchar
        if data == "helo" : incomingsocket.send(helo)
        elif data == "ehlo" : incomingsocket.send(ehlo)
        elif data == "help" : incomingsocket.send(help)
        elif data == "starttls" : incomingsocket.send(starttls)
        elif data == "rcpt" : incomingsocket.send(rcpt)
        elif data == "mail" : incomingsocket.send(invalidaddress)
        elif data == "data" : incomingsocket.send(datamsg)
        elif data == "rset" : incomingsocket.send(rset)
        elif data == "auth" : incomingsocket.send(auth)
        elif data == "vrfy" : incomingsocket.send(vrfy)
        elif data == "quit" : break
        else : incomingsocket.send(error)
        data = ""
    #Send the Warning
    incomingsocket.send(warning)
    # Close the socket
    incomingsocket.close
s.close

---

This second piece of code was also posted (I think in addicts) and is for an echo server.

Code:

---

# Demonstrates various methods of importing modules.
from socket import *
import string
import time
import shlex
# create a socket of the basic type.
s = socket(AF_INET, SOCK_STREAM)
# Query the user for their IP Address and set that and the port
HOST = raw_input("Enter IP Address to bind socket to: ")
PORT = 700
s.bind((HOST, PORT)) # Bind the socket to an IP Address and Port
while 1:
    s.listen(5) # Have the socket listen for a connection
    (incomingsocket, address) = s.accept() # Accept an incoming connection
    straddress = str(address) # Convert incoming address to a string
    testlist = string.split(straddress, ",") # Split the tuple into lists
    gethost = string.split(testlist[0], "'") # Split the host portion of the list
    getaddr = string.split(testlist[1], ")") # Split the port portion of the list
    host = gethost[1] # Remove just the address from the list
    incomingport = int(getaddr[0]) # Remove just the port from the list
    data = ""
    # Print connection information to stdout
    logdata = "Connection attempt on port " + str(PORT) + " from " + str(host) + ":" + str(incomingport) + " @ " + time.strftime("%H:%M:%S - %d %b %Y")
    print logdata
    #Send a Banner 
    incomingsocket.send("Welcome to HT's Simple Echo Server - RFC 862\r\n")
    # Listen for incoming data
    while 1 :
        while 1:
            lastchar = incomingsocket.recv(1024)
            if lastchar == "\n": break
            elif lastchar == "\r\n": break
            else: data = data + lastchar
        incomingsocket.send(data)
        incomingsocket.send("\r\n")
        if data == "quit\r\n" : break
        if data == "quit\n" : break
        data = ""
    # Close the socket
    incomingsocket.close
s.close

---

These may or may not be useful to you, but they should provide you with a starting ground that will at least open a few ports and return a few banners to the attacker, as well as simulating the basics of the respective daemons they are trying to emulate.

Peace,
HT