hfish 集群蜜罐搭建

电玩女神 2024-04-07 10:47 57阅读 0赞

#### **一、前言** ####

HFish 是一款基于 Golang 开发的跨平台多功能主动攻击型蜜罐钓鱼平台框架系统，为了企业安全防护测试做出了精心的打造

发布版本下载链接： [https://github.com/hacklcx/HFish/releases][https_github.com_hacklcx_HFish_releases]

Github: https://github.com/hacklcs/HFish

*  多功能 不仅仅支持 HTTP(S) 钓鱼，还支持支持 SSH、SFTP、Redis、Mysql、FTP、Telnet、暗网等蜜罐
 *  扩展性 提供 API 接口，使用者可以随意扩展钓鱼模块 ( WEB、PC、APP )
 *  便捷性 使用 Golang 开发，使用者可以在 Win + Mac + Linux 上快速部署一套钓鱼平台

#### 二、集群搭建 ####

1.环境说明：

client01:66.42.68.123(客户端1)

clinet02:144.202.85.37(客户端1)

server:104.156.253.44(服务端)

2.服务端安装与配置

root@server:~\# wget [https://github.com/hacklcx/HFish/releases/download/0.6.4/HFish-0.6.4-linux-amd64.tar.gz][https_github.com_hacklcx_HFish_releases_download_0.6.4_HFish-0.6.4-linux-amd64.tar.gz]

![e056b59357095dd6e00454e3d3c49beb.png][]

root@server:~\# tar zxvf HFish-0.6.4-linux-amd64.tar.gz

![d50604c61c6e81e04ad2ceffe92a71ad.png][]

root@server:~\# vi config.ini \#需要将statuse修改为1，后台密码修改为复杂密码，db\_str数据库生产环境建议采用mysql远程连接，这里测试用自带的sqlite数据库，API查询和上报的认证密钥可以修改为自己的API key.

![cd10324e112e34960e660e2f7c30d6ae.png][]

只保留 HFish config.ini web libs (不启动 WEB 蜜罐可以删掉 WEB 目录) 其他皆可删掉

root@client01:~\# wget https://github.com/hacklcx/HFish/releases/download/0.6.4/HFish-0.6.4-linux-amd64.tar.gz

![0a501d8232672b802283c4d1369fb016.png][]

然后执行命令启动服务端服务

./HFish run

2.客服端1安装与配置

root@client01:~\# tar zxvf HFish-0.6.4-linux-amd64.tar.gz

![820d964e4176cb0d0e2d9bbce052c335.png][]

只保留 HFish config.ini web libs (不启动 WEB 蜜罐可以删掉 WEB 目录) 其他皆可删掉。

root@client01:~\# rm -rf admin/ db/ images/ static/

![61b08e417a8aeaf378a64306e31c4afb.png][]

root@client01:~\# vi config.ini \#需要将statuse修改为2，addr地址和端口修改为服务器端的IP和端口

![66239acce96504797a94f0f24398c5f5.png][]

然后执行命令启动客服端服务

./HFish run

2.客服端2安装与配置

root@client02:~\# rm -rf admin/ db/ images/ static/

![d133cd419b5ca9fcfb04f29139f89982.png][]

root@client02:~\# vi config.ini \#需要将statuse修改为2，addr地址和端口修改为服务器端的IP和端口

![3b1f4232417e686808ad8450fbdd75e7.png][]

然后执行命令启动客服端服务

./HFish run

3.界面展示：

![3cf03cebc3c6ba76113cd1c0cda2ad67.png][]

![2c88c055a55d4e88de923e7023c3ab5c.png][]

![683dfe4a9121412598807d590304015c.png][]

4.监控脚本

/opt/monitor.sh:

\#!/bin/bash  procnum = \`ps \-ef | grep "HFish"| grep \-v grep | wc \-l\`

if \[ $procnum \-eq 0 \] ; then

cd /root/HFish && nohup ./HFish run >> output.log 2> &1 &

![4d3dba870d072665073ddc577e0d5a8b.png][]

crontab \-e

\*/1 \* \* \* \* sh /opt/monitor.sh \# 写入内容，一分钟执行一次 :wq ! \# 保存退出即可，请自行检查是否服务器是否启动 crontab 服务

![583a87fa7be0c799d835f16239f37737.png][]

5.黑名单 IP查询

http://104.156.253.44:9001/api/v1/get/ip?key=X85e2ba265d965b1929148d0f0e33133

![ed6fdb339443045294e5d43e318806ec.png][]

6.获取全部账号密码信息

http://104.156.253.44:9001/api/v1/get/passwd\_list?key=X85e2ba265d965b1929148d0f0e33133

![de02ec7805521caf2c53f5ac76b02261.png][]

7.获取全部钓鱼信息

http://104.156.253.44:9001/api/v1/get/fish\_info?key=X85e2ba265d965b1929148d0f0e33133

![925b52559695cbd403676ef1e41c4f8c.png][]

8.启动暗网蜜罐

root@server:/opt\# apt-get install tor

![0cf8db87b7b49618738938f891016b3d.png][]

修改配置 vi /etc/tor/torrc 文件

HiddenServiceDir /var/lib/tor/hidden\_service/ \# 添加t or web 目录

HiddenServicePort 80 127.0 .0.1:8080 \# 将本机暗网的网站8080端口映射到暗网80端口

![240b00bc3db45c6f66e82f1a4ebd9496.png][]

重启 tor root

root@server:\# service tor restart

![df8c83891cb1e4c6c688d99ee2a12234.png][]

查看暗网域名

cat /var/lib/tor/hidden\_service/hostname

![be137e8e34508317bb12d4bcfadac21e.png][]

访问暗网蜜罐

访问 Tor 官网: https://www.torproject.org

下载 Tor浏览器 安装系统对应版本

启动 Tor浏览器 访问蜜罐 .onion 后缀域名即

9.代理测试方法

在终端上执行以下命令:

http\_proxy=http://127.0.0.1:8081 wget -O - http://hfish.io

![97b52834e71130e72333019b6b5e7e90.png][]

10.自定义蜜罐添加：

\# 修改 config.ini

\[pot\_name\]

status = 1

addr = 0.0.0.0:5901

info = \{ \{addr\}\} 扫描了该蜜罐

配置参数：

pot\_name 蜜罐名称

status 是否启动 蜜罐 1 启动 0 关闭

addr 蜜罐 服务端地址

info 告警内容，\*\*\{ \{addr\}\}\*\* 可选，写了后会替换为攻击者 IP

11.与威胁情报联动配置

![c09fc630fda3824c6b16ec764f1821a7.png][]

![19c915e95ecace5d9dc7c848ce9739d5.png][]

12.web钓鱼

web钓鱼，默认是wordpress模板，可以自定义修改模板如OA或者exchange邮箱

![a124db4fbd193fe7c7c5a0f67cd5be21.png][]

13.邮件告警

如果设置邮箱告警，需要设置正确的账号和密码，这里的密码是为授权码

![c16d4141dae3c0d685866d47a783a61e.png][]

![bbe200f871a828c4ea15611d6a2c40be.jpeg][]

![cc425470760064bd0c0bf1d690029724.png][]

![f8ec2085b89baa33a46f57abd1bd694e.png][]

[https_github.com_hacklcx_HFish_releases]: https://github.com/hacklcx/HFish/releases
[https_github.com_hacklcx_HFish_releases_download_0.6.4_HFish-0.6.4-linux-amd64.tar.gz]: https://github.com/hacklcx/HFish/releases/download/0.6.4/HFish-0.6.4-linux-amd64.tar.gz
[e056b59357095dd6e00454e3d3c49beb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/84d43942cd824680885f245c57dc327b.png
[d50604c61c6e81e04ad2ceffe92a71ad.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/87bad2ade0694b8cbd648dd0b44fc820.png
[cd10324e112e34960e660e2f7c30d6ae.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/089e4a17af234f92ac02a36abaf28f15.png
[0a501d8232672b802283c4d1369fb016.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/5ee9c8b507d14cb0bb79b2f191af49f8.png
[820d964e4176cb0d0e2d9bbce052c335.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/cabf5178ad044f77b0e48a64c2975536.png
[61b08e417a8aeaf378a64306e31c4afb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/1073d7781e0449f19be8ca6463543892.png
[66239acce96504797a94f0f24398c5f5.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e225756bc4f94d3aa75b5379d0e8104d.png
[d133cd419b5ca9fcfb04f29139f89982.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e6cd83e5e29745afbb71944e8c8e22c3.png
[3b1f4232417e686808ad8450fbdd75e7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/bd8a68f8da444274aba0bd05c870eac5.png
[3cf03cebc3c6ba76113cd1c0cda2ad67.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/8637e0acf6a540a6acb2096108205799.png
[2c88c055a55d4e88de923e7023c3ab5c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d022825f77f3416f92b78c5c40d13791.png
[683dfe4a9121412598807d590304015c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e2cc61e613eb4ffa85e0e6334aea5356.png
[4d3dba870d072665073ddc577e0d5a8b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ba5c14d5e1174e289e709c13a98f4658.png
[583a87fa7be0c799d835f16239f37737.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/8bd7024b7d554e1e8fc483ad983f627f.png
[ed6fdb339443045294e5d43e318806ec.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c98a0ebb26c6425d827358cd758e1a1e.png
[de02ec7805521caf2c53f5ac76b02261.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3fc101baeb8849289c7d4f6f5dc6cc1c.png
[925b52559695cbd403676ef1e41c4f8c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/aec8c95c194b4d25a3ccd24424e55307.png
[0cf8db87b7b49618738938f891016b3d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4365ce46e4f74021887e6cd620276226.png
[240b00bc3db45c6f66e82f1a4ebd9496.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c27599c7485c4f018579e7828e7b55fb.png
[df8c83891cb1e4c6c688d99ee2a12234.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/2dc5b1a2fadb40b98d4cdbc2d6023493.png
[be137e8e34508317bb12d4bcfadac21e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a5a15081b61943f9ad95502065907975.png
[97b52834e71130e72333019b6b5e7e90.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/eb0e8b06466a4249a830dc44933c0110.png
[c09fc630fda3824c6b16ec764f1821a7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c0ee1724233f4f46aedbcadde94ad15b.png
[19c915e95ecace5d9dc7c848ce9739d5.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3a3049ab12404f67bde8cda1e4ea8c6e.png
[a124db4fbd193fe7c7c5a0f67cd5be21.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/72693c3ba9a249bcbfd426fa626b0096.png
[c16d4141dae3c0d685866d47a783a61e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f1b830e9b2ce44cb8f6c6236d5b4b4ea.png
[bbe200f871a828c4ea15611d6a2c40be.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a049fd6e14ca4726bcc6a1958f1ebfcb.jpeg
[cc425470760064bd0c0bf1d690029724.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f77eef4d516343f787b6b4d640d22670.png
[f8ec2085b89baa33a46f57abd1bd694e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c8ba35cb462b4e28bf993b67c81b5cca.png