### Setup Development Environment with Docker Compose Source: https://github.com/dinotools/dionaea/blob/master/doc/source/development/setup.md Clone the repository and use docker-compose to bring up the development environment. This is a quick way to get started. ```console $ git clone https://github.com/DinoTools/dionaea.git $ cd dionaea/dev/docker $ docker-compose up ``` -------------------------------- ### Rebuild, Install, and Run Dionaea from Source Source: https://github.com/dinotools/dionaea/blob/master/doc/source/development/setup.md Build, install, and start Dionaea from the root of the git repository. This command sequence compiles the source, installs it, and then runs the honeypot with specified logging options. ```console $ make $ sudo make install $ sudo /opt/dionaea/bin/dionaea -c /opt/dionaea/etc/dionaea/dionaea.cfg -l all,-debug -L '*' ``` ```console $ make && sudo make install && sudo dionaea -c /opt/dionaea/etc/dionaea/dionaea.cfg -l all,-debug -L '*' ``` -------------------------------- ### Setup Development Environment on Ubuntu 14.04 Source: https://github.com/dinotools/dionaea/blob/master/doc/source/development/setup.md Clone the repository and run the bootstrap script to set up the development environment on a fresh Ubuntu 14.04 system. All files will be installed in `/opt/dionaea`. ```console $ git clone https://github.com/DinoTools/dionaea.git $ vagrant $ ./bootstrap.sh ``` -------------------------------- ### Build and Install libemu Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Clones the libemu repository, configures it for installation at /opt/dionaea, and installs it. ```bash git clone git://git.carnivore.it/libemu.git libemu cd libemu autoreconf -vi ./configure --prefix=/opt/dionaea make install cd .. ``` -------------------------------- ### Build and Install liblcfg Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Clones the liblcfg repository, configures it for installation at /opt/dionaea, and installs it. ```bash git clone git://git.carnivore.it/liblcfg.git liblcfg cd liblcfg/code autoreconf -vi ./configure --prefix=/opt/dionaea make install cd ../.. cd .. ``` -------------------------------- ### MySQL Module Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/mysql.md Example configuration for the MySQL module, demonstrating how to set up databases like 'information_schema' with an in-memory SQLite database. It also shows commented-out examples for custom database paths. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: mysql config: databases: information_schema: path: ":memory:" # example how to extend this # just provide a databasename and path to the database # the database can be altered by attackers, so ... better use a copy # psn: # path: "/path/to/cc_info.sqlite" ``` -------------------------------- ### Install Ubuntu Dependencies Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Installs necessary development libraries and tools on Ubuntu using aptitude. ```bash aptitude install libudns-dev libglib2.0-dev libssl-dev libcurl4-openssl-dev \ libreadline-dev libsqlite3-dev python-dev \ libtool automake autoconf build-essential \ subversion git-core \ flex bison \ pkg-config ``` -------------------------------- ### Dionaea Logging Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html A comment indicating that logrotate requires Dionaea to be started with a PID file, specifying the path to the PID file. ```bash # in this case -p /opt/dionaea/var/run/dionaea.pid ``` -------------------------------- ### SIP SDP Example Configuration Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/sip.md This example shows how to define Session Description Protocol (SDP) parameters for a SIP session, including audio and video port configurations. ```text v=0 o=- 1304279835 1 IN {addrtype} {unicast_address} s=SIP Session c=IN {addrtype} {unicast_address} t=0 0 [audio_port] m=audio {audio_port} RTP/AVP 111 0 8 9 101 120 a=sendrecv a=rtpmap:111 Speex/16000/1 a=fmtp:111 sr=16000,mode=any a=rtpmap:0 PCMU/8000/1 a=rtpmap:8 PCMA/8000/1 a=rtpmap:9 G722/8000/1 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16,32,36 a=rtpmap:120 NSE/8000 a=fmtp:120 192-193 [/audio_port] [video_port] m=video {video_port} RTP/AVP 34 96 97 c=IN {addrtype} {unicast_address} a=rtpmap:34 H263/90000 a=fmtp:34 QCIF=2 a=rtpmap:96 H263-1998/90000 a=fmtp:96 QCIF=2 a=rtpmap:97 H263-N800/90000 [/video_port] ``` -------------------------------- ### Install and Activate Virtual Environment for Git Source: https://github.com/dinotools/dionaea/blob/master/doc/source/contributing.md Set up a Python virtual environment for installing Git-related tools like pre-commit. Activate the environment before proceeding. ```bash $ python3 -m venv venv_git $ source venv_git/bin/activate ``` -------------------------------- ### Install xmatch Shared Library Source: https://github.com/dinotools/dionaea/blob/master/modules/xmatch/CMakeLists.txt Installs the built 'xmatch' shared library to the 'lib' directory of the installation prefix. ```cmake install( TARGETS xmatch LIBRARY DESTINATION lib ) ``` -------------------------------- ### Build and Install libpcap Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Downloads, extracts, configures, and installs libpcap version 1.1.1 to /opt/dionaea. ```bash wget http://www.tcpdump.org/release/libpcap-1.1.1.tar.gz tar xfz libpcap-1.1.1.tar.gz cd libpcap-1.1.1 ./configure --prefix=/opt/dionaea make make install cd .. ``` -------------------------------- ### Install pre-commit Source: https://github.com/dinotools/dionaea/blob/master/doc/source/contributing.md Install the pre-commit tool, which helps manage and run Git hooks. Ensure your virtual environment is active. ```bash $ pip install pre-commit ``` -------------------------------- ### Build and Install libev Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Downloads, extracts, configures, and installs libev version 4.04 to /opt/dionaea. ```bash wget http://dist.schmorp.de/libev/Attic/libev-4.04.tar.gz tar xfz libev-4.04.tar.gz cd libev-4.04 ./configure --prefix=/opt/dionaea make install cd .. ``` -------------------------------- ### Install libnl from source Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Installs libnl from source, setting the rpath for shared libraries and configuring for installation at /opt/dionaea. ```bash git clone git://git.infradead.org/users/tgr/libnl.git cd libnl autoreconf -vi export LDFLAGS=-Wl,-rpath,/opt/dionaea/lib ./configure --prefix=/opt/dionaea make make install cd .. ``` -------------------------------- ### Full HTTP Service Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/http.md A comprehensive example demonstrating various HTTP service configurations, including ports, SSL ports, maximum request size, global headers, and filename-based header matching. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: http config: # Root directory to look for files root: "@DIONAEA_STATEDIR@/http/root" ports: - 80 ssl_ports: - 443 max_request_size: 32768 # maximum size in kbytes of the request (32MB) # Set default Content-Type if unable to detect # default_content_type: text/html; charset=utf-8 # Max number of fields to extract from GET request (Python >= 3.8) # get_max_num_fields: 100 # List of default headers # default_headers: # - ["Content-Type", "{content_type}"] # - ["Content-Length", "{content_length}"" # - ["Connection", "{connection}"] # Try to detect the Content-Type by using the filename # detect_content_type: true global_headers: - ["Server", "nginx"] # Add additional headers to the response. First match wins. # filename_pattern - is a regex if matched the headers are set # headers - a list of HTTP headers to set # the order matters, use to simulate your webserver as good as possible headers: - filename_pattern: ".*\\.php" headers: - ["Content-Type", "text/html; charset=utf-8"] - ["Content-Length", "{content_length}"] - ["Connection", "{connection}"] - ["X-Powered-By", "PHP/5.5.9-1ubuntu4.5"] # If enabled, try to handle some SOAP requests # soap_enabled: false template: # set to true to enable template processing # this feature requires jinja2 template engine http://jinja.pocoo.org/ enabled: false file_extension: .j2 path: "@DIONAEA_STATEDIR@/http/template/nginx" templates: autoindex: filename: autoindex.html.j2 error_pages: - filename: error.html.j2 # - filename: error/{code}.html.j2 # used to specify additional template values values: # full_name: nginx/1.1 ``` -------------------------------- ### Configure and Build Dionaea Source: https://github.com/dinotools/dionaea/blob/master/doc/source/installation.md Create a build directory, configure the build process using CMake with a specified installation prefix, and then compile and install Dionaea. ```bash mkdir build cd build cmake -DCMAKE_INSTALL_PREFIX:PATH=/opt/dionaea .. make sudo make install ``` -------------------------------- ### Install Dionaea from Source on Ubuntu 18.04 Source: https://context7.com/dinotools/dionaea/llms.txt Steps to clone the repository, install build dependencies, and build/install Dionaea using CMake. Ensure all listed dependencies are installed before building. ```bash # Clone the repository git clone https://github.com/DinoTools/dionaea.git cd dionaea # Install build dependencies sudo apt-get install \ build-essential cmake check cython3 \ libcurl4-openssl-dev libemu-dev libev-dev \ libglib2.0-dev libloudmouth1-dev libnetfilter-queue-dev \ libnl-3-dev libpcap-dev libssl-dev libtool libudns-dev \ python3 python3-dev python3-bson python3-yaml python3-boto3 \ fonts-liberation # Build and install mkdir build && cd build cmake -DCMAKE_INSTALL_PREFIX:PATH=/opt/dionaea .. make sudo make install # Dionaea is now installed at /opt/dionaea ``` -------------------------------- ### Example Emuprofile Configuration Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/emuprofile.md This is a basic example of how to configure the emuprofile module in dionaea. Ensure this configuration is placed within the main dionaea configuration file. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: emuprofile ``` -------------------------------- ### MSSQL Module Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/mssql.md An example configuration snippet for enabling the MSSQL honeypot module in dionaea. Ensure this is part of your main dionaea configuration. ```yaml - name: mssql ``` -------------------------------- ### Memcache Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/memcache.md This snippet shows a basic configuration for enabling the memcache emulation module in Dionaea. ```yaml - name: memcache ``` -------------------------------- ### Install Pre-commit Hooks Source: https://github.com/dinotools/dionaea/blob/master/CONTRIBUTING.rst Install pre-commit using a virtual environment to manage and run pre-commit hooks. This ensures code quality before committing. ```bash $ python3 -m venv venv_git $ source venv_git/bin/activate $ pip install pre-commit $ pre-commit install ``` -------------------------------- ### Install Emu Module Library Source: https://github.com/dinotools/dionaea/blob/master/modules/emu/CMakeLists.txt Installs the built 'module_emu' shared library to the appropriate location within the Dionaea installation directory, typically 'lib/dionaea'. ```cmake install( TARGETS module_emu LIBRARY DESTINATION lib/dionaea ) ``` -------------------------------- ### Mirror Service Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/mirror.md This is a basic configuration snippet for enabling the mirror service. Ensure this is part of your main dionaea configuration file. ```yaml - name: mirror ``` -------------------------------- ### Install pre-commit Hooks Source: https://github.com/dinotools/dionaea/blob/master/doc/source/contributing.md Install the Git hooks managed by pre-commit. This automates checks before commits. ```bash $ pre-commit install ``` -------------------------------- ### log_json Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/log_json.md An example configuration for the log_json ihandler. It shows how to specify the output file for the JSON data and includes a commented-out option for flattening the data. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: log_json config: # Uncomment next line to flatten object lists to work with ELK # flat_data: true handlers: #- http://127.0.0.1:8080/ - file://@DIONAEA_STATEDIR@/dionaea.json ``` -------------------------------- ### Example log_db_sql Configuration Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/log_db_sql.md Configure the log_db_sql handler with a database URL. This example uses a SQLite database located in the Dionaea state directory. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: log_db_sql config: url: sqlite:///@DIONAEA_STATEDIR@/dionaea.db ``` -------------------------------- ### MQTT Honeypot Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/mqtt.md This YAML snippet shows a basic configuration for enabling the MQTT honeypot service. Ensure this is part of your main dionaea configuration file. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: mqtt ``` -------------------------------- ### Log SQLite Handler Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/log_sqlite.md This is an example configuration for the log_sqlite ihandler. It specifies the path to the SQLite database file where incidents will be logged. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: log_sqlite config: file: "@DIONAEA_STATEDIR@/dionaea.sqlite" ``` -------------------------------- ### Build and Install udns Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Builds the udns library from source, copies the header and shared library to /opt/dionaea, and creates a symbolic link for libudns. ```bash wget http://www.corpit.ru/mjt/udns/old/udns_0.0.9.tar.gz tar xfz udns_0.0.9.tar.gz cd udns-0.0.9/ ./configure make shared cp udns.h /opt/dionaea/include/ cp *.so* /opt/dionaea/lib/ cd /opt/dionaea/lib ln -s libudns.so.0 libudns.so cd - ``` -------------------------------- ### Logging Configuration Examples Source: https://github.com/dinotools/dionaea/blob/master/doc/source/configuration.md Configure log file locations and message levels for Dionaea. Supports filtering by level and domain. ```ini errors.levels=warning,error ``` ```ini errors.levels=all,-debug ``` -------------------------------- ### Install REUSE Tool Source: https://github.com/dinotools/dionaea/blob/master/doc/source/contributing.md Install the REUSE compliance checking tool using pip. This is a prerequisite for running compliance checks. ```default $ pip install reuse ``` -------------------------------- ### Run Dionaea Instance with Docker Source: https://github.com/dinotools/dionaea/blob/master/docker/README.md Starts a Dionaea honeypot instance, exposing multiple ports for various services. Use this command to quickly launch a honeypot. ```console $ docker run --rm -it -p 21:21 -p 42:42 -p 69:69/udp -p 80:80 -p 135:135 -p 443:443 -p 445:445 -p 1433:1433 -p 1723:1723 -p 1883:1883 -p 1900:1900/udp -p 3306:3306 -p 5060:5060 -p 5060:5060/udp -p 5061:5061 -p 11211:11211 dinotools/dionaea ``` -------------------------------- ### Install Curl Module Library Source: https://github.com/dinotools/dionaea/blob/master/modules/curl/CMakeLists.txt Installs the built 'module_curl' library to the 'lib/dionaea' directory on the target system. This makes the module available for use by the Dionaea honeypot. ```cmake install( TARGETS module_curl LIBRARY DESTINATION lib/dionaea ) ``` -------------------------------- ### Fail2ban Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/fail2ban.md This YAML snippet shows how to configure Dionaea to use Fail2ban by specifying the paths to the downloads and offers files. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: fail2ban config: downloads: "@DIONAEA_STATEDIR@/fail2ban/downloads.f2b" offers: "@DIONAEA_STATEDIR@/fail2ban/offers.f2b" ``` -------------------------------- ### VirusTotal iHandler Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/virustotal.md Example configuration for the VirusTotal ihandler. Set your VirusTotal API key and specify the path for the SQLite cache file. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: virustotal config: # grab it from your virustotal account at My account -> My API Key (https://www.virustotal.com/en/user//apikey/) apikey: "........." file: "@DIONAEA_STATEDIR@/vtcache.sqlite" # comment: "This sample was captured in the wild and uploaded by the dionaea honeypot.\n#honeypot #malware #networkworm" ``` -------------------------------- ### TFTP Download Module Configuration Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/tftp_download.md This is an example configuration snippet for enabling the TFTP download module in Dionaea. Ensure this is part of your main dionaea.yaml configuration. ```yaml - name: tftp_download ``` -------------------------------- ### Log Incident Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/log_incident.md Example configuration for the log_incident ihandler, specifying a file handler to save incidents to a JSON file. Ensure the file path is correctly set. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: log_incident config: handlers: #- http://127.0.0.1:8080/ - file://@DIONAEA_STATEDIR@/dionaea_incident.json ``` -------------------------------- ### Run Dionaea with User, Group, and Paths Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Example of running Dionaea as a specific user and group, with specified working directory and PID file location. This is useful for security and process management. ```bash dionaea -u nobody -g nogroup -r /opt/dionaea/ -w /opt/dionaea -p /opt/dionaea/var/dionaea.pid ``` -------------------------------- ### MongoDB Module Configuration Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/mongo.md Example configuration for enabling the MongoDB honeypot module. Ensure the 'mongo' module is listed in your dionaea configuration. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: mongo ``` -------------------------------- ### Example submit_http_post Configuration Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/submit_http_post.md Configure the submit_http_post handler to upload files to multiple URLs. Specify field values and the filename for the uploaded file. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: submit_http_post config: submit: file_upload: urls: - http://example.org/upload - http://example.com/file.php field_values: submit: "Upload file" file_fieldname: upload_file ``` -------------------------------- ### Run pg_backend with database Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html This command starts the pg_backend module and stores events in a PostgreSQL database. You need to provide XMPP and database connection details. ```bash ./pg_backend.py -U USER@sensors.carnivore.it -P XMPPPASS -M dionaea.sensors.carnivore.it -C anon-files -C anon-events -s DBHOST -u DBUSER -d xmpp -p DBPASS -f /tmp/ ``` -------------------------------- ### Dionaea SIP Module Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/sip.md This YAML configuration sets up the SIP honeypot module, defining ports, user database path, RTP recording modes, and personalities. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: sip config: udp_ports: - 5060 tcp_ports: - 5060 tls_ports: - 5061 users: "@DIONAEA_STATEDIR@/sip/accounts.sqlite" rtp: enable: true # how to dump the rtp stream # bistream = dump as bistream modes: - bistream - pcap pcap: path: "@DIONAEA_STATEDIR@/sip/rtp/{personality}/%Y-%m-%d/" filename: "%H:%M:%S_{remote_host}_{remote_port}_in.pcap" personalities: default: domain: "localhost" name: "softphone" personality: "generic" # next-server: # domain: "my-domain" # name: "my server" # personality: "generic" # serve: ["10.0.0.1"] # default_sdp: "default" # handle: ["REGISTER", "INVITE", "BYE", "CANCEL", "ACK"] actions: bank-redirect: do: "redirect" params: play-hello: do: "play" params: file: "var/dionaea/.../file.ext" ``` -------------------------------- ### Configure and Build Python 3.2 Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Configures Python 3.2 for shared library support, installation at /opt/dionaea, and includes IPv6 support, specifying linker flags. ```bash ./configure --enable-shared --prefix=/opt/dionaea --with-computed-gotos \ --enable-ipv6 LDFLAGS="-Wl,-rpath=/opt/dionaea/lib/ -L/usr/lib/x86_64-linux-gnu/" make make install ``` -------------------------------- ### S3 Upload Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/s3.md Configure the S3 handler with AWS credentials, bucket name, region, and destination folder. Ensure your AWS credentials are kept secure. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: s3 config: # Upload dionaea captured samples to Amazon AWS S3 bucket # Amazon AWS S3 credentials access_key_id: "AKIAIXEXAMPLE" secret_access_key: "6WVE5LkETVL91nTKgGnm/YxJ+EXAMPLE" bucket_name: "my-dionaea-bucket" region_name: "eu-west-1" # Alternate endpoint URL # Normally Boto 3 will automatically construct appropriate URL # By default, we can leave this value to blank endpoint_url: # Whether or not to validate the S3 certificate verify: True # Specify the destination folder in S3 for the upload s3_dest_folder: "dionaea-capture/" ``` -------------------------------- ### Jinja Template Example for HTTP Service Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/http.md This Jinja template demonstrates how to create forms for GET and POST requests, including multipart/form-data for file uploads. It also shows how to display received GET and POST form values. ```jinja Demo

Form GET

Form POST

Form POST - multipart/form-data

Results

Get Values
{% for name, value in connection.request_fields|dictsort %}
{{ name }} = {{ value[0] }}
{% endfor %}
Form values
{% if connection.request_form %}
{% for name in connection.request_form.keys() %}
{% if connection.request_form[name].filename %}
{{ name }} = file with name '{{ connection.request_form[name].filename }}'
{% else %}
{{ name }} = {{ connection.request_form[name].value }}
{% endif %}
{% endfor %}
{% endif %}
        
``` -------------------------------- ### Configure Logging and Domains Source: https://github.com/dinotools/dionaea/blob/master/doc/source/run.md Examples demonstrating how to set logging levels and domains. Use comma-separated values for multiple settings and a '-' prefix to exclude specific levels or domains. Wildcards '*' and '?' can be used for domain matching. ```console # dionaea -l all,-debug -L '*' ``` ```console # dionaea -l all,-debug -L 'con*,py*' ``` -------------------------------- ### p0f Honeypot Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/p0f.md This YAML configuration snippet defines the p0f honeypot module. It specifies the connection path to the p0f socket, which should be started with the provided command. ```yaml - name: p0f config: # start p0f with # sudo p0f -i any -u root -Q /tmp/p0f.sock -q -l path: "un:///tmp/p0f.sock" ``` -------------------------------- ### SMB Service Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/smb.md This YAML configuration demonstrates how to set up an SMB service in dionaea. It includes options for generic settings, specific OS types, and defining shares with their properties like comment, path, and type. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: smb config: ## Generic setting ## # 1:"Windows XP Service Pack 0/1", # 2:"Windows XP Service Pack 2", # 3:"Windows XP Service Pack 3", # 4:"Windows 7 Service Pack 1", # 5:"Linux Samba 4.3.11" # os_type: 2 # Additional config # primary_domain: Test # oem_domain_name: Test # server_name: TEST-SERVER ## Windows 7 ## # native_os: Windows 7 Professional 7600 # native_lan_manager: Windows 7 Professional 6.1 # shares: # ADMIN$: # comment: Remote Admin # path: C:\\Windows # type: disktree # C$: # comment: Default Share # path: C:\\ # type: # - disktree # - special # IPC$: # comment: Remote IPC # type: ipc # Printer: # comment: Microsoft XPS Document Writer # type: printq ## Samba ## # native_os: Windows 6.1 # native_lan_manager: Samba 4.3.11 # shares: # admin: # comment: Remote Admin # path: \\home\\admin # type: disktree # share: # comment: Default Share # path: \\share # type: disktree # IPC$: # comment: Remote IPC # path: IPC Service # type: ipc # Printer: # comment: Printer Drivers # type: printq ``` -------------------------------- ### Install Dionaea Build Dependencies on Ubuntu Source: https://github.com/dinotools/dionaea/blob/master/doc/source/installation.md Install essential build dependencies for Dionaea on Ubuntu 18.04 LTS. Ensure 'ttf-liberation' is installed for 'util/gnuplotsql.py'. ```bash sudo apt-get install \ build-essential \ cmake \ check \ cython3 \ libcurl4-openssl-dev \ libemu-dev \ libev-dev \ libglib2.0-dev \ libloudmouth1-dev \ libnetfilter-queue-dev \ libnl-3-dev \ libpcap-dev \ libssl-dev \ libtool \ libudns-dev \ python3 \ python3-dev \ python3-bson \ python3-yaml \ python3-boto3 \ fonts-liberation ``` -------------------------------- ### Install PCAP Module Library Source: https://github.com/dinotools/dionaea/blob/master/modules/pcap/CMakeLists.txt Installs the compiled PCAP module library to the appropriate destination. ```cmake install( TARGETS module_pcap LIBRARY DESTINATION lib/dionaea ) ``` -------------------------------- ### Run Dionaea with Logging Options Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Examples of running Dionaea with specific logging levels and domains. Use '-l' for log levels and '-L' for log domains, supporting wildcards and exclusions. ```bash dionaea -l all,-debug -L '*' dionaea -l all,-debug -L 'con*,py*' ``` -------------------------------- ### PPTP Module Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/pptp.md This YAML snippet demonstrates the basic structure for configuring the PPTP honeypot module. It includes the module name and placeholders for device-specific emulation details, which can be uncommented and customized. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: pptp config: # Cisco PIX # firmware_revision: 4608 # hostname: # vendor_name: Cisco Systems # DrayTek # firmware_revision: 1 # hostname: Vigor # vendor_name: DrayTek # Linux # firmware_revision: 1 # hostname: local # vendor_name: linux # Windows # firmware_revision: 0 # hostname: # vendor_name: Microsoft # MikroTik router # firmware_revision: 1 # hostname: MikroTik # vendor_name: MikroTik ``` -------------------------------- ### SPDX License Identifiers Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/contributing.md Examples of SPDX license identifiers for source files. These are machine-parsable shorthands for licenses. ```text GPL-3.0+ : GNU General Public License v3.0 or later LGPL-2.0 : GNU Library General Public License v2 only LGPL-2.0+ : GNU Library General Public License v2 or later LGPL-2.1 : GNU Lesser General Public License v2.1 only LGPL-2.1+ : GNU Lesser General Public License v2.1 or later ``` -------------------------------- ### Install Cython for Python 3.2 Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Installs Cython version 0.15 using the Python 3.2 interpreter, required for Python 3.2 compatibility. ```bash wget http://cython.org/release/Cython-0.15.tar.gz tar xfz Cython-0.15.tar.gz cd Cython-0.15 /opt/dionaea/bin/python3 setup.py install cd .. ``` -------------------------------- ### GDB Python Macros Setup Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Instructions for setting up GDB Python macros by placing the gdbinit file in ~/.gdbinit. It also covers potential issues with permissions and running GDB with sudo. ```gdb break PyEval_EvalFrameEx ``` -------------------------------- ### Example Dionaea Log Entry Source: https://github.com/dinotools/dionaea/blob/master/doc/source/ihandler/log_sqlite.md This is an example of the log format produced by the log_sqlite handler, showing details of a network connection and subsequent exploit attempts. ```text connection 610 smbd tcp accept 10.69.53.52:445 <- 10.65.34.231:2010 dcerpc request: uuid '3919286a-b10c-11d0-9ba8-00c04fd92ef5' opnum 9 p0f: genre:'Windows' detail:'XP SP1+, 2000 SP3' uptime:'-1' tos:'' dist:'11' nat:'0' fw:'0' profile: [{'return': '0x7c802367', 'args': ['', 'CreateProcessA'], 'call': 'GetProcAddress'}, ...., {'return': '0', 'args': ['0'], 'call': 'ExitThread'}] service: bindshell://1957 connection 611 remoteshell tcp listen 10.69.53.52:1957 connection 612 remoteshell tcp accept 10.69.53.52:1957 <- 10.65.34.231:2135 p0f: genre:'Windows' detail:'XP SP1+, 2000 SP3' uptime:'-1' tos:'' dist:'11' nat:'0' fw:'0' offer: fxp://1:1@10.65.34.231:8218/ssms.exe download: 1d419d615dbe5a238bbaa569b3829a23 fxp://1:1@10.65.34.231:8218/ssms.exe connection 613 ftpctrl tcp connect 10.69.53.52:37065 -> 10.65.34.231/None:8218 connection 614 ftpdata tcp listen 10.69.53.52:62087 connection 615 ftpdata tcp accept 10.69.53.52:62087 <- 10.65.34.231:2308 p0f: genre:'Windows' detail:'XP SP1+, 2000 SP3' uptime:'-1' tos:'' dist:'11' nat:'0' fw:'0' ``` -------------------------------- ### Compare Configuration Files Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Compare the current dionaea.conf with the distribution's default configuration file to identify any changes or updates needed. ```bash diff dionaea.conf dionaea.conf.dist ``` -------------------------------- ### Configure FTP Service Source: https://context7.com/dinotools/dionaea/llms.txt Sets up the FTP service with a root directory for files and a custom welcome message. ```yaml # /opt/dionaea/etc/dionaea/services-enabled/ftp.yaml - name: ftp config: root: "/opt/dionaea/var/lib/dionaea/ftp/root" response_messages: welcome_msg: "220 DiskStation FTP server ready." ``` -------------------------------- ### FTP Service Configuration Example Source: https://github.com/dinotools/dionaea/blob/master/doc/source/service/ftp.md This YAML snippet shows how to configure the FTP service in Dionaea. It specifies the service name, the root directory for FTP operations, and custom welcome messages. ```yaml # SPDX-FileCopyrightText: none # SPDX-License-Identifier: CC0-1.0 - name: ftp config: root: "@DIONAEA_STATEDIR@/ftp/root" response_messages: welcome_msg: 220 DiskStation FTP server ready. ``` -------------------------------- ### Compile OpenSSL Source: https://github.com/dinotools/dionaea/blob/master/doc/html/index.html Compile OpenSSL from source, specifying shared libraries and installation prefix. Ensure all dependencies are compiled with the same SSL version. ```bash cvs -d anonymous@cvs.openssl.org:/openssl-cvs co openssl cd openssl ./Configure shared --prefix=/opt/dionaea linux-x86_64 make SHARED_LDFLAGS=-Wl,-rpath,/opt/dionaea/lib make install ```