3

I've got the Honeyd honeypot in one virtual machine (kali) and nmap in another (ubuntu), the config file looks like this:

create default
set default default tcp action closed
set default default udp action closed
set default default icmp action open

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action open
set windows default udp action open
set windows default icmp action closed
add windows tcp port 21 "sh scripts/unix/linux/ftp.sh"
add windows tcp port 135 open
add windows tcp port 139 open
add windows tcp port 445 open

set windows ethernet "00:0c:38:8d:8c:17"
dhcp windows on eth0

... Then i'm running honey as sudo honeyd -f <my config file> -l <my log> -p nmap-os-db -a nmap.assoc -0 pf.os -x xprobe2.conf -d

When i perform scans i get some results:

enter image description here

I get some UDP and ARP detection but no SYN scan detection or anything else.

The scans I'm doing are quite aggressive ones too:

nmap <ip> -sT -A -O

Yet it picks up nothing? - and the OS is not detected properly.

enter image description here

Can anyone spot my mistake? - The OS detection is not working its saying there are too many results and all 1000 scanned ports are coming back as filtered.

closed as off-topic by schroeder, Xander, TildalWave, Mark, AJ Henderson Nov 4 '14 at 14:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Mark, AJ Henderson
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'd look at your networking between the 2 VMs. Are you going through a virtual firewall? Is your firewall on your Kali system wide open? Are the VMs directly connected? Can you capture packets on the Kali machine to see if the nmap packets are making it to your system? – schroeder Nov 3 '14 at 17:17
  • If i scan kali (target) from ubuntu (attacker) wireshark lights up like crazy, if i scan the honeypot nothing happens - saying that all ports on kali are coming back closed, i can ping kali but i can't ping honeyd running on it – Crizly Nov 3 '14 at 17:22
  • "Ping the honeypot" ? I'm not sure what you mean. – schroeder Nov 3 '14 at 17:45
  • You know ping the IP address of it (icmp echo) – Crizly Nov 3 '14 at 17:51
  • You appear to be mixing up terms: Kali, target, honeyd. How can you ping "Kali" but not "honeyd"? Are they not the same machine with the same IP? – schroeder Nov 3 '14 at 17:59
0

After much head banging I found the problem was with the VirtualBox software, Honeyd requires you be able to go into promiscuous mode.

By default VirtualBox does not allow this, you have to go into your virtual machine network settings and "allow all" from the promiscuous mode dropdown box, then it works fine!

Not the answer you're looking for? Browse other questions tagged or ask your own question.