Hack Like a Pro: Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 1 « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!The Holy Grail of any hacker is to develop azero-day exploit—an exploit that has never been seen by antivirus (AV) and other software developers, as well as intrusion detection system (IDS) developers. In that way, you can exploit systems with your newly discovered vulnerability with impunity!To get a zero-day, you have at least two choices: develop your own or capture someone else's.Developing your own can be a long and tedious process and requires significant knowledge of assembler, fuzzing, shellcode, etc. The process can take take thousands of man days. Cybercrime gangs and spying governments invest millions of dollars to develop zero-days, but in some rare cases, individuals manage to develop zero-days with little effort, especially for legacy systems. (The zero-daythat hacked Target two years agowas developed by a 17-year-old hacker in Russia, but it targeted Windows XP, which Target was still using on their point-of-sale systems).The other approach is to capture a zero-day that others have developed and reuse it. Rememberthe Hacking Team exploitsthat were released when Hacking Team was hacked? This approach has long been used by AV developers,forensic investigatorsand, in some cases, hackers.What we want to do inthis seriesis install and configure a honeypot that appears both vulnerable and realistic. Then, we wait for it to lure attackers in and then capture their malware when they have successfully compromised our system.If we are a forensic investigator, we can then analyze the malware and maybe develop a defense or signature. If we are a hacker, we may be able to reuse the malware on other systems. In some cases, we may need to re-engineer the malware for other purposes, but that is still much faster and more efficient than starting from scratch. The key is to be able to capture the malware first.DionaeaDionaeawas developed by Markus Koetter as a low-interaction honeypot. It emulates a vulnerable Windows systems with services often targeted by attackers such as HTTP, FTP, SSH, SMB, etc. It is written in C, but uses Python to emulate various protocols to entice attackers.Dionaeais named after the genus of plants that includes the carnivorousVenus flytrap. I think the symbolism is apparent.Probably most important, it uses Libemu to detect shellcode and can alert us of the shellcode and capture it. Dionaea sends real-time notification of attacks via XMPP and then logs the information into a SQLite database.LibemuLibemu is a library used for x86 emulation as well as shellcode detection, which is perfect for our honeypot here. It can pull malware off the wire or inside documents (PDF, RTF, etc.) that we can then use to analyze for malicious behavior using heuristics.This is a relatively advanced honeypot and should not be attempted by the novice. In addition, I strongly suggest that you NOT use it on a system that will be used for other purposes as we will be installing libraries and other code that may disable other parts of your system.In addition, Dionaea is meant to be vulnerable. This means if it is compromised, your entire system may be compromised. You should use a clean install, preferably a Debian or Ubuntu system. I will be using a clean install of Ubuntu 14.04.Step 1: Install DependenciesDionaea is a complex piece of software and requires numerous dependencies that are not usually installed on Ubuntu or other Debian distributions. As a result, we will need to install the dependencies before installing and configuring Dionaea. This can be a long and tedious task.For instance, to begin we need to download the following packages.ubuntu > apt-get install libudns-dev libglib2.0-dev libssl-dev libcurl4-openssl-dev libreadline-dev libsqlite3-dev python-dev libtool automake autoconf build-essential subversion git-core flex bison pkg-config libnl-3-dev libnl-genl-3-dev libnl-nf-3-dev libnl-route-3-dev sqlite3Fortunately,Andrew Michael Smithhas developed a script that does all the heavy lifting for us. We can download his script from GitHub usingwget.ubuntu > wget -qhttps://raw.github.com/andrewmichaelsmith/honeypot-setup-script/master/setup.bash-O /tmp/setup.bash && bash /tmp/setup.bashThis script will download and install all of the dependencies (there are many) and applications (p0f, SQLite, and others), then download and install and configure Dionaea.Be patient here, this can take quite awhile.Step 2: Choose an InterfaceAfter downloading all of the applications and dependencies, Dionaea will begin to configure itself and ask you to choose the network interface you want the honeypot to listen on. Here, I chose eth0, but yours may be different.Eventually, the downloading and installing will complete and you will be greeted by a screen like below telling you thatp0fand Dionaea have started.Step 3: Test the InstallOnce the above process has been completed, we can check to see whether Dionaea has been properly and completely installed by typing:ubuntu > dionaea -helpIf the help screen seen above appears, you have successfully installed Dionaea. Congratulations!Configuring DionaeaNow our honeypot is up and running. Infuture tutorials in this series, I will show you how to set up Dionaea to alert you in real time of attacks, how to identify the particulars of the attackers (OS, IP, browser, interface), and how to capture and analyze the shellcode of the attack.Then, we will test our honeypot usingMetasploitand other attack tools to see whether it can actually capture malware before placing it live online. So keep coming back, my greenhorn hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover images via Shutterstock (1,2)RelatedHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 2 (Configuration)News:The DEA Spent $575,000 of Your Tax Dollars on Zero-Day ExploitsHow To:Use the Cowrie SSH Honeypot to Catch Attackers on Your NetworkNews:How Zero-Day Exploits Are Bought & SoldHack Like a Pro:How to Build Your Own Exploits, Part 1 (Introduction to Buffer Overflows)Hack Like a Pro:How to Set Up a Honeypot & How to Avoid ThemHack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitNews:How Governments Around the World Are Undermining Citizens' Privacy & Security to Stockpile CyberweaponsHack Like a Pro:How to Build Your Own Exploits, Part 2 (Writing a Simple Buffer Overflow in C)How To:Draw Zero No Louise of Zero No TsukaimaHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPNews:Chrysaor Malware Found on Android Devices—Here's What You Should Know & How to Protect YourselfHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)How To:The Art of 0-Day Vulnerabilities, Part 1: STATIC ANALYSISHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerNews:Hackers Claim 1$ Million Bounty for Security Flaw in iOS 9Red Dead Redemption Review:5 out of 5News:Day 2 Of Our New WorldNews:Wild West ThemeHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterEkokook:The Kitchen of the FutureMortal Kombat:Legacy: Ep. 8: Scorpion and Sub Zero (Part 2)Mortal Kombat:Legacy: Ep. 7: Scorpion and Sub Zero (Part 1)News:Wild Mustang Problems?News:Slow Motion Footage of Surfers from Jaws Beach, HawaiiNews:Mystery Game ContentsNews:Countdown to ZeroHow To:Use Internet Explorer? Install the Latest Version to Avoid the Newest Zero-Day ExploitHow To:Survive Deadly Bites and Stings from Wild Animals