Showing posts with label python. Show all posts
Showing posts with label python. Show all posts

12 May 2017

Installing conpot on debian Jessie (8) for the lazy:

Prerequisites:
Update your box and sync your clock:
# apt-get update && apt-get upgrade
# apt-get install ntpdate libmysqlclient-dev gcc libpython27-dev

Then do a time update :
# ntpdate -v time.nist.gov

Now install pip :
# wget https://bootstrap.pypa.io/get-pip.py
# python get-pip.py
Then you should get something like this :
root@debian-dev:~# pip -V
pip 9.0.1 from /usr/local/lib/python2.7/dist-packages (python 2.7)

nice. Now on to
Conpot itself:
# pip install conpot
But if you run it it fails with this error:
[...] from bacpypes import LocalDeviceObjectImportError: cannot import name LocalDeviceObject

Awww snap !
That’s because conpot is a bit outdated and looks for a class in the bacpypes package where it used to be several versions ago, but the author moved it. So all your lazy ass has to do is change
IN FILE: /usr/local/lib/python2.7/dist-packages/conpot/protocols/bacnet/bacnet_server.py
Look for: from bacpypes.app import LocalDeviceObject
Change to: from bacpypes.service.device import LocalDeviceObject

And what do you know: magic happens :
# conpot --help
[...]  Version 0.5.1  MushMush Foundation [...]

Now run it test if it actually listens :
# conpot --template default

And Surely enough, it does :
[...]
2017-05-12 16:21:15,204 IPMI BMC initialized.
2017-05-12 16:21:15,204 Conpot IPMI initialized using /usr/lib64/python2.7/site-packages/conpot/templates/default/ipmi/ipmi.xml template
2017-05-12 16:21:15,204 Found and enabled ('ipmi', ) protocol.
2017-05-12 16:21:15,204 No proxy template found. Service will remain unconfigured/stopped.
2017-05-12 16:21:15,204 Modbus server started on: ('0.0.0.0', 502)
2017-05-12 16:21:15,204 S7Comm server started on: ('0.0.0.0', 102)
2017-05-12 16:21:15,205 HTTP server started on: ('0.0.0.0', 80)
2017-05-12 16:21:15,275 SNMP server started on: ('0.0.0.0', 161)
2017-05-12 16:21:15,275 Bacnet server started on: ('0.0.0.0', 47808)
2017-05-12 16:21:15,276 IPMI server started on: ('0.0.0.0', 623)
2017-05-12 16:21:20,206 Privileges dropped, running as "nobody:nogroup"
[...]

Right, so you told python to do it’s thing, and surely it now listens :
root@debian-dev:~# netstat -antlup | grep -i list
tcp        0      0 0.0.0.0:502             0.0.0.0:*               LISTEN      11642/python  
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      403/sshd      
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      667/exim4      
tcp        0      0 0.0.0.0:57657           0.0.0.0:*               LISTEN      386/rpc.statd  
tcp        0      0 0.0.0.0:102             0.0.0.0:*               LISTEN      11642/python  
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      373/rpcbind    
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      11642/python  
tcp6       0      0 :::22                   :::*                    LISTEN      403/sshd      
tcp6       0      0 ::1:25                  :::*                    LISTEN      667/exim4      
tcp6       0      0 :::42332                :::*                    LISTEN      386/rpc.statd  
tcp6       0      0 :::111                  :::*                    LISTEN      373/rpcbind     

Mind you, this box be much new, very basic.

Here’s how it looks like from a browser on port 80:
















Such conpot, much http !
Now get configuring. This guide doesn't cover that since it's plainly written here : https://mushorg.github.io/conpot/usage/index.html

Installing conpot on Centos 7 easy for the lazy:

Prerequisites:
First of all, I am talking about a fresh install, so read between the lines if that’s not the case, mkay mkay. Make sure your system is updated and your clock is set properly:
# yum -y update
# yum -y install ntpdate

then ln -sf /usr/share/zoneinfo/[Your_Region]/Your_Capital_City /etc/localtime
For example

# ln -sf /usr/share/zoneinfo/Europe/Bucharest /etc/localtime
Then do a time update :
# ntpdate -v time.nist.gov

Now install pip :
# curl -O https://bootstrap.pypa.io/get-pip.py
# python get-pip.py 
Then you should get something like this :
[root@centos7development ~]# pip -V
pip 9.0.1 from /usr/lib/python2.7/site-packages (python 2.7)

Dependencies:
# yum install mariadb-devel gcc python-devel
nice. Now on to
Conpot itself:
# pip install conpot
But if you run it it fails with this error:
[...] from bacpypes import LocalDeviceObjectImportError: cannot import name LocalDeviceObject

Awww snap !
That’s because conpot is a bit outdated and looks for a class in the bacpypes package where it used to be several versions ago, but the author moved it. So all your lazy ass has to do is change
IN FILE: /usr/lib64/python2.7/site-packages/conpot/protocols/bacnet/bacnet_server.py
Look for: from bacpypes.app import LocalDeviceObject
Change to: from bacpypes.service.device import LocalDeviceObject

And what do you know: magic happens :
# conpot --help
[...]  Version 0.5.1  MushMush Foundation [...]

Now run it test if it actually listens :
# conpot --template default

And Surely enough, it does :
[...]
2017-05-12 16:21:15,204 IPMI BMC initialized.
2017-05-12 16:21:15,204 Conpot IPMI initialized using /usr/lib64/python2.7/site-packages/conpot/templates/default/ipmi/ipmi.xml template
2017-05-12 16:21:15,204 Found and enabled ('ipmi', ) protocol.
2017-05-12 16:21:15,204 No proxy template found. Service will remain unconfigured/stopped.
2017-05-12 16:21:15,204 Modbus server started on: ('0.0.0.0', 502)
2017-05-12 16:21:15,204 S7Comm server started on: ('0.0.0.0', 102)
2017-05-12 16:21:15,205 HTTP server started on: ('0.0.0.0', 80)
2017-05-12 16:21:15,275 SNMP server started on: ('0.0.0.0', 161)
2017-05-12 16:21:15,275 Bacnet server started on: ('0.0.0.0', 47808)
2017-05-12 16:21:15,276 IPMI server started on: ('0.0.0.0', 623)
2017-05-12 16:21:20,206 Privileges dropped, running as "nobody:nobody"
[...]

Right, so you told python to do it’s thing, and surely it now listens :
[root@centos7development ~]# netstat -antlup | grep -i list
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      18362/python    
tcp        0      0 0.0.0.0:502             0.0.0.0:*               LISTEN      18362/python    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      896/sshd        
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      991/master      
tcp        0      0 0.0.0.0:102             0.0.0.0:*               LISTEN      18362/python    
tcp6       0      0 :::22                   :::*                    LISTEN      896/sshd        
tcp6       0      0 ::1:25                  :::*                    LISTEN      991/master        

Mind you, this box be much new, very basic.
Being Centos and all that you need to setup some firewall permissions, but for the sake of argument, and since this is not a "how-to firewalld yourself", I just disabled it :
Here’s how it looks like from a browser on port 80:
















Such conpot, much http !
Now get configuring. This guide doesn't cover that since it's plainly written here : https://mushorg.github.io/conpot/usage/index.html

22 February 2013

how to install glastopf on centos 6 in a couple of minutes, no hassle

Edited on 04'th of March 2013 to reflect latest glastopf changes.
 
If you're wondering WTF is glastopf, well -> that's the bugger !
Some words before we begin:
Installing glastopf on Centos 6.3 32bit/64bit can be a pain especially if you break your already in place python setup. That's because glastopf needs 2.7 :) cute :>
First python version 2.7 needs to be installed without breaking the default 2.6 install (this would mess up yum and other tools that depend on python 2.6) *you want to stay away from that.

Ok, so how you set your OS up is up to you. you can get iso's, burn em and install in a physical machine, or virtualise using virtualbox/openvz/xen/vmware whatever you wish, the point is, you must have a fresh install(preferably) and a login prompt. 
Also, this was adapted from this ubuntu guide:the marvelous ubuntu guide. Once you're at a login prompt or at the shell, read on: 


All commands issued by root. If you must use sudo then do. I encourage it.
Setup the 'mess'(build) dir if you prefer but you can install python from anywhere.

Prepare the environment:
Prequisites from rpms

# yum groupinstall "Development Tools"
# yum install zlib-devel bzip2-devel openssl-devel ncurses-devel sqlite-devel readline-devel tk-devel php-devel libxml2-devel libxslt-devel atlas atlas-devel gcc-gfortran g++ git php php-devel wget screen mysql mysql-server mysql-devel libevent-headers
- accept all deps. 
- You need some of those things to have a not-only-barely-functional python interpreter. 
- from this point on it is recommended to perform all your work in screen. if you're not familiar with screen here's a good tutorial: the mighty screen. Basically it's a virtual terminal that keeps whatever stuff you do in it running even if your ssh session fails due to leet-isp-skills or alien crashes severing your fiber channels. Then when you reconnect you can re-attach to it and voila. it's as if you never left.
# mkdir -p /usr/local/build/
Python installation: cd to previously created dir, then:
# wget http://www.python.org/ftp/python/2.7.3/Python-2.7.3.tar.bz2
# tar xjf Python-2.7.3.tar.bz2
# cd Python-2.7.3
# ./configure --prefix=/usr/local
# make && make altinstall
(the red word is very important)
Prequisites for pip (if you don't like distribute feel free to use your favourite):
# cd /usr/local/build/ 
# curl -O http://python-distribute.org/distribute_setup.py
# python2.7 distribute_setup.py
Pip installation:
# cd /usr/local/build/  
# curl -O https://raw.github.com/pypa/pip/master/contrib/get-pip.py
# python2.7 get-pip.py
Proceed to prequisites for glastopf:
  • pymongo:
# pip-2.7 install --upgrade pymongo
  • numpy and other deps:
# pip-2.7 install numpy
# pip-2.7 install chardet sqlalchemy lxml beautifulsoup pyOpenSSL requests MySQL-python
# pip-2.7 install scipy
(be warned: pip installs software from alpha centauri so expect *some* delays. also compiling can take a while.)
  • antlr:
# cd /usr/local/build/
# wget http://www.antlr3.org/download/antlr-3.1.3.tar.gz
# tar xzf antlr-3.1.3.tar.gz
# cd antlr-3.1.3/runtime/Python
# python2.7 setup.py install
  • SKLearn:
# cd /usr/local/build/
# git clone git://github.com/scikit-learn/scikit-learn.git
# cd scikit-learn
# python2.7 setup.py install
  • evnet:
# cd /usr/local/build/
# git clone git://github.com/rep/evnet.git
# cd evnet
# python2.7 setup.py install
Install and configure the php sandbox
# cd /usr/local/build/
# git clone git://github.com/glastopf/BFR.git
# cd BFR
# phpize
# ./configure --enable-bfr
# make && make install
take a look at your architecture and add this line to php.ini accordingly:
zend_extension = /usr/lib/php/modules/bfr.so
or
zend_extension = /usr/lib64/php/modules/bfr.so

Proceed with glastopf 
# cd /usr/local/build
# git clone https://github.com/glastopf/glastopf.git
# cd glastopf
# python2.7 setup.py install
if for some weird reason this doesnt work retry last command - i had issues due to some weird network problems or mirror issues. 

Create a directory that will serve as your glastopf honeypot root. anywhere you want. For example /usr/local:
# mkdir /usr/local/honeypot 
# cd /usr/local/honeypot
AND THEN : 
# glastopf-runner.py
but wait. it fails. that's because in the glastopf.cfg file that it sets up in this directory the group id doesn't exist. it may on debiant/ubuntu but not on centos. so change it to nobody and adjust other settings and you're set.

# screen glastopf-runner.py
It should look like something similar to this with the last line being Glastopf started and privileges dropped:


:D enjoy