1

Let's consider the following scenario: You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on your system with privileges of www-data user.

Is it possible to have honeypot on commands run by the www-data user? For example, let's assume that apache2 or any other process run by www-data, never runs ls command to list directory (it would most likely use other API provided by the system, rather than start new process parse output etc). Is it possible to set-up a honeypot on such command? For example, log the commands in sys.log, or add an entry to a database with only INSERT permission?

The command should still run normally on other users (or specified) accounts, without triggering the log event.

If such honeypot is possible, how could one be set up? Is there any reasons why such honeypot is bad and should not be used?

  • Why would you want a honeypot once they have full control over the process and local control? Isn't it far too late? – schroeder May 21 at 16:16
  • Well I was thinking of this a bit more as of "you been hacked" flag. In some cases compromised services / users can go for long time without being noticed by administrator, but adding such custom behaviour potentially could help finding it out sooner and reducing the impact – vakus May 21 at 16:19
  • Then you don't want a honeypot. You want a tripwire. You want to be alerted when certain commands are run. That's a different problem. – schroeder May 21 at 16:19
  • Are you also aware of things like: unix.stackexchange.com/questions/155139/… – schroeder May 21 at 16:23
  • 1
    @S0AndS0 i never used any containers yet but dont feel that this is limiting factor, as i am willing to learn them – vakus May 21 at 20:08
2

It sounds like you want to have a custom shell environment for this one user. Replace bash with a custom variant that only allows certain commands and logs the other commands.

Kippo/Cowrie would be a good model for you to look at for creating something like this and all the challenges and limitations, as well. Kippo/Cowrie is for faking ssh shells.

  • Some friends and I once wrote a program called "honeydoor". It is both a backdoor shell and a honeypot in one c program. If you log in as the 'doored' user, you get a bash shell. If you log in with one of programmed commonly used telnet password combos like 'root:toor', than you get the fake shell, which logs all commands. After a certain # of failed attempts it just spits urandom data at you (hopefully crashing the scanner) This is a pretty fun way to collect default logins and payloads, and is easier to set up than kippo: gist.github.com/darkerego/9771c474e73852986cacea3ee13f2096 – Chev_603 May 21 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.