Sunday
Jul202014
Over a year with Kippo
Sunday, July 20, 2014 at 8:31PM UPDATE: After posting @ikoniaris of Honeydrive and Bruteforce fame recommended running these. Here are the results of kippo-stats.pl created by Tomasz Miklas and Miguel jacq.
As many of you know from previous posts, I am a big fan of honeypots, particularly Kippo. My main Kippo instance sitting in AWS has been online for over a year now. Let's take a look at what we have captured and learned over this past year. If you want to validate any of these statistics I have made the raw logs available for download.
General Stats:
Unique values (135526 connections):
*Map Generated with JCSOCAL's GIPC
Top 11 Countries
China: 699
United States: 654
Brazil: 76
Russian Federation: 69
Germany: 65
Korea, Republic of: 57
Romania: 56
Egypt: 52
Japan: 50
India: 41
Indonesia: 41
Unique Usernames: 8600 (Username list)
Unique Passwords: 75780 (wordlist)
Unique Sources: 1985 (list of IPs)
Passwords:
One of my favorite uses of kippo data is to generate wordlists from login attempts. I wrote a quick script to parse the kippo logs and pull out all passwords and unique them into a wordlist. Feel free to grab. Additionally I made the wordlists available for download.
Using Pipal I performed analysis of all the login attempts over this year:
Two items of note here are that over 60% of password attempts were 1-8 characters. 40% of attempts were for lowercase alpha characters only. The most used password was 123456. This is the default pass for Kippo.
If a user attempts to create an account or change the root password in a Kippo session those passwords are captured and added to the allowed credentials list. The following credentials were created:
root:0:albertinoalbert123root:0:fgashyeq77dhshfaroot:0:florian12euroot:0:hgd177q891999wwwwwe1.dONroot:0:iphone5root:0:kokotroot:0:noperoot:0:picvinaroot:0:scorpi123root:0:testroot:0:xiaozheroot:0:12345root:0:bnn318da9031kdamfaihheq1faroot:0:lsroot:0:neonhostt1root:0:wget123
Downloads:
When an attacker attempts to download a tool via wget, within Kippo we allow that file to be downloaded, although they cannot interact with it. With this we are able to get a copy of whatever is being downloaded. In most cases these are IRC bots, but not all. I have made them all available for download.
Here is a listing of all the files:
*Duplicates and obviously legitimate files have been removed from the list.
20131030113401_http___198_2_192_204_22_disknyp20131103183232_http___61_132_227_111_8080_meimei20131104045744_http___198_2_192_204_22_disknyp20131114214017_http___www_unrealircd_com_downloads_Unreal3_2_8_1_tar_gz20131116130541_http___198_2_192_204_22_disknyp20131129165151_http___dl_dropboxusercontent_com_s_1bxj9ak8m1octmk_ktx_c20131129165438_http___dl_dropboxusercontent_com_s_66gpt66lvut4gdu_ktx20131202040921_http___198_2_192_204_22_disknyp20131207123419_http___packetstorm_wowhacker_com_DoS_juno_c20131216143108_http___www_psybnc_at_download_beta_psyBNC_2_3_2_7_tar_gz20131216143208_http___X_hackersoft_org_scanner_gosh_jpg20131216143226_http___download_microsoft_com_download_win2000platform_SP_SP3_NT5_EN_US_W2Ksp3_exe20131217163423_http___ha_ckers_org_slowloris_slowloris_pl20131217163456_http___www_lemarinel_net_perl20131222084315_http___maxhub_com_auto_bill_pipe_bot20140103142644_http___ftp_gnu_org_gnu_autoconf_autoconf_2_69_tar_gz20140109170001_http___sourceforge_net_projects_cpuminer_files_pooler_cpuminer_2_3_2_linux_x86_tar_gz20140120152204_http___111_39_43_54_5555_dos3220140122202342_http___layer1_cpanel_net_latest20140122202549_http___linux_duke_edu_projects_yum_download_2_0_yum_2_0_7_tar_gz20140122202751_http___www_ehcp_net_ehcp_latest_tgz20140201131804_http___www_suplementar_com_br_images_stories_goon_pooler_cpuminer_2_3_2_tar_gz20140201152307_http___nemo_rdsor_ro_darwin_jpg20140208081358_http___www_youtube_com_watch_v_6hVQs5ll06420140208184835_http___sharplase_ru_x_txt20140215141909_http___tenet_dl_sourceforge_net_project_cpuminer_pooler_cpuminer_2_3_2_tar_gz20140215142830_http___sourceforge_net_projects_cpuminer_files_pooler_cpuminer_2_3_2_tar_gz20140219072721_http___www_psybnc_at_download_beta_psyBNC_2_3_2_7_tar_gz20140328031725_http___dl_dropboxusercontent_com_u_133538399_multi_py20140409053322_http___www_c99php_com_shell_c99_rar20140409053728_http___github_com_downloads_orbweb_PHP_SHELL_WSO_wso2_5_1_php20140413130110_http___www_iphobos_com_hb_unixcod_rar20140416194008_http___linux_help_bugs3_com_Camel_mail_txt20140419143734_http___www_activestate_com_activeperl_downloads_thank_you_dl_http___downloads_activestate_com_ActivePerl_releases_5_18_2_1802_ActivePerl_5_18_2_1802_x86_64_linux_glibc_2_5_298023_tar_gz20140419144043_http___ha_ckers_org_slowloris_slowloris_pl20140420104056_http___downloads_metasploit_com_data_releases_archive_metasploit_4_9_2_linux_x64_installer_run20140420104325_http___nmap_org_dist_nmap_6_46_1_i386_rpm20140505073503_http___116_255_239_180_888_00720140505093229_http___119_148_161_25_805_sd3220140505111511_http___112_117_223_10_280_120140515091557_http___112_117_223_10_280__bash_6_phpmysql20140519193800_http___www_unrealircd_com_downloads_Unreal3_2_8_1_tar_gz20140523120411_http___lemonjuice_tk_netcat_sh20140610174516_http___59_63_183_193_280__etc_Test888820140614200901_http___kismetismy_name_ktx20140625032113_http___ftp_mirrorservice_org_sites_ftp_wiretapped_net_pub_security_packet_construction_netcat_gnu_netcat_netcat_0_7_1_tar_gz20140720005010_http___www_bl4ck_viper_persiangig_com_p8_localroots_2_6_x_cw7_3
To see the full source for some of the scripts downloaded by the attackers you can go to this Github Repo. A couple of my favorite ones.
TTY Replay Sessions:
My absolute favorite feature of Kippo is the ability to replay interactive sessions of attacker activity. Watching these replays gives us an idea of what attackers do once inside a session. For instance almost every session begins with a "w" which shows logged in users and uptime, and then a "uname -a" to show them system details. I made a Youtube series called The Kippo Kronicles a while back to showcase some of these sessions. While I don't have the time necessary to continue putting up videos for each session I have put the output of each session up at this Github Repo.
Here is a fun example:
AWSWeb:~# adduseradduser: Only one or two names allowed.AWSWeb:~# useraddadduser: Only one or two names allowed.AWSWeb:~# lsAWSWeb:~# pwdrootAWSWeb:~# cd /[1D[1P[1D[1P[1D[1P[1D[1Pcat /etc/passwdroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shrichard:x:1000:1000:richard,,,:/home/richard:/bin/bashsshd:x:101:65534::/var/run/sshd:/usr/sbin/nologinAWSWeb:~# userbash: user: command not foundAWSWeb:~# adduser obzAdding user `obz' ...Adding new group `obz' (1001) ...Adding new user `obz' (1001) with group `obz' ...Creating home directory `/home/obz' ...Copying files from `/etc/skel' ...Password:Password again:Changing the user information for obzEnter the new value, or press ENTER for the defaultUsername []:Must enter a value!Username []: obzFull Name []: l[1D[1Padmin obzRoom Number []: 1Work Phone []: 1234567890Home Phone []:Must enter a value!Home Phone []: 0Mobile Phone []: 0Country []: cnCity []: xangLanguage []: mandFavorite movie []: 1Other []: 1Is the information correct? [Y/n] yERROR: Some of the information you entered is invalidDeleting user `obz' ...Deleting group `obz' (1001) ...Deleting home directory `/home/obz' ...Try again? [Y/n] yChanging the user information for obzEnter the new value, or press ENTER for the defaultUsername []: obxFull Name []: obx toorRoom Number []: 1Work Phone []: 1[1D[1P9089543121Home Phone []: 9089342135Mobile Phone []: 9089439012Country []: cnCity []: xangLanguage []: man[1D[1P[1D[1P[1D[1PenglishFavorite movie []: oneOther []: two[1D[1P[1D[1P[1D[1PfourIs the information correct? [Y/n] yERROR: Some of the information you entered is invalidDeleting user `obz' ...Deleting group `obz' (1001) ...Deleting home directory `/home/obz' ...Try again? [Y/n] nAWSWeb:~# cat adduser obz user cat /etc/passwdroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shrichard:x:1000:1000:richard,,,:/home/richard:/bin/bashsshd:x:101:65534::/var/run/sshd:/usr/sbin/nologinAWSWeb:~# cat /etc/shadowcat: /etc/shadow: No such file or directoryAWSWeb:~# /etc/init.d\[1D[1P[1D[1PD/ssh startbash: /etc/init.D/ssh: command not foundAWSWeb:~# [K/etc/init.D/ssh start[1D[1D[1D[1D[1D[1D[1D[1D[1D[1D[1D[1Pdbash: /etc/init.d/ssh: command not foundAWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~#AWSWeb:~# exitcConnection to server closed.localhost:~# exitConnection to server closed.localhost:~# byebash: bye: command not foundlocalhost:~# exitConnection to server closed.localhost:~# adminbash: admin: command not foundlocalhost:~# sulocalhost:~# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:11 .drwxr-xr-x 1 root root 4096 2013-02-03 17:11 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrclocalhost:~# pwd/rootlocalhost:~# cd /localhost:/# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:11 .drwxr-xr-x 1 root root 4096 2013-02-03 17:11 ..drwxr-xr-x 1 root root 0 2009-11-20 08:19 sysdrwxr-xr-x 1 root root 4096 2009-11-08 15:42 bindrwxr-xr-x 1 root root 4096 2009-11-06 11:08 mntdrwxr-xr-x 1 root root 4096 2009-11-06 11:08 medialrwxrwxrwx 1 root root 25 2009-11-06 11:16 vmlinuz -> /boot/vmlinuz-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-06 11:09 optlrwxrwxrwx 1 root root 11 2009-11-06 11:08 cdrom -> /media/cdrom0drwxr-xr-x 1 root root 4096 2009-11-06 11:08 selinuxdrwxrwxrwx 1 root root 4096 2009-11-20 08:19 tmpdr-xr-xr-x 1 root root 0 2009-11-20 08:19 procdrwxr-xr-x 1 root root 4096 2009-11-08 15:41 sbindrwxr-xr-x 1 root root 4096 2009-11-20 08:20 etcdrwxr-xr-x 1 root root 3200 2009-11-20 08:20 devdrwxr-xr-x 1 root root 4096 2009-11-06 11:09 srvlrwxrwxrwx 1 root root 28 2009-11-06 11:16 initrd.img -> /boot/initrd.img-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-08 15:46 libdrwxr-xr-x 1 root root 4096 2009-11-06 11:22 homedrwxr-xr-x 1 root root 4096 2009-11-06 11:09 vardrwxr-xr-x 1 root root 4096 2009-11-08 15:46 usrdrwxr-xr-x 1 root root 4096 2009-11-08 15:39 bootdrwxr-xr-x 1 root root 4096 2009-11-20 09:08 rootdrwx------ 1 root root 16384 2009-11-06 11:08 lost+foundlocalhost:/# cd /homelocalhost:/home# ls -lldrwxr-xr-x 1 root root 4096 2013-02-03 17:11 .drwxr-xr-x 1 root root 4096 2013-02-03 17:11 ..drwxr-xr-x 1 1000 1000 4096 2009-11-06 11:22 richardlocalhost:/home# exitConnection to server closed.localhost:~#localhost:~#localhost:~#localhost:~#localhost:~#localhost:~#localhost:~# ssh -D root@http://60.250.65.112/ 1337The authenticity of host '60.250.65.112 (60.250.65.112)' can't be established.RSA key fingerprint is 9d:30:97:8a:9e:48:0d:de:04:8d:76:3a:7b:4b:30:f8.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '60.250.65.112' (RSA) to the list of known hosts.root@60.250.65.112's password:Linux localhost 2.6.26-2-686 #1 SMP Wed Nov 4 20:45:37 UTC 2009 i686Last login: Sat Feb 2 07:07:11 2013 from 192.168.9.4localhost:~# uname -aLinux localhost 2.6.24-2-generic #1 SMP Thu Dec 20 17:36:12 GMT 2007 i686 GNU/Linuxlocalhost:~# pwd/rootlocalhost:~# cd /localhost:/# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:19 .drwxr-xr-x 1 root root 4096 2013-02-03 17:19 ..drwxr-xr-x 1 root root 0 2009-11-20 08:19 sysdrwxr-xr-x 1 root root 4096 2009-11-08 15:42 bindrwxr-xr-x 1 root root 4096 2009-11-06 11:08 mntdrwxr-xr-x 1 root root 4096 2009-11-06 11:08 medialrwxrwxrwx 1 root root 25 2009-11-06 11:16 vmlinuz -> /boot/vmlinuz-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-06 11:09 optlrwxrwxrwx 1 root root 11 2009-11-06 11:08 cdrom -> /media/cdrom0drwxr-xr-x 1 root root 4096 2009-11-06 11:08 selinuxdrwxrwxrwx 1 root root 4096 2009-11-20 08:19 tmpdr-xr-xr-x 1 root root 0 2009-11-20 08:19 procdrwxr-xr-x 1 root root 4096 2009-11-08 15:41 sbindrwxr-xr-x 1 root root 4096 2009-11-20 08:20 etcdrwxr-xr-x 1 root root 3200 2009-11-20 08:20 devdrwxr-xr-x 1 root root 4096 2009-11-06 11:09 srvlrwxrwxrwx 1 root root 28 2009-11-06 11:16 initrd.img -> /boot/initrd.img-2.6.26-2-686drwxr-xr-x 1 root root 4096 2009-11-08 15:46 libdrwxr-xr-x 1 root root 4096 2009-11-06 11:22 homedrwxr-xr-x 1 root root 4096 2009-11-06 11:09 vardrwxr-xr-x 1 root root 4096 2009-11-08 15:46 usrdrwxr-xr-x 1 root root 4096 2009-11-08 15:39 bootdrwxr-xr-x 1 root root 4096 2009-11-20 09:08 rootdrwx------ 1 root root 16384 2009-11-06 11:08 lost+foundlocalhost:/# cd /rootlocalhost:~# ls -lldrwxr-xr-x 1 root root 4096 2013-02-03 17:19 .drwxr-xr-x 1 root root 4096 2013-02-03 17:19 ..drwxr-xr-x 1 root root 4096 2009-11-06 11:16 .debtags-rw------- 1 root root 5515 2009-11-20 09:08 .viminfodrwx------ 1 root root 4096 2009-11-06 11:13 .aptitude-rw-r--r-- 1 root root 140 2009-11-06 11:09 .profile-rw-r--r-- 1 root root 412 2009-11-06 11:09 .bashrclocalhost:~# cd /ho[1D[1P[1D[1P[1D[1P[1D[1P[1D[1P[1D[1Pcd /home/localhost:/home# ls -ldrwxr-xr-x 1 root root 4096 2013-02-03 17:20 .drwxr-xr-x 1 root root 4096 2013-02-03 17:20 ..drwxr-xr-x 1 1000 1000 4096 2009-11-06 11:22 richardlocalhost:/home# exitConnection to server closed.localhost:~# exitConnection to server closed.localhost:~#
Conclusion:
After a year with Kippo, I have learned a lot about what these basic attackers do when connecting to seemingly open ssh hosts. There is plenty more to learn though. I have some plans on building out a larger honeypot infrastructure, and automating some of the data collection and parsing. Additionally I would like to spend more time analyzing the sessions and malware for further trends. I'll keep you all posted!
*Big thanks to Bruteforce Labs for their tools and expertise in honeypots.
