Build your own RDP Honeypot
Tags: security, dfir, honeypot
Published: 2019-11-20 03:46:34

---
title: Build your own RDP Honeypot
published: true
date: 2019-11-20 01:46:08 UTC
tags: security,dfir,honeypot
canonical_url: https://medium.com/pythonic-forensics/build-your-own-rdp-honeypot-24c1687cb7e9
---

![Photo by Matthew T Rader on Unsplash](https://cdn-images-1.medium.com/max/972/1*KYlALfnVj5R13KQx68WhBA.jpeg)

This is a short post, largely inspired by [alt3kx](https://medium.com/u/7413f5a9ff32) and their awesome post here:

{% medium https://medium.com/@alt3kx/build-an-easy-rdp-honeypot-with-raspberry-pi-3-and-observe-the-infamous-attacks-as-bluekeep-29a167f78cc1 %}

Please go check it out!

Where this post differs is implementing on a Debian cloud instance of your choice and adding in email reporting. We will run through all the steps just to have a cohesive post, though most of the steps do mirror those in the aforementioned post.

## # Requirements

We will be setting up in a virtual/cloud-based environment. This has pros/cons (versus your own RaspberryPi or other hardware), though we can save that for the comments ;)

- Access to a Windows 2008 R2 server that you don’t mind making insecure temporarily. One option is to spin up an EC2 instance in a new security group just for this sole use. You can also use Azure/other platforms supporting Windows 2008 R2 images.
- A Debian based compute instance on your cloud hosting provider of choice. This will actually host our honeypot, so we will want to set this up separate from everything else. This guide won’t walk thru a hosting provider specific setup, as there are too many to cover. You will also want to ensure you have X11 forwarding configured over SSH.

## # Windows 2008 Setup

1. Spin up both your Windows 2008 R2.
2. RDP into the Windows 2008 R2 instance and disable “Network Level Authentication” ([this guide walks through the process](https://www.parallels.com/blogs/ras/disabling-network-level-authentication/#WS2008WS2008R2)).

## # Debian/Honeypot Setup

This setup has a few more stages:

### ## Installing and configuring RDPY

This honeypot will leverage the [GitHub project RDPY](https://github.com/citronneur/rdpy/), as it covers the tooling needed to setup an RDP listener on a Linux host. This can be installed using a Python 2.7 version of `pip`.

```
pip install rdpy
```

We will also need to install a few more tools using `apt install python-qt4 xauth screen freerdp2-x11`. You may need to install `pip` as well.

Once these are setup (and X11 forwarding is configured for your SSH session) we will generate the fake RDP prompt that will show on connection.

I recommend using screen for this part, though you can also open a second SSH connection to the host.

In one terminal, run the below command, where `1.1.1.1` is the IP address of your Windows 2008 R2 host:

```
rdpy-rdpymitm.py -o ./ 1.1.1.1
```

In the second terminal, we will use our xfreerdp client to connect to our MiTM proxy, providing the username Administrator and forcing the client not to use Network Level Authentication:

```
xfreerdp --no-nla -u Administrator 127.0.0.1
```

> In this case we do want to use the IP address `127.0.0.1`

A window should pop up and show the `xfreerdp` interface with a prompt to select a user account. There is no need to interact with the interface at this point and we can close out.

Feel free to use `ctrl-c` in the terminal with our MiTM script. You should see a new file in the same directory as the script, with the extension `rss`. This file contains a play back (which for bonus points you can view with `rdpy-rssplayer.py`) needed for the honeypot script.

> At this point we will want to use `screen` or `nohup` to start our honeypot and keep it running on disconnect (so we don’t have to keep our connection alive for the honeypot to remain up).

We can safely destroy our Windows 2008 R2 instance now and save on the cloud hosting fees!

Now we are ready to run the honeypot script, it is as simple as the below, where you provide the name of your RSS file as the only argument:

```
rdpy-rdpyhoneypot.py \*.rss
```

Congrats! The honeypot is live!

# ## Getting intel out of your honeypot

This next step is where we can automate a few tasks to send reports to our mailbox.

To start, we will want a few tools to capture, process, and report on the activity. Let’s install them:

```
apt install tcpdump bro bro-aux zip
```

We first will use tcpdump to capture all traffic on TCP/3389 into a PCAP file:

```
tcpdump tcp port 3389 -i eth0 -vvX -w ‘rdp.%FT%H-%M-%S.pcap’ -C 500 -G 86400 -W 10
```

> Please sub in your own interface (ie eth0) and file naming convention. For full details on [this tcpdump command line, check ExplainShell](https://explainshell.com/explain?cmd=tcpdump+tcp+port+3389+-i+eth0+-vvX+-w+%27rdp.%25FT%25H-%25M-%25S.pcap%27+-C+500+-G+86400+-W+10). This capture should also run as an admin in a screen or `nohup` session to prevent it closing on disconnect. Neither of these solutions will assist in the case of a reboot.

Now we can move to our report generation! For this, we will use bro to generate easy to consume logs from the PCAP files. We will then take these logs and create a summary report that we send via email. This is all possible in the below script (please modify as you see fit!)

{% gist https://gist.github.com/chapinb/dffb48fcd2f7a290d39c5c8da25c97ce %}

> You will need to sub in your own information for Mailgun if you want to use that API, otherwise feel free to plug in your own email sending routine.

Now that we have the script setup, we can create a cron job to run it for us daily and fill our inbox with a summary of what we caught in our honeypot!

Please play around with this configuration and fine tune further to your liking. If possible, please share back to the community!

* * *