tyler.durden
/
kippo
mirror of https://github.com/desaster/kippo.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Kippo - SSH Honeypot
287 Commits 2 Branches 1 Tag 5.7 MiB
Python 98.4%
Dockerfile 1.1%
Shell 0.5%
Go to file
Upi Tamminen b9eb06a283
Merge pull request #242 from desaster/dockerfile 
add Dockerfile & docker-compose.yml
 		2023-08-26 20:39:53 +03:00
data Initial support for non-root users. Check your root passwords! 2011-02-05 21:53:54 +00:00
db/mysql add Dockerfile & docker-compose.yml 2023-08-02 16:27:42 +03:00
dl Added 'empty' folders … 2014-05-28 05:00:21 +01:00
doc Add support for logging downloaded files via dblog 2013-01-08 17:31:29 +00:00
honeyfs Add /proc/version 2014-07-29 10:44:36 +01:00
kippo work around #194 - couldn't match all kex parts 2015-10-21 22:34:31 +03:00
log/tty Added 'empty' folders … 2014-05-28 05:00:21 +01:00
txtcmds Add simple free command 2014-07-30 17:25:46 +01:00
utils fix incorrect syntax, fixes #126 2014-06-14 13:11:03 +03:00
.dockerignore add Dockerfile & docker-compose.yml 2023-08-02 16:27:42 +03:00
.gitignore add Dockerfile & docker-compose.yml 2023-08-02 16:27:42 +03:00
Dockerfile add Dockerfile & docker-compose.yml 2023-08-02 16:27:42 +03:00
README.md Update README.md 2016-09-30 11:17:25 -04:00
docker-compose.yml add Dockerfile & docker-compose.yml 2023-08-02 16:27:42 +03:00
fs.pickle Add php 2014-07-30 17:25:46 +01:00
kippo.cfg.dist add Dockerfile & docker-compose.yml 2023-08-02 16:27:42 +03:00
kippo.tac restructuring and cleanup 2014-08-09 23:55:20 +03:00
start.sh add virtualenv support to start.sh 2014-08-11 20:39:26 +03:00
stop.sh make stop.sh less fancy 2014-06-10 19:28:57 +03:00

README.md

NOTE: For more recent development, check out Michel Oosterhof's fork

Kippo

Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker.

Kippo is inspired, but not based on Kojoney.

Demo

Some interesting logs from a live Kippo installation below (viewable within a web browser with the help of Ajaxterm). Note that some commands may have been improved since these logs were recorded.

Features

Some interesting features:

  • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
  • Possibility of adding fake file contents so the attacker can 'cat' files such as /etc/passwd. Only minimal file contents are included
  • Session logs stored in an UML Compatible format for easy replay with original timings
  • Just like Kojoney, Kippo saves files downloaded with wget for later inspection
  • Trickery; ssh pretends to connect somewhere, exit doesn't really exit, etc

Requirements

Software required:

  • An operating system (tested on Debian, CentOS, FreeBSD and Windows 7)
  • Python 2.5+
  • Twisted 8.0 to 15.1.0
  • PyCrypto
  • Zope Interface

See Wiki for some installation instructions.

How to run it?

Edit kippo.cfg to your liking and start the honeypot by running:

./start.sh

start.sh is a simple shell script that runs Kippo in the background using twistd. Detailed startup options can be given by running twistd manually. For example, to run Kippo in foreground:

twistd -y kippo.tac -n

By default Kippo listens for ssh connections on port 2222. You can change this, but do not change it to 22 as it requires root privileges. Use port forwarding instead. (More info: MakingKippoReachable).

Files of interest:

  • dl/ - files downloaded with wget are stored here
  • log/kippo.log - log/debug output
  • log/tty/ - session logs
  • utils/playlog.py - utility to replay session logs
  • utils/createfs.py - used to create fs.pickle
  • fs.pickle - fake filesystem
  • honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here

Is it secure?

Maybe. See FAQ

I have some questions!

I am might be reachable via e-mail: desaster at gmail dot com, or as desaster on the #honeypots channel in the freenode IRC network.