0x00  MHN蜜罐介绍

MHN(Modern Honey Network):开源蜜罐,简化蜜罐的部署,同时便于收集和统计蜜罐的数据。用ThreatStream来部署,数据存储在MOngoDB中,安装了入侵检测系统的部署传感器Snort、Kippo、Conpot和Dionaea。收集的信息可以通过Web接口进行展示。据官方说法,目前经测试支持部署MHN服务器的系统有Ubuntu 14.04, Ubuntu 16.04, Centos 6.9

github地址(https://github.com/threatstream/mh)

0x01 支持蜜罐类型

  • Snort
  • Suricata
  • Dionaea
  • Conpot
  • Kippo
  • Amun
  • Glastopf
  • WordPot
  • ShaockPot
  • P0f

0x02 MHN架构

MHN蜜罐系统建设-LMLPHP

0x03  MHN安装与使用

1.Ubuntu安装MHN管理端

# 操作系统:ubuntu16.04系统更新和自动化脚本安装

sudo apt update

sudo apt upgrade -y

sudo apt-get install git -y

cd /opt

sudo git clone https://github.com/threatstream/mhn.git

cd mhn /

sudo ./install.sh

# 配置服务器信息,这里的邮箱与密码就是安装完成后的Web后台密码

Do you wish to run in Debug mode?: y/n n

Superuser email: [email protected]

Superuser password: (again):

Server base url ["http://155.138.147.248"]:

Honeymap url [":3000"]: http://155.138.147.248:3000

Mail server address ["localhost"]:

Mail server port []:

Use TLS for email?: y/n n

Use SSL for email?: y/n n

Mail server username [""]:

Mail server password [""]:

Mail default sender [""]:

Path for log file ["/var/log/mhn/mhn.log"]:

Would you like to integrate with Splunk? (y/n)n

Would you like to install ELK? (y/n)n

# 配置splunk与ELK,我这里选择不配置

MHN蜜罐系统建设-LMLPHP

2.MHN配置

2.1 agent部署蜜罐

在Deploy选项中,选择我们需要部署的蜜罐类型,复制部署脚本进行安装。

如部署conpot蜜罐,在其系统中执行以下脚本:

wget "http://155.138.147.248/api/script/?text=true&script_id=15" -O deploy.sh && sudo bash deploy.sh http://155.138.147.248 lfDWqAN

MHN蜜罐系统建设-LMLPHP

2.2 集成SplunkArcSight

Splunk

cd /opt/mhn/scripts/

sudo ./install_hpfeeds-logger-splunk.sh

sudo  ./install_splunk_universalforwarder.sh

tail -f /var/log/mhn/mhn-splunk.log

这会将事件作为值记录到/var/log/mhn-splunk.log。SplunkUniveralForwarder应该监视此日志

Arcsight

cd /opt/mhn/scripts/

sudo ./install_hpfeeds-logger-arcsight.sh
tail -f /var/log/mhn/mhn-arcsight.log

2.3禁止数据上报

MHN Server会默认将分析数据上报给Anomali,如果需要禁用此配置,运行如下命令:

cd mhn/scripts/
sudo ./disable_collector.sh

3.利用MHN部署蜜罐

SSH蜜罐测试

# 蜜罐部署机器:155.138.151.176

# 部署蜜罐:dionaea
wget
"http://155.138.147.248/api/script/?text=true&script_id=4" -O
deploy.sh && sudo bash deploy.sh http://155.138.147.248 lfDWqANT

# 尝试暴力破解攻击
hydra -l root -P password.txt mssql://155.138.151.176

4.界面功能展示

1.如下图界面展示了攻击者的源IP地址以及目的端口和所属协议以及蜜罐类型等攻击报告信息。

MHN蜜罐系统建设-LMLPHP

2.如下图列出了攻击载荷报告信息(传感器,源IP地址,目的端口等信息)

MHN蜜罐系统建设-LMLPHP

3.可以看到下图列出了已安装的agent传感器

MHN蜜罐系统建设-LMLPHP

4.下图分别列出攻击者TOP的用户名和密码字典等展示图

MHN蜜罐系统建设-LMLPHP

MHN蜜罐系统建设-LMLPHP

MHN蜜罐系统建设-LMLPHP

5.打开以下连接地址可以看到实时的攻击图(honeymap)

MHN蜜罐系统建设-LMLPHP

0x05 系统排错以及安全设置

1.查看系统运行状态

root@mhn:/opt/mhn/scripts# sudo /etc/init.d/nginx status   #查看nginx状态

 * nginx is running

root@mhn:/opt/mhn/scripts# sudo /etc/init.d/supervisor status    #查看supervisor 状态

 is running

root@mhn:/opt/mhn/scripts#sudo supervisorctl status  #查看所有蜜罐系统组件运行状态

geoloc                           RUNNING    pid , uptime ::

honeymap                         RUNNING    pid , uptime ::

hpfeeds-broker                   RUNNING    pid , uptime ::

mhn-celery-beat                  RUNNING    pid , uptime ::

mhn-celery-worker                RUNNING    pid , uptime ::

mhn-collector                    RUNNING    pid ,  uptime ::

mhn-uwsgi                        RUNNING    pid , uptime ::

mnemosyne                        RUNNING    pid , uptime ::

root@mhn:/opt/mhn/scripts#sudo supervisorctl restart all   #重启所有蜜罐系组件系统命令

正常情况各服务的状态如下:

geoloc                           RUNNING    pid , uptime ::

honeymap                         RUNNING    pid , uptime ::

hpfeeds-broker                   RUNNING    pid , uptime ::

mhn-celery-beat                  RUNNING    pid , uptime ::

mhn-celery-worker                RUNNING    pid , uptime ::

mhn-collector                    RUNNING    pid ,  uptime ::

mhn-uwsgi                        RUNNING    pid , uptime ::

mnemosyne                        RUNNING    pid , uptime ::

2.honeymap 的状态为FATAL解决方法

先删除旧版本的golang

sudo rm -rf /usr/bin/go

sudo apt-get remove golang-go

sudo apt-get remove --auto-remove golang-go

安装golang,如果apt-get install golang安装,后面会因为golang版本低而报错,所以直接下载编译后的包

wget https://storage.googleapis.com/golang/go1.9.linux-amd64.tar.gz

解压,然后进行以下配置

sudo tar -xzf go1..linux-amd64.tar.gz -C /usr//local/  //注意包名要改和自己一样的

导入环境变量:

export GOROOT=/usr/local/go

export GOARCH=amd64

export GOOS=linux

export GOBIN=$GOROOT/bin/

export GOTOOLS=$GOROOT/pkg/tool/

export PATH=$GOBIN:$GOTOOLS:$PATH

安装依赖插件net并重新启动所有蜜罐系统组件

cd /opt/honeymap/server

export GOPATH=/opt/honeymap/server

mkdir -p $GOPATH/src/golang.org/x/
cd $GOPATH/src/golang.org/x/
git clone https://github.com/golang/net.git net
go install net sudo supervisorctl restart all

3.mhn-celery-worker的状态为FATAL解决方法

cd /var/log/mhn/

sudo chmod  mhn.log

sudo supervisorctl start mhn-celery-worker

如果还不行

cd /var/log/mhn/  #查看celery-worker的错误日志

tail -f mhn-celery-worker.err

提示的具体错误内容如下

worker.err supervisor: couldn't chdir to /root/mhn/server: EACCES supervisor: child process was not spawned)

改变root跟目录权限

chmod  -R /root  # 改下权限

4.手动密码重置

如果基于电子邮件的密码重置不适合您,这是另一种方法。
# cd /opt/mhn/server/server/

#apt install sqlite3

# sqlite3 mhn.db

SQLite version 3.7. -- ::

Enter ".help" for instructions

Enter SQL statements terminated with a ";"

sqlite> select * from user;

|[email protected]|sklfdjhkasdlfhklsadhfklasdhfkldsahklsd||

sqlite>.quit

$ cd /opt/mhn/server/

$ source env/bin/activate

$ cd server

$ python manual_password_reset.py

Enter email address: YOUR_USER@YOUR_SITE.com

Enter new password:

Enter new password (again):

user found, updating password

5.网络排查

$ sudo netstat -luntp  #查看网络端口开放情况

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name

tcp               0.0.0.0:              0.0.0.0:*               LISTEN      /sshd

tcp6              :::                   :::*                    LISTEN      /dionaea

tcp6              :::                   :::*                    LISTEN      /sshd

tcp6              :::                 :::*                    LISTEN      /dionaea

tcp6              :::                  :::*                    LISTEN      /dionaea

tcp6              :::                  :::*                    LISTEN      /dionaea

tcp6              :::                 :::*                    LISTEN      /dionaea

tcp6              :::                 :::*                    LISTEN      /dionaea

tcp6              :::                  :::*                    LISTEN      /dionaea

tcp6              :::                 :::*                    LISTEN      /dionaea

tcp6              :::                   :::*                    LISTEN      /dionaea

tcp6              :::                   :::*                    LISTEN      /dionaea

udp               0.0.0.0:              0.0.0.0:*                           /dhclient3

udp               0.0.0.0:           0.0.0.0:*                           /dionaea

udp6              :::                 :::*                                /dionaea

udp6              :::                   :::*                                /dionaea

$ sudo iptables -L  #查看防火墙规则状态

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

$ sudo tcpdump -nnNN tcp port   #监听tcp 10000数据通信信息

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size  bytes

::14.009646 IP 1.2.3.4. > 5.6.6.8.: Flags [P.], seq :, ack , win , options [nop,nop,TS val  ecr ], length

::14.012967 IP 5.6.6.8. > 1.2.3.4.: Flags [.], ack , win , options [nop,nop,TS val  ecr ], length

# netstat -luntp | grep    #查看端口10000的状态

tcp               0.0.0.0:           0.0.0.0:*

LISTEN      /python

$sudo  tail -f hpfeeds-broker.err  #查看hpfeeds-broker错误信息

INFO:root:Auth success by mnemosyne.

INFO:root:Auth success by mnemosyne.

INFO:root:Auth success by mnemosyne.

INFO:root:Auth success by mnemosyne.

INFO:root:Auth success by mnemosyne.

INFO:root:Auth success by mnemosyne.

INFO:root:Auth success by cb5a36e8-55e8-11e9-a746-560001faa574.

INFO:root:Auth success by cb5a36e8-55e8-11e9-a746-560001faa574.

INFO:root:Auth success by mnemosyne.

INFO:root:Auth success by mnemosyne.

$sudo  mongo hpfeeds

MongoDB shell version v3.4.20

connecting to: mongodb://127.0.0.1:27017/hpfeeds

MongoDB server version: 3.4.

Welcome to the MongoDB shell.

For interactive help, type "help".

For more comprehensive documentation, see

 http://docs.mongodb.org/

Questions? Try the support group

 http://groups.google.com/group/mongodb-user

Server has startup warnings:

--03T07::15.543+ I STORAGE [initandlisten]

--03T07::15.543+ I STORAGE [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine

--03T07::15.543+ I STORAGE [initandlisten] ** See http://dochub.mongodb.org/core/prodnotes-filesystem

--03T07::15.579+ I CONTROL [initandlisten]

--03T07::15.579+ I CONTROL [initandlisten] ** WARNING: Access control is not enabled for the database.

--03T07::15.579+ I CONTROL [initandlisten] ** Read and write access to data and configuration is unrestricted.

--03T07::15.579+ I CONTROL [initandlisten]

--03T07::15.579+ I CONTROL [initandlisten]

--03T07::15.579+ I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/defrag is 'always'.

--03T07::15.579+ I CONTROL [initandlisten] **        

6.设置通过HTTPS访问MHN以及端口开放安全

将生成的SSL密钥文件复制到/etc/ssl/private/

将下面的配置复制到/etc/nginx/sites-enabled/

/etc/nginx/sites-enabled/mhn-https

server {

    listen               ;

    listen               ssl;

    server_name         _;

    ssl_certificate     /etc/ssl/private/mhn.pem;

    ssl_certificate_key /etc/ssl/private/mhn-priv.key;

    if ($ssl_protocol = "") {

        rewrite ^ https://$host$request_uri? permanent;

    }

    location / {

        try_files $uri @mhnserver;

    }

    root /opt/www;

    location @mhnserver {

      include uwsgi_params;

      uwsgi_pass unix:/tmp/uwsgi.sock;

    }

    location  /static {

      alias /opt/mhn/server/mhn/static;

    }

}

/etc/nginx/sites-enabled/honeymap-https

map $http_upgrade $connection_upgrade {

             default upgrade;

             ''      close;

}

server {

             listen    ssl;

             ssl_certificate     /etc/ssl/private/mhn.pem;

             ssl_certificate_key /etc/ssl/private/mhn-priv.key;

             root /opt/honeymap/client;

             index index.html index.htm;

             server_name _;

             location / {

                          try_files $uri $uri/ /index.html;

             }

             location /data/ {

                          proxy_pass http://localhost:3000;

                          proxy_http_version 1.1;

                          proxy_set_header Upgrade $http_upgrade;

                          proxy_set_header Connection $connection_upgrade;

             }

}

/etc/nginx/sites-available/splunk-https

map $http_upgrade $connection_upgrade {

        default upgrade;

        ''      close;

}

server {

        listen    ssl;

        ssl_certificate     /etc/ssl/private/mhn.pem;

        ssl_certificate_key /etc/ssl/private/mhn-priv.key;

        root /tmp;

        index index.html index.htm;

        server_name _;

        location / {

                proxy_pass http://localhost:8000;

                proxy_http_version 1.1;

                proxy_set_header Upgrade $http_upgrade;

                proxy_set_header Connection $connection_upgrade;

        }

}

需要启用以下端口并允许MHN服务器上的防火墙规则运行,所有其他端口都可以被阻止。

TCP:443 TCP:3000

7.备份数据

在MHN服务器上进行备份数据

sudo su -

supervisorctl stop all

mongodump  --db hpfeeds

mongodump  --db mnemosyne

tar zcvf mhn-backup.tar.gz dump /opt/mhn/server/mhn.db

supervisorctl start all

复制mhn-backup.tar.gz安全的地方

8.数据恢复

使用install.sh进行安装MHN ,然后将mhn-backup.tar.gz复制到/tmp/目录下并运行以下命

sudo su -

supervisorctl stop all

cd /tmp

tar zxvf mhn-backup.tar.gz

cp /opt/mhn/server/mhn.db /opt/mhn/server/mhn.db

service mongod start

dump.sh脚本:
for FILE in dump/mnemosyne/*.bson;

do

    mongorestore --drop --db mnemosyne "$FILE"

done

for FILE in dump/hpfeeds/*.bson;

do

    mongorestore --drop --db hpfeeds "$FILE"

done
supervisorctl start all

0x06 总结

使用

  • 蜜罐可以存在于各种场景之中(机房、内网、云环境);
  • 蜜罐产品的思考应该是在防火墙、入侵检测之后,属于提高企业安全水平的辅助产品;
  • 蜜罐主要部署在企业内网,起到预警与了解攻击中入侵的情况的作用,如:发现员工PC中毒对内网的入侵、转移攻击者注意力等等;
  • 蜜罐不能设置的太过简单,也不能设置太过复杂;

优点

  • 内置集成大量的蜜罐系统,且提供一键部署蜜罐的方式;
  • 支持蜜罐攻击效果图展示,与ArcSight或Splunk集成友好;

缺点

  • 部署时间需要很长时间(不算缺点吧,网速给力情况下不存在这个问题);
  • 不支持对蜜罐的集中管理;

0x07 参考资料

Build Your Own Honeypot Network In Under An Hour

https://www.cnblogs.com/Eleven-Liu/p/9284417.html

https://libraries.io/github/threatstream/mhn

https://github.com/threatstream/mhn/

05-11 18:26