FEATURES OF KIPPO SSH HONEYPOT

INTERSTING FEATURES:

  • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
  • Possibility of adding fake file contents so the attacker can ‘cat’ files such as /etc/passwd. Only minimal file contents are included
  • Session logs stored in an UML compatible format for easy replay with original timings
  • Just like Kojoney, Kippo saves files downloaded with wget for later inspection
  • Trickery; ssh pretends to connect somewhere, exit doesn’t really exit, etc

REQUIREMENT OF KIPPO SSH HONEYPOT

BASIC SOFTWARE REQUIREMENT:

  • An operating system (tested on Debian, CentOS, FreeBSD and Windows 7)
  • Python 2.5+
  • PyCrypto
  • Zope Interface
  • Twisted 8.0 to 15.1.0

HOW TO CLONE BY GITCLONE ON LINUX

$ gitclone https://github.com/desaster/kippo.git

How to run KIPPO SSH HONEYPOT ?

Edit kippo.cfg to your liking and start the honeypot by running:

./start.sh

start.sh is a simple shell script that runs Kippo in the background using twistd. Detailed startup options can be given by running twistd manually. For example, to run Kippo in foreground:

twistd -y kippo.tac -n

By default KIPPO HONEYPOT listens for ssh connections on port 2222. You can change this, but do not change it to 22 as it requires root privileges. Use port forwarding instead.

INTERSTING FILES IN KIPPO HONEYPOT:

  • dl/ – files downloaded with wget are stored here
  • log/kippo.log – log/debug output
  • log/tty/ – session logs
  • fs.pickle – fake filesystem
  • utils/playlog.py – utility to replay session logs
  • utils/createfs.py – used to create fs.pickle
  • honeyfs/ – file contents for the fake filesystem – feel free to copy a real system here

DOWNLOAD NOW

By admin

Leave a Reply

Your email address will not be published. Required fields are marked *