Hack 94 Simulate a Network of Vulnerable HostsUse honeyd to fool would-be attackers into chasing ghosts. As the saying goes, you will attract more flies with honey than with vinegar. (I''ve never understood that saying; who wants to attract flies, anyway?) A honeypot is used to attract the "flies" of the Internet: script kiddies and hacker wannabes that have nothing better to do with their time than scan for vulnerable hosts and try to attack them. A honeypot does this by pretending to be a server running vulnerable services, but is in fact collecting information about the attackers who think themselves so clever. Whether you want to simulate one or one thousand vulnerable network hosts, honeyd (http://www.honeyd.org) makes the job as simple as editing a configuration file and running a daemon. The honeyd daemon can simulate thousands of hosts simultaneously and will let you configure what operating system each host will appear as when scanned with operating system detection tools like Nmap [Hack #42] . Each system that honeyd simulates will appear to be a fully functioning node on the network. Besides simply creating hosts that respond to pings and traceroutes, honeyd also lets you configure what services each host appears to be running. You can either use simple scripts to emulate a given service or have honeyd act as a proxy and forward requests to another host for servicing. honeyd has several prerequisites that you''ll need to install before building the daemon itself. These are libevent (http://www.monkey.org/~provos/libevent/), libdnet (http://libdnet.sourceforge.net), and libpcap (http://www.tcpdump.org). These can be easily installed by downloading and unpacking them and then using the standard./configure && make install procedure. After the libraries are installed, you can install honeyd the same way. Then copy the service emulation scripts from the source distribution to somewhere more permanent (e.g., /usr/local/share/honeyd/scripts). There are only a few scripts that come with honeyd itself, but there are additional service emulation scripts available on honeyd''s contributions page (http://www.citi.umich.edu/u/provos/honeyd/contribl). Once honeyd has been installed, you''ll need to create a configuration file that defines the types of operating systems and services honeyd will emulate, and the IP addresses honeyd will respond to. First, create some operating system templates: ### Windows computers And then bind them to the IP addresses that you want to use: bind 192.168.0.10 windows-web Save this configuration file in a good place (e.g., /usr/local/share/honeyd/honeyd.conf). Then start honeyd and arpd like this: # arpd 192.168.0.10-192.168.0.12 Now try running Nmap on the IP addresses that honeyd is handling: # nmap -sS -sU -O 192.168.0.10-12 You can certainly see that honeyd fools Nmap. But what happens when you try to access one of the services that are purportedly running? Try connecting to the port 25 of the fake Windows mail server: $ telnet 192.168.0.11 25 Pretty effective at first glance isn''t it? If you''d like to specify some real services for attackers to play with, you can use the proxy keyword to forward any port to a host on another machine. For example, this will forward SSH requests from our imaginary Linux host to the machine at 192.168.1.100: add linux tcp port 22 proxy 192.168.0.100:22 In addition to running the service emulation scripts, honeyd can limit inbound or outbound bandwidth, or even slow down access to a particular service. This can be used to tie up spammer''s resources, by holding open an apparently open mail relay. The possibilities provided by honeyd are limited only by your imagination and the time you''re willing to spend building your virtual fly-catching network. |
لطفا منتظر باشید ...
