MHN蜜罐系统建设

忘是亡心i 2024-04-07 10:53 67阅读 0赞

**0x00 MHN****蜜罐介绍**

MHN(Modern Honey Network)：开源蜜罐，简化蜜罐的部署，同时便于收集和统计蜜罐的数据。用ThreatStream来部署，数据存储在MOngoDB中，安装了入侵检测系统的部署传感器Snort、Kippo、Conpot和Dionaea。收集的信息可以通过Web接口进行展示。据官方说法，目前经测试支持部署MHN服务器的系统有Ubuntu 14.04, Ubuntu 16.04, Centos 6.9

[github地址][github](https://github.com/threatstream/mh)

**0x01** **支持蜜罐类型**

*  Snort
 *  Suricata
 *  Dionaea
 *  Conpot
 *  Kippo
 *  Amun
 *  Glastopf
 *  WordPot
 *  ShaockPot
 *  P0f

**0x02 MHN****架构**

![1bf54049e9964cf17904dee292e77837.png][]

**0x03 MHN****安装与使用**

**1.Ubuntu****安装****MHN****管理端**

\# 操作系统：ubuntu16.04系统更新和自动化脚本安装

sudo apt update
    
    sudo apt upgrade -y 
    
    sudo apt-get install git -y
    
    cd /opt
    
    sudo git clone https://github.com/threatstream/mhn.git
    
    cd mhn /
    
    sudo ./install.sh

\# 配置服务器信息，这里的邮箱与密码就是安装完成后的Web后台密码

Do you wish to run in Debug mode?: y/n n
    
    Superuser email: root@backlion.org
    
    Superuser password: (again):
    
    Server base url ["http://155.138.147.248"]:     
    
    Honeymap url [":3000"]: http://155.138.147.248:3000
    
    Mail server address ["localhost"]:
    
    Mail server port [25]:
    
    Use TLS for email?: y/n n
    
    Use SSL for email?: y/n n
    
    Mail server username [""]:
    
    Mail server password [""]:
    
    Mail default sender [""]:
    
    Path for log file ["/var/log/mhn/mhn.log"]:
    
    Would you like to integrate with Splunk? (y/n)n 
    
    Would you like to install ELK? (y/n)n

\# 配置splunk与ELK，我这里选择不配置

![27560055f6398ee43c6e06d8bdd9af63.png][]

**2.MHN****配置**

**2.1 agent****部署蜜罐**

在Deploy选项中，选择我们需要部署的蜜罐类型，复制部署脚本进行安装。

如部署conpot蜜罐,在其系统中执行以下脚本:

wget "http://155.138.147.248/api/script/?text=true&script_id=15" -O deploy.sh && sudo bash deploy.sh http://155.138.147.248 lfDWqAN

![efd9278ce29f158f2cbf1f2bc2e368e3.png][]

**2.2** **集成****Splunk****与****ArcSight**

**Splunk**

cd /opt/mhn/scripts/

sudo ./install\_hpfeeds-logger-splunk.sh

sudo ./install\_splunk\_universalforwarder.sh

tail -f /var/log/mhn/mhn-splunk.log

这会将事件作为值记录到/var/log/mhn-splunk.log。SplunkUniveralForwarder应该监视此日志

**Arcsight**

cd /opt/mhn/scripts/
    
    sudo ./install_hpfeeds-logger-arcsight.sh
    tail -f /var/log/mhn/mhn-arcsight.log

**2.3****禁止数据上报**

MHN Server会默认将分析数据上报给Anomali，如果需要禁用此配置，运行如下命令：

cd mhn/scripts/
    sudo ./disable_collector.sh

**3.****利用****MHN****部署蜜罐**

**SSH****蜜罐测试**

\# 蜜罐部署机器：155.138.151.176

\# 部署蜜罐：dionaea  
wget "http://155.138.147.248/api/script/?text=true&script\_id=4" -O deploy.sh && sudo bash deploy.sh http://155.138.147.248 lfDWqANT

\# 尝试暴力破解攻击  
hydra -l root -P password.txt mssql://155.138.151.176

**4.****界面功能展示**

1.如下图界面展示了攻击者的源IP地址以及目的端口和所属协议以及蜜罐类型等攻击报告信息。

![8cca62aaab294e4ee40e7b6dcdb202c4.png][]

2.如下图列出了攻击载荷报告信息(传感器，源IP地址，目的端口等信息)

![67419d1069b97b63de62d4c63448f1c9.png][]

3.可以看到下图列出了已安装的agent传感器

![df80b7a3487975f5bf78422c2d400933.png][]

4.下图分别列出攻击者TOP的用户名和密码字典等展示图

![500763651958469bf7ff8cf91f8aea33.png][]

![f3e159441674629ae584c2796e5651ac.png][]

![d0ac73cb5ff710c629d770e87fe2f43b.png][]

5.打开以下连接地址可以看到实时的攻击图(honeymap)

![9ab970abdaf4c4644748b2156e591331.png][]

**0x05** **系统排错以及安全设置**

**1.****查看系统运行状态**

root@mhn:/opt/mhn/scripts# sudo /etc/init.d/nginx status   #查看nginx状态
    
     * nginx is running       
    
    root@mhn:/opt/mhn/scripts# sudo /etc/init.d/supervisor status    #查看supervisor 状态
    
     is running
    
    root@mhn:/opt/mhn/scripts#sudo supervisorctl status  #查看所有蜜罐系统组件运行状态
    
    geoloc                           RUNNING    pid 31443, uptime 0:00:12
    
    honeymap                         RUNNING    pid 30826, uptime 0:08:54
    
    hpfeeds-broker                   RUNNING    pid 10089, uptime 0:36:42
    
    mhn-celery-beat                  RUNNING    pid 29909, uptime 0:18:41
    
    mhn-celery-worker                RUNNING    pid 29910, uptime 0:18:41
    
    mhn-collector                    RUNNING    pid 7872,  uptime 0:18:41
    
    mhn-uwsgi                        RUNNING    pid 29911, uptime 0:18:41
    
    mnemosyne                        RUNNING    pid 28173, uptime 0:30:08
    
    root@mhn:/opt/mhn/scripts#sudo supervisorctl restart all   #重启所有蜜罐系组件系统命令
    
    正常情况各服务的状态如下：
    
    geoloc                           RUNNING    pid 31443, uptime 0:00:12
    
    honeymap                         RUNNING    pid 30826, uptime 0:08:54
    
    hpfeeds-broker                   RUNNING    pid 10089, uptime 0:36:42
    
    mhn-celery-beat                  RUNNING    pid 29909, uptime 0:18:41
    
    mhn-celery-worker                RUNNING    pid 29910, uptime 0:18:41
    
    mhn-collector                    RUNNING    pid 7872,  uptime 0:18:41
    
    mhn-uwsgi                        RUNNING    pid 29911, uptime 0:18:41
    
    mnemosyne                        RUNNING    pid 28173, uptime 0:30:08

**2.honeymap** **的状态为****FATAL****解决方法**

先删除旧版本的golang
    
    sudo rm -rf /usr/bin/go
    
    sudo apt-get remove golang-go
    
    sudo apt-get remove --auto-remove golang-go
    
    安装golang，如果apt-get install golang安装，后面会因为golang版本低而报错，所以直接下载编译后的包
    
    wget https://storage.googleapis.com/golang/go1.9.linux-amd64.tar.gz
    
    解压，然后进行以下配置
    
    sudo tar -xzf go1.9.linux-amd64.tar.gz -C /usr//local/  //注意包名要改和自己一样的
    
    导入环境变量：
    
     
    
    export GOROOT=/usr/local/go
    
    export GOARCH=amd64
    
    export GOOS=linux
    
    export GOBIN=$GOROOT/bin/
    
    export GOTOOLS=$GOROOT/pkg/tool/
    
    export PATH=$GOBIN:$GOTOOLS:$PATH
    
     
    
    安装依赖插件net并重新启动所有蜜罐系统组件
    
    cd /opt/honeymap/server
    
    export GOPATH=/opt/honeymap/server
    
    mkdir -p $GOPATH/src/golang.org/x/
    cd $GOPATH/src/golang.org/x/
    git clone https://github.com/golang/net.git net
    go install net
    
    sudo supervisorctl restart all

**3.mhn-celery-worker****的状态为****FATAL****解决方法**

cd /var/log/mhn/
    
    sudo chmod 777 mhn.log
    
    sudo supervisorctl start mhn-celery-worker
    
    如果还不行
    
    cd /var/log/mhn/  #查看celery-worker的错误日志
    
    tail -f mhn-celery-worker.err
    
    提示的具体错误内容如下
    
    worker.err supervisor: couldn't chdir to /root/mhn/server: EACCES supervisor: child process was not spawned)
    
    改变root跟目录权限
    
    chmod 777 -R /root  # 改下权限

**4.****手动密码重置**

如果基于电子邮件的密码重置不适合您，这是另一种方法。

# cd /opt/mhn/server/server/
    
    #apt install sqlite3
    
    # sqlite3 mhn.db
    
    SQLite version 3.7.9 2011-11-01 00:52:41
    
    Enter ".help" for instructions
    
    Enter SQL statements terminated with a ";"
    
    sqlite> select * from user;
    
    1|USERNAME@SITE.com|sklfdjhkasdlfhklsadhfklasdhfkldsahklsd|1|
    
    sqlite>.quit
    
    $ cd /opt/mhn/server/
    
    $ source env/bin/activate
    
    $ cd server
    
    $ python manual_password_reset.py
    
    Enter email address: YOUR_USER@YOUR_SITE.com
    
    Enter new password:
    
    Enter new password (again):
    
    user found, updating password

**5.****网络排查**

$ sudo netstat -luntp  #查看网络端口开放情况
    
    Active Internet connections (only servers)
    
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      561/sshd       
    
    tcp6       0      0 :::21                   :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::22                   :::*                    LISTEN      561/sshd       
    
    tcp6       0      0 :::1433                 :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::443                  :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::445                  :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::5060                 :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::5061                 :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::135                  :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::3306                 :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::42                   :::*                    LISTEN      3763/dionaea   
    
    tcp6       0      0 :::80                   :::*                    LISTEN      3763/dionaea   
    
    udp        0      0 0.0.0.0:68              0.0.0.0:*                           464/dhclient3  
    
    udp        0      0 0.0.0.0:40077           0.0.0.0:*                           3763/dionaea   
    
    udp6       0      0 :::5060                 :::*                                3763/dionaea   
    
    udp6       0      0 :::69                   :::*                                3763/dionaea    
    
     
    
    $ sudo iptables -L  #查看防火墙规则状态
    
    Chain INPUT (policy ACCEPT)
    
    target     prot opt source               destination        
    
     
    
    Chain FORWARD (policy ACCEPT)
    
    target     prot opt source               destination        
    
     
    
    Chain OUTPUT (policy ACCEPT)
    
    target     prot opt source               destination        
    
     
    
    $ sudo tcpdump -nnNN tcp port 10000  #监听tcp 10000数据通信信息
    
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    
    listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
    
    16:46:14.009646 IP 1.2.3.4.42873 > 5.6.6.8.10000: Flags [P.], seq 1180349317:1180349611, ack 2474834734, win 913, options [nop,nop,TS val 85084174 ecr 169636000], length 294
    
    16:46:14.012967 IP 5.6.6.8.10000 > 1.2.3.4.42873: Flags [.], ack 294, win 162, options [nop,nop,TS val 169661444 ecr 85084174], length 0
    
    # netstat -luntp | grep 10000   #查看端口10000的状态
    
    tcp        0      0 0.0.0.0:10000           0.0.0.0:*
    
    LISTEN      980/python
    
    $sudo  tail -f hpfeeds-broker.err  #查看hpfeeds-broker错误信息
    
    INFO:root:Auth success by mnemosyne.
    
    INFO:root:Auth success by mnemosyne.
    
    INFO:root:Auth success by mnemosyne.
    
    INFO:root:Auth success by mnemosyne.
    
    INFO:root:Auth success by mnemosyne.
    
    INFO:root:Auth success by mnemosyne.
    
    INFO:root:Auth success by cb5a36e8-55e8-11e9-a746-560001faa574.
    
    INFO:root:Auth success by cb5a36e8-55e8-11e9-a746-560001faa574.
    
    INFO:root:Auth success by mnemosyne.
    
    INFO:root:Auth success by mnemosyne.
    
    $sudo  mongo hpfeeds
    
    MongoDB shell version v3.4.20
    
    connecting to: mongodb://127.0.0.1:27017/hpfeeds
    
    MongoDB server version: 3.4.20
    
    Welcome to the MongoDB shell.
    
    For interactive help, type "help".
    
    For more comprehensive documentation, see
    
     http://docs.mongodb.org/
    
    Questions? Try the support group
    
     http://groups.google.com/group/mongodb-user
    
    Server has startup warnings: 
    
    2019-04-03T07:28:15.543+0000 I STORAGE [initandlisten] 
    
    2019-04-03T07:28:15.543+0000 I STORAGE [initandlisten] ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
    
    2019-04-03T07:28:15.543+0000 I STORAGE [initandlisten] ** See http://dochub.mongodb.org/core/prodnotes-filesystem
    
    2019-04-03T07:28:15.579+0000 I CONTROL [initandlisten] 
    
    2019-04-03T07:28:15.579+0000 I CONTROL [initandlisten] ** WARNING: Access control is not enabled for the database.
    
    2019-04-03T07:28:15.579+0000 I CONTROL [initandlisten] ** Read and write access to data and configuration is unrestricted.
    
    2019-04-03T07:28:15.579+0000 I CONTROL [initandlisten] 
    
    2019-04-03T07:28:15.579+0000 I CONTROL [initandlisten] 
    
    2019-04-03T07:28:15.579+0000 I CONTROL [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/defrag is 'always'.
    
    2019-04-03T07:28:15.579+0000 I CONTROL [initandlisten] **

**6.****设置通过****HTTPS****访问****MHN****以及端口开放安全**

将生成的SSL密钥文件复制到/etc/ssl/private/

将下面的配置复制到/etc/nginx/sites-enabled/

**/etc/nginx/sites-enabled/mhn-https**

server {
    
        listen               80;
    
        listen              443 ssl;
    
        server_name         _;
    
        ssl_certificate     /etc/ssl/private/mhn.pem;
    
        ssl_certificate_key /etc/ssl/private/mhn-priv.key;
    
     
    
        if ($ssl_protocol = "") {
    
            rewrite ^ https://$host$request_uri? permanent;
    
        }
    
     
    
        location / {
    
            try_files $uri @mhnserver;
    
        }
    
       
    
        root /opt/www;
    
     
    
        location @mhnserver {
    
          include uwsgi_params;
    
          uwsgi_pass unix:/tmp/uwsgi.sock;
    
        }
    
     
    
        location  /static {
    
          alias /opt/mhn/server/mhn/static;
    
        }
    
    }

**/etc/nginx/sites-enabled/honeymap-https**

map $http_upgrade $connection_upgrade {
    
                 default upgrade;
    
                 ''      close;
    
    }
    
     
    
    server {
    
                 listen   8443 ssl;
    
                 ssl_certificate     /etc/ssl/private/mhn.pem;
    
                 ssl_certificate_key /etc/ssl/private/mhn-priv.key;
    
     
    
                 root /opt/honeymap/client;
    
                 index index.html index.htm;
    
     
    
                 server_name _;
    
     
    
                 location / {
    
                              try_files $uri $uri/ /index.html;
    
                 }
    
     
    
                 location /data/ {
    
                              proxy_pass http://localhost:3000;
    
                              proxy_http_version 1.1;
    
                              proxy_set_header Upgrade $http_upgrade;
    
                              proxy_set_header Connection $connection_upgrade;
    
                 }
    
    }

**/etc/nginx/sites-available/splunk-https**

map $http_upgrade $connection_upgrade {
    
            default upgrade;
    
            ''      close;
    
    }
    
     
    
    server {
    
            listen   8001 ssl;
    
            ssl_certificate     /etc/ssl/private/mhn.pem;
    
            ssl_certificate_key /etc/ssl/private/mhn-priv.key;
    
     
    
            root /tmp;
    
            index index.html index.htm;
    
     
    
            server_name _;
    
     
    
            location / {
    
                    proxy_pass http://localhost:8000;
    
                    proxy_http_version 1.1;
    
                    proxy_set_header Upgrade $http_upgrade;
    
                    proxy_set_header Connection $connection_upgrade;
    
            }
    
    }

需要启用以下端口并允许MHN服务器上的防火墙规则运行，所有其他端口都可以被阻止。

TCP：443 TCP：3000

**7.****备份数据**

在MHN服务器上进行备份数据

sudo su -
    
    supervisorctl stop all
    
    mongodump  --db hpfeeds
    
    mongodump  --db mnemosyne
    
    tar zcvf mhn-backup.tar.gz dump /opt/mhn/server/mhn.db
    
    supervisorctl start all

复制mhn-backup.tar.gz安全的地方

**8.****数据****恢复**

使用install.sh进行安装MHN ，然后将mhn-backup.tar.gz复制到/tmp/目录下并运行以下命

sudo su -
    
    supervisorctl stop all
    
    cd /tmp
    
    tar zxvf mhn-backup.tar.gz
    
    cp /opt/mhn/server/mhn.db /opt/mhn/server/mhn.db
    
    service mongod start

dump.sh脚本：

for FILE in dump/mnemosyne/*.bson;
    
    do
    
        mongorestore --drop --db mnemosyne "$FILE"
    
    done
    
     
    
    for FILE in dump/hpfeeds/*.bson;
    
    do
    
        mongorestore --drop --db hpfeeds "$FILE"
    
    done

supervisorctl start all

**0x06** **总结**

**使用**

*  蜜罐可以存在于各种场景之中(机房、内网、云环境)；
 *  蜜罐产品的思考应该是在防火墙、入侵检测之后，属于提高企业安全水平的辅助产品；
 *  蜜罐主要部署在企业内网，起到预警与了解攻击中入侵的情况的作用，如：发现员工PC中毒对内网的入侵、转移攻击者注意力等等；
 *  蜜罐不能设置的太过简单，也不能设置太过复杂；

**优点**

*  内置集成大量的蜜罐系统，且提供一键部署蜜罐的方式；
 *  支持蜜罐攻击效果图展示，与ArcSight或Splunk集成友好；

**缺点**

*  部署时间需要很长时间(不算缺点吧，网速给力情况下不存在这个问题)；
 *  不支持对蜜罐的集中管理；

**0x07** **参考资料**

[Build Your Own Honeypot Network In Under An Hour][]

[https://www.cnblogs.com/Eleven-Liu/p/9284417.html][https_www.cnblogs.com_Eleven-Liu_p_9284417.html]

[https://libraries.io/github/threatstream/mhn][https_libraries.io_github_threatstream_mhn]

[https://github.com/threatstream/mhn/][https_github.com_threatstream_mhn]

[github]: https://github.com/threatstream/mhn
[1bf54049e9964cf17904dee292e77837.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e0cf227b5b234df2bf117e444d74873d.png
[27560055f6398ee43c6e06d8bdd9af63.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/352674d96a8e4a6ab72c04db66a1ae96.png
[efd9278ce29f158f2cbf1f2bc2e368e3.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/a37c4729b1b34f1abe703c16f715f66f.png
[8cca62aaab294e4ee40e7b6dcdb202c4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d1a742fdfee74fecb3ca9caa670422bd.png
[67419d1069b97b63de62d4c63448f1c9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/41b2983b41e3459f9e24a13e55e6d021.png
[df80b7a3487975f5bf78422c2d400933.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/cd7c530e77e14301b71455e3f7d13fe4.png
[500763651958469bf7ff8cf91f8aea33.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/b5b916b17fc94cfc8b81f77610158ed6.png
[f3e159441674629ae584c2796e5651ac.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f228f64bf5ad47bbbcc0100f1bf86a98.png
[d0ac73cb5ff710c629d770e87fe2f43b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/02dfcbc88b9140ad86bbf1c34b0af288.png
[9ab970abdaf4c4644748b2156e591331.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e217fcffbb66461cafec36fe82a88c9e.png
[Build Your Own Honeypot Network In Under An Hour]: https://jerrygamblin.com/2017/05/29/build-your-own-honeypot-network-in-under-an-hour/
[https_www.cnblogs.com_Eleven-Liu_p_9284417.html]: https://www.cnblogs.com/Eleven-Liu/p/9284417.html
[https_libraries.io_github_threatstream_mhn]: https://libraries.io/github/threatstream/mhn
[https_github.com_threatstream_mhn]: https://github.com/threatstream/mhn/