Hack Like a Pro: Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 2 (Configuration) « Null Byte :: WonderHowTo

Welcome back, my rookie hackers!The Golden Fleece of hackers is to develop a zero-day exploit, an exploit that has not been seen by antivirus (AV) software or and intrusion detection system (IDS). A zero-day exploit is capable of skating right past these defenses as they do not contain a signature or another way of detecting them.Developing a zero-day can be tedious and time-consuming and is not for the novice. It usually involves finding a buffer that can be overflowed, then writing the code that overflows the buffer, and taking control of the execution so that your malicious software is run. Not a simple task.An alternative, of course, is to capture a zero-day exploit. Criminal hackers and national governments are always developing new zero-day exploits in order steal credit card numbers, confidential information, or national secrets. If we can convince those entities that our system is both importantandvulnerable, they will likely attack it as well. When they do, we may be able to capture their exploit and reuse it. Some of these exploits are worth millions of dollars.Inthe first partofthis series, we downloaded and set up the Dionaea honeypot. What makes Dionaea different than other honeypots is its ability to capture exploits.We had set up the honeypot in the last guide, but we had yet to configure it. In this tutorial, we will configure Dionaea to prepare it for capturing exploits. I began this seres setting up Dionaea on an Ubuntu 14.04 desktop system, so we will continue to use Dionaea on Ubuntu—but Dionaea will run on many Linux distributions.Step 1: Open the Dionaea Configuration FileThe first step is to open the Dionaea configuration file. First navigate to the/etc/dionaeadirectory.ubuntu > cd /etc/dionaeaWhen you do a long listing on that directory, you can see thedionaea.conffile. Let's open that file with a text editor. On Ubuntu, we have several choices. In this case, I used Leafpad, but gedit, Vim, or any other text editor will work.ubuntu > leafpad dionaea.confStep 2: Configure LoggingIn its default configuration, Dionaea will create shiploads of logs in a production environment. In some cases, you will see multiple gigabytes per day of log files. To prevent that, we need to configure logging to only log "error" priorities and above level. (For more information on Linux logging, seemy Linux Basics articleon the topic.)To do so, we need to navigate down to the logging section of the configuration file. There you will see a section that looks like this:Note the two areas I have circled. Change both of them from "warning,error" to just "error".Step 3: Interface and IP SectionNext, navigate down to thelistenandinterfacesection of the configuration file. We want the interface to be set to "manual" and the IP addresses set to any. This will allow Dionaea to capture on the interface of your choice (eth0) no matter what IP address is assigned to it.If you want Dionaea to only listen on a single IP address, you can place that IP address in the line below, replacing the "::" part.addrs = {eth0 = "::"}As you know, "::" is IPv6 shorthand for any IP address.Step 4: ModulesNext, we need to tell Dionaea what modules we want it to run.Leave the default setting here, but note that we have "virustotal" commented out. If the comments are removed, you can configure Dionaea to send any captured malware to VirusTotal. Let's keep it commented out.Also note that we will be using one of our favorite tools,p0f, for the operating system fingerprinting. Lastly, we have "logsql" uncommented, enabling Dionaea to create and use an SQLite database. This will enhance our ability to manage the activity from our sensor by placing the data into a SQLite database.Step 5: ServicesJust below the modules, we have a section detailing the services we want to run. Note below that Dionaea by default is set up to run http, https, tftp, ftp, mirror, smb, epmap, sip, mssql, and mysql.I recommend that you disable http and https as they are not likely to fool many attackers and may, in fact, identify it as a honeypot. Leave the others as they represent vulnerable services that may be attacked.Step 6: Start Dionaea to TestFinally, to test our new configuration we need to run Dionaea. We can do this by typing:ubuntu> dionaea -u nobody -g nogroup -w /opt/dionaea -p /opt/dionaea/run/dionaea.pidNow that Dionaea is running successfully, we can go to the next step, capturing and analyzing malware with Dionaea—so keep coming back, my rookie hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 1News:The DEA Spent $575,000 of Your Tax Dollars on Zero-Day ExploitsHow To:Use the Cowrie SSH Honeypot to Catch Attackers on Your NetworkNews:How Zero-Day Exploits Are Bought & SoldHack Like a Pro:How to Set Up a Honeypot & How to Avoid ThemHack Like a Pro:How to Build Your Own Exploits, Part 1 (Introduction to Buffer Overflows)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitNews:How Governments Around the World Are Undermining Citizens' Privacy & Security to Stockpile CyberweaponsHack Like a Pro:How to Build Your Own Exploits, Part 2 (Writing a Simple Buffer Overflow in C)How To:Draw Zero No Louise of Zero No TsukaimaHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)News:Chrysaor Malware Found on Android Devices—Here's What You Should Know & How to Protect YourselfHow To:Set Up Kali Linux on the New $10 Raspberry Pi Zero WHow To:The Art of 0-Day Vulnerabilities, Part 1: STATIC ANALYSISHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Hack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerRed Dead Redemption Review:5 out of 5News:Day 2 Of Our New WorldNews:Wild West ThemeHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterEkokook:The Kitchen of the FutureMortal Kombat:Legacy: Ep. 8: Scorpion and Sub Zero (Part 2)Mortal Kombat:Legacy: Ep. 7: Scorpion and Sub Zero (Part 1)News:Wild Mustang Problems?How To:Use Internet Explorer? Install the Latest Version to Avoid the Newest Zero-Day ExploitNews:Slow Motion Footage of Surfers from Jaws Beach, HawaiiNews:Mystery Game ContentsNews:Countdown to ZeroHow To:Survive Deadly Bites and Stings from Wild Animals