Skip to content

Commit ecb2b4a

Browse files
t3chn0m4g3t3chn0m4g3
authored
Merge pull request #329 from dtag-dev-sec/debian
Prepare for T-Pot 19.03 release
2 parents 35e89b1 + 3f324f0 commit ecb2b4a

File tree

101 files changed

+2154
-6656
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

101 files changed

+2154
-6656
lines changed

‎README.md‎

Lines changed: 86 additions & 86 deletions
Large diffs are not rendered by default.

‎bin/backup_es_folders.sh‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
#!/bin/bash
2+
# Run as root only.
3+
myWHOAMI=$(whoami)
4+
if [ "$myWHOAMI" != "root" ]
5+
then
6+
echo "Need to run as root ..."
7+
exit
8+
fi
9+
210
# Backup all ES relevant folders
311
# Make sure ES is available
412
myES="http://127.0.0.1:64298/"
@@ -16,7 +24,7 @@ fi
1624
myCOUNT=1
1725
myDATE=$(date +%Y%m%d%H%M)
1826
myELKPATH="/data/elk/data"
19-
myKIBANAINDEXNAME=$(curl -s -XGET ''$myES'_cat/indices/' | grep -w ".kibana_1" | awk '{ print $4 }')
27+
myKIBANAINDEXNAME=$(curl -s -XGET ''$myES'_cat/indices/.kibana' | awk '{ print $4 }')
2028
myKIBANAINDEXPATH=$myELKPATH/nodes/0/indices/$myKIBANAINDEXNAME
2129

2230
# Let's ensure normal operation on exit or if interrupted ...

‎bin/clean.sh‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
#!/bin/bash
22
# T-Pot Container Data Cleaner & Log Rotator
3-
43
# Set colors
54
myRED=""
65
myGREEN=""
@@ -154,6 +153,14 @@ fuHERALDING () {
154153
chown tpot:tpot /data/heralding -R
155154
}
156155

156+
# Let's create a function to clean up and prepare honeypy data
157+
fuHONEYPY () {
158+
if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/honeypy/*; fi
159+
mkdir -p /data/honeypy/log
160+
chmod 760 /data/honeypy -R
161+
chown tpot:tpot /data/honeypy -R
162+
}
163+
157164
# Let's create a function to clean up and prepare honeytrap data
158165
fuHONEYTRAP () {
159166
if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/honeytrap/*; fi
@@ -258,6 +265,7 @@ if [ "$myPERSISTENCE" = "on" ];
258265
fuGLASTOPF
259266
fuGLUTTON
260267
fuHERALDING
268+
fuHONEYPY
261269
fuHONEYTRAP
262270
fuMAILONEY
263271
fuMEDPOT

‎bin/dps.sh‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11
#/bin/bash
2+
3+
# Run as root only.
4+
myWHOAMI=$(whoami)
5+
if [ "$myWHOAMI" != "root" ]
6+
then
7+
echo "Need to run as root ..."
8+
exit
9+
fi
10+
211
# Show current status of T-Pot containers
312
myPARAM="$1"
413
myCONTAINERS="$(cat /opt/tpot/etc/tpot.yml | grep -v '#' | grep container_name | cut -d: -f2 | sort | tr -d " ")"
@@ -9,14 +18,13 @@ myWHITE=""
918
myMAGENTA=""
1019

1120
function fuGETSTATUS {
12-
grc docker ps -f status=running -f status=exited --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" | grep -v "NAME" | sort
21+
grc --colour=on docker ps -f status=running -f status=exited --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" | grep -v "NAME" | sort
1322
}
1423

1524
function fuGETSYS {
1625
printf "========| System |========\n"
1726
printf "%+10s %-20s\n" "Date: " "$(date)"
1827
printf "%+10s %-20s\n" "Uptime: " "$(uptime | cut -b 2-)"
19-
printf "%+10s %-20s\n" "CPU temp: " "$(sensors | grep 'Physical' | awk '{ print $4" " }' | tr -d [:cntrl:])"
2028
echo
2129
}
2230

‎bin/dump_es.sh‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
# Dump all ES data
33
# Make sure ES is available
44
myES="http://127.0.0.1:64298/"
5-
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c green)
5+
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c "green\|yellow")
66
if ! [ "$myESSTATUS" = "1" ]
77
then
8-
echo "### Elasticsearch is not available, try starting via 'systemctl start elk'."
8+
echo "### Elasticsearch is not available, try starting via 'systemctl start tpot'."
99
exit
1010
else
1111
echo "### Elasticsearch is available, now continuing."
@@ -20,12 +20,12 @@ trap fuCLEANUP EXIT
2020

2121
# Set vars
2222
myDATE=$(date +%Y%m%d%H%M)
23-
myINDICES=$(curl -s -XGET ''$myES'_cat/indices/' | awk '{ print $3 }' | sort | grep -v 1970)
24-
myES="http://127.0.0.1:64298/"
23+
myINDICES=$(curl -s -XGET ''$myES'_cat/indices/logstash-*' | awk '{ print $3 }' | sort | grep -v 1970)
24+
myINDICES+=" .kibana"
2525
myCOL1=""
2626
myCOL0=""
2727

28-
# Dumping all ES data
28+
# Dumping Kibana and Logstash data
2929
echo $myCOL1"### The following indices will be dumped: "$myCOL0
3030
echo $myINDICES
3131
echo

‎bin/hpfeeds_optin.sh‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
#!/bin/bash
2+
3+
# Run as root only.
4+
myWHOAMI=$(whoami)
5+
if [ "$myWHOAMI" != "root" ]
6+
then
7+
echo "Need to run as root ..."
8+
exit
9+
fi
10+
11+
myTPOTYMLFILE="/opt/tpot/etc/tpot.yml"
12+
13+
function fuSISSDEN () {
14+
echo
15+
echo "You chose SISSDEN, you just need to provide ident and secret"
16+
echo
17+
myENABLE="true"
18+
myHOST="hpfeeds.sissden.eu"
19+
myPORT="10000"
20+
myCHANNEL="t-pot.events"
21+
myCERT="/opt/ewsposter/sissden.pem"
22+
read -p "Ident: " myIDENT
23+
read -p "Secret: " mySECRET
24+
myFORMAT="json"
25+
}
26+
27+
function fuGENERIC () {
28+
echo
29+
echo "You chose generic, please provide all the details of the broker"
30+
echo
31+
myENABLE="true"
32+
read -p "Host URL: " myHOST
33+
read -p "Port: " myPORT
34+
read -p "Channel: " myCHANNEL
35+
echo "For generic providers set this to 'false'"
36+
echo "If you received a CA certficate mount it into the ewsposter container by modifying $myTPOTYMLFILE"
37+
read -p "TLS - 'false' or path to CA in container: " myCERT
38+
read -p "Ident: " myIDENT
39+
read -p "Secret: " mySECRET
40+
read -p "Format ews (xml) or json: " myFORMAT
41+
}
42+
43+
function fuOPTOUT () {
44+
echo
45+
while [ 1 != 2 ]
46+
do
47+
read -s -n 1 -p "You chose to opt out (y/n)? " mySELECT
48+
echo $mySELECT
49+
case "$mySELECT" in
50+
[y,Y])
51+
echo "Opt out."
52+
break
53+
;;
54+
[n,N])
55+
echo "Aborted."
56+
exit
57+
;;
58+
esac
59+
done
60+
myENABLE="false"
61+
myHOST="host"
62+
myPORT="port"
63+
myCHANNEL="channels"
64+
myCERT="false"
65+
myIDENT="user"
66+
mySECRET="secret"
67+
myFORMAT="json"
68+
}
69+
70+
function fuAPPLY () {
71+
echo "Now stopping T-Pot ..."
72+
systemctl stop tpot
73+
echo "Applying your settings ... "
74+
sed --follow-symlinks -i "s/EWS_HPFEEDS_ENABLE.*/EWS_HPFEEDS_ENABLE=${myENABLE}/g" "$myTPOTYMLFILE"
75+
sed --follow-symlinks -i "s/EWS_HPFEEDS_HOST.*/EWS_HPFEEDS_HOST=${myHOST}/g" "$myTPOTYMLFILE"
76+
sed --follow-symlinks -i "s/EWS_HPFEEDS_PORT.*/EWS_HPFEEDS_PORT=${myPORT}/g" "$myTPOTYMLFILE"
77+
sed --follow-symlinks -i "s/EWS_HPFEEDS_CHANNELS.*/EWS_HPFEEDS_CHANNELS=${myCHANNEL}/g" "$myTPOTYMLFILE"
78+
sed --follow-symlinks -i "s#EWS_HPFEEDS_TLSCERT.*#EWS_HPFEEDS_TLSCERT=${myCERT}#g" "$myTPOTYMLFILE"
79+
sed --follow-symlinks -i "s/EWS_HPFEEDS_IDENT.*/EWS_HPFEEDS_IDENT=${myIDENT}/g" "$myTPOTYMLFILE"
80+
sed --follow-symlinks -i "s/EWS_HPFEEDS_SECRET.*/EWS_HPFEEDS_SECRET=${mySECRET}/g" "$myTPOTYMLFILE"
81+
sed --follow-symlinks -i "s/EWS_HPFEEDS_FORMAT.*/EWS_HPFEEDS_FORMAT=${myFORMAT}/g" "$myTPOTYMLFILE"
82+
echo "Now starting T-Pot ..."
83+
systemctl start tpot
84+
echo "You can always change or review your settings in the ewsposter section of $myTPOTYMLFILE"
85+
echo "Done."
86+
}
87+
88+
echo "HPFEEDS Delivery Opt-In for T-Pot"
89+
echo "---------------------------------"
90+
echo "By running this script you agree to share your data with a 3rd party and agree to their corresponding sharing terms."
91+
echo
92+
echo
93+
echo "Please choose your broker"
94+
echo "---------------------------"
95+
echo "[1] - SISSDEN"
96+
echo "[2] - Generic (enter details manually)"
97+
echo "[0] - Opt out of HPFEEDS"
98+
echo "[q] - Do not agree end exit"
99+
echo
100+
while [ 1 != 2 ]
101+
do
102+
read -s -n 1 -p "Your choice: " mySELECT
103+
echo $mySELECT
104+
case "$mySELECT" in
105+
[1])
106+
fuSISSDEN
107+
break
108+
;;
109+
[2])
110+
fuGENERIC
111+
break
112+
;;
113+
[0])
114+
fuOPTOUT
115+
break
116+
;;
117+
[q,Q])
118+
echo "Aborted."
119+
exit
120+
;;
121+
esac
122+
done
123+
fuAPPLY
124+

‎bin/restore_es.sh‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
# Restore folder based ES backup
33
# Make sure ES is available
44
myES="http://127.0.0.1:64298/"
5-
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c green)
5+
myESSTATUS=$(curl -s -XGET ''$myES'_cluster/health' | jq '.' | grep -c "green\|yellow")
66
if ! [ "$myESSTATUS" = "1" ]
77
then
8-
echo "### Elasticsearch is not available, try starting via 'systemctl start elk'."
8+
echo "### Elasticsearch is not available, try starting via 'systemctl start tpot'."
99
exit
1010
else
1111
echo "### Elasticsearch is available, now continuing."
@@ -41,17 +41,31 @@ echo $myCOL1"### Now unpacking tar archive: "$myDUMP $myCOL0
4141
tar xvf $myDUMP
4242

4343
# Build indices list
44-
myINDICES=$(ls tmp/logstash*.gz | cut -c 5- | rev | cut -c 4- | rev)
44+
myINDICES="$(ls tmp/logstash*.gz | cut -c 5- | rev | cut -c 4- | rev)"
4545
myINDICES+=" .kibana"
4646
echo $myCOL1"### The following indices will be restored: "$myCOL0
4747
echo $myINDICES
4848
echo
4949

50+
# Force single seat template for everything
51+
echo -n $myCOL1"### Forcing single seat template: "$myCOL0
52+
curl -s XPUT ''$myES'_template/.*' -H 'Content-Type: application/json' -d'
53+
{ "index_patterns": ".*",
54+
"order": 1,
55+
"settings":
56+
{
57+
"number_of_shards": 1,
58+
"number_of_replicas": 0
59+
}
60+
}'
61+
echo
62+
5063
# Restore indices
64+
curl -s -X DELETE ''$myES'.kibana*' > /dev/null
5165
for i in $myINDICES;
5266
do
5367
# Delete index if it already exists
54-
curl -s -XDELETE $myES$i > /dev/null
68+
curl -s -X DELETE $myES$i > /dev/null
5569
echo $myCOL1"### Now uncompressing: tmp/$i.gz" $myCOL0
5670
gunzip -f tmp/$i.gz
5771
# Restore index to ES

‎bin/rules.sh‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ function fuNFQCHECK {
2323
myNFQCHECK=$(grep -e '^\s*honeytrap:\|^\s*glutton:' $myDOCKERCOMPOSEYML | tr -d ': ' | uniq)
2424
if [ "$myNFQCHECK" == "" ];
2525
then
26-
echo "No NFQ related honeypot detected, no iptables rules needed. Exiting."
26+
echo "No NFQ related honeypot detected, no iptables-legacy rules needed. Exiting."
2727
exit
2828
else
29-
echo "Detected $myNFQCHECK as NFQ based honeypot, iptables rules needed. Continuing."
29+
echo "Detected $myNFQCHECK as NFQ based honeypot, iptables-legacy rules needed. Continuing."
3030
fi
3131
}
3232

@@ -41,54 +41,54 @@ echo "$myRULESPORTS"
4141
}
4242

4343
function fuSETRULES {
44-
### Setting up iptables rules for honeytrap
44+
### Setting up iptables-legacy rules for honeytrap
4545
if [ "$myNFQCHECK" == "honeytrap" ];
4646
then
47-
/sbin/iptables -w -A INPUT -s 127.0.0.1 -j ACCEPT
48-
/sbin/iptables -w -A INPUT -d 127.0.0.1 -j ACCEPT
47+
/usr/sbin/iptables-legacy -w -A INPUT -s 127.0.0.1 -j ACCEPT
48+
/usr/sbin/iptables-legacy -w -A INPUT -d 127.0.0.1 -j ACCEPT
4949

5050
for myPORT in $myRULESPORTS; do
51-
/sbin/iptables -w -A INPUT -p tcp --dport $myPORT -j ACCEPT
51+
/usr/sbin/iptables-legacy -w -A INPUT -p tcp --dport $myPORT -j ACCEPT
5252
done
5353

54-
/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
54+
/usr/sbin/iptables-legacy -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
5555
fi
5656

57-
### Setting up iptables rules for glutton
57+
### Setting up iptables-legacy rules for glutton
5858
if [ "$myNFQCHECK" == "glutton" ];
5959
then
60-
/sbin/iptables -w -t raw -A PREROUTING -s 127.0.0.1 -j ACCEPT
61-
/sbin/iptables -w -t raw -A PREROUTING -d 127.0.0.1 -j ACCEPT
60+
/usr/sbin/iptables-legacy -w -t raw -A PREROUTING -s 127.0.0.1 -j ACCEPT
61+
/usr/sbin/iptables-legacy -w -t raw -A PREROUTING -d 127.0.0.1 -j ACCEPT
6262

6363
for myPORT in $myRULESPORTS; do
64-
/sbin/iptables -w -t raw -A PREROUTING -p tcp --dport $myPORT -j ACCEPT
64+
/usr/sbin/iptables-legacy -w -t raw -A PREROUTING -p tcp --dport $myPORT -j ACCEPT
6565
done
6666
# No need for NFQ forwarding, such rules are set up by glutton
6767
fi
6868
}
6969

7070
function fuUNSETRULES {
71-
### Removing iptables rules for honeytrap
71+
### Removing iptables-legacy rules for honeytrap
7272
if [ "$myNFQCHECK" == "honeytrap" ];
7373
then
74-
/sbin/iptables -w -D INPUT -s 127.0.0.1 -j ACCEPT
75-
/sbin/iptables -w -D INPUT -d 127.0.0.1 -j ACCEPT
74+
/usr/sbin/iptables-legacy -w -D INPUT -s 127.0.0.1 -j ACCEPT
75+
/usr/sbin/iptables-legacy -w -D INPUT -d 127.0.0.1 -j ACCEPT
7676

7777
for myPORT in $myRULESPORTS; do
78-
/sbin/iptables -w -D INPUT -p tcp --dport $myPORT -j ACCEPT
78+
/usr/sbin/iptables-legacy -w -D INPUT -p tcp --dport $myPORT -j ACCEPT
7979
done
8080

81-
/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
81+
/usr/sbin/iptables-legacy -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
8282
fi
8383

84-
### Removing iptables rules for glutton
84+
### Removing iptables-legacy rules for glutton
8585
if [ "$myNFQCHECK" == "glutton" ];
8686
then
87-
/sbin/iptables -w -t raw -D PREROUTING -s 127.0.0.1 -j ACCEPT
88-
/sbin/iptables -w -t raw -D PREROUTING -d 127.0.0.1 -j ACCEPT
87+
/usr/sbin/iptables-legacy -w -t raw -D PREROUTING -s 127.0.0.1 -j ACCEPT
88+
/usr/sbin/iptables-legacy -w -t raw -D PREROUTING -d 127.0.0.1 -j ACCEPT
8989

9090
for myPORT in $myRULESPORTS; do
91-
/sbin/iptables -w -t raw -D PREROUTING -p tcp --dport $myPORT -j ACCEPT
91+
/usr/sbin/iptables-legacy -w -t raw -D PREROUTING -p tcp --dport $myPORT -j ACCEPT
9292
done
9393
# No need for removing NFQ forwarding, such rules are removed by glutton
9494
fi

‎bin/tped.sh‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
#!/bin/bash
22

3+
# Run as root only.
4+
myWHOAMI=$(whoami)
5+
if [ "$myWHOAMI" != "root" ]
6+
then
7+
echo "Need to run as root ..."
8+
exit
9+
fi
10+
311
# set backtitle, get filename
412
myBACKTITLE="T-Pot Edition Selection Tool"
513
myYMLS=$(cd /opt/tpot/etc/compose/ && ls -1 *.yml)
@@ -21,7 +29,7 @@ for i in $myYMLS;
2129
do
2230
myITEMS+="$i $(echo $i | cut -d "." -f1 | tr [:lower:] [:upper:]) "
2331
done
24-
myEDITION=$(dialog --backtitle "$myBACKTITLE" --menu "Select T-Pot Edition" 13 50 6 $myITEMS 3>&1 1>&2 2>&3 3>&-)
32+
myEDITION=$(dialog --backtitle "$myBACKTITLE" --menu "Select T-Pot Edition" 12 50 5 $myITEMS 3>&1 1>&2 2>&3 3>&-)
2533
if [ "$myEDITION" == "" ];
2634
then
2735
echo "Have a nice day!"

0 commit comments

Comments
 (0)