You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@mina.apache.org by Ioan Eugen Stan <st...@gmail.com> on 2013/01/24 11:22:27 UTC
ssh honey pot - tamper with commands
Hello,
I'm working on a SSH Honeypot and using SSHD as a server. I need help
figuring out how can I have for example command completion and the
ability to tamper with some commands (choose between executing,
delaying or faking their execution - not running them and returning
some other data)
Right now I managed to create a server that can execute commands and
can open a Shell connection where I can type in commands. The server
echoes them back but does not display them.
I know it's possible, but the lack of documentation is killing me so
any help is appreciated.
Cheers,
--
Ioan Eugen Stan
Re: ssh honey pot - tamper with commands
Posted by Ioan Eugen Stan <st...@gmail.com>.
Hello again,
Your discussion and some research led me to a possible solution. It
seems I can call bash autocomplete commands: compgen and complete to
generate the completions [1], [2].
For example, running $ compgen -c "gre" return the following
completions for commands tarting with "gre":
gresource
grepjar
greytiff
grep
The algorithm for bash is a bit more involved and explained in detail here [2]
So now all I have to do is:
- create the shell with jline
- intercept the auto-complete sequence (two TAB)
- execute (on another shell maybe) compgen -c "command entered so far"
and return the output properly formatted.
Cheers,
[1] http://www.debian-administration.org/article/An_introduction_to_bash_completion_part_2
[2] http://www.gnu.org/software/bash/manual/bash.html#Programmable-Completion
[3] http://www.debian-administration.org/articles/316
[4] https://sixohthree.com/867/bash-completion
--
Ioan Eugen Stan / CTO / http://axemblr.com
Re: ssh honey pot - tamper with commands
Posted by Guillaume Nodet <gn...@gmail.com>.
Yeah, you can reuse or rewrite jline, which is the real purpose of that
library ;-)
It does implement Ctrl+R amongst other things, so there should be no
problem to intercept those if you want.
Fwiw, key bindings depends on bash configuration, so you need to read the
~/.inputrc to read the correct bindings.
On Thu, Jan 24, 2013 at 2:21 PM, Ioan Eugen Stan <st...@gmail.com>wrote:
> Hello Guillaume,
>
> The idea is to mimic a real shell experience to fool the attacker into
> thinking he's on a real shell. This kind of excludes implementing a
> delegate for each command.
>
> I'll try to trigger completion myself. By the way, I think the biggest
> issue is to mimic/register all the character codes that the shell
> (bash in this case) has like Meta /, or Ctrl R for reverse search.
> This is to make the experience very similar.
>
> Take for example: insert-completions built-in [1] triggered by
> pressing (M-*) .
>
> Any ideas how I can intercept characters codes generated wit Control
> or Meta and react to them?
>
> Thanks,
>
> [1]
> http://www.gnu.org/software/bash/manual/bashref.html#Commands-For-Completion
>
> Thanks,
> --
> Ioan Eugen Stan / CTO / http://axemblr.com
>
--
------------------------
Guillaume Nodet
------------------------
Blog: http://gnodet.blogspot.com/
------------------------
FuseSource, Integration everywhere
http://fusesource.com
Re: ssh honey pot - tamper with commands
Posted by Ioan Eugen Stan <st...@gmail.com>.
Hello Guillaume,
The idea is to mimic a real shell experience to fool the attacker into
thinking he's on a real shell. This kind of excludes implementing a
delegate for each command.
I'll try to trigger completion myself. By the way, I think the biggest
issue is to mimic/register all the character codes that the shell
(bash in this case) has like Meta /, or Ctrl R for reverse search.
This is to make the experience very similar.
Take for example: insert-completions built-in [1] triggered by
pressing (M-*) .
Any ideas how I can intercept characters codes generated wit Control
or Meta and react to them?
Thanks,
[1] http://www.gnu.org/software/bash/manual/bashref.html#Commands-For-Completion
Thanks,
--
Ioan Eugen Stan / CTO / http://axemblr.com
Re: ssh honey pot - tamper with commands
Posted by Guillaume Nodet <gn...@gmail.com>.
It's theorically doable, but really tricky. The reason is that you have to
duplicate line editing in java the same way the native shell will, else
you'll end up with a different command line. Let's take an exmple: the
user enter <g> <i> <t> <home> <del> <del> <c> <a>
You need to make sure, your java buffer actually contains <cat> and not
<gitca> for example.
It's really not easy, and that's what jline does, but making sure your
native shell *and* jline behave exactly the same is ... tricky.
If you have a limited and known set of commands, I don't see why you would
not go full jline. If you don't and want to add some smart things to your
shell, I'd really recommend using shell scripts for that. Mixing both it
imho not the right thing to do.
On Thu, Jan 24, 2013 at 12:34 PM, Ioan Eugen Stan <st...@gmail.com>wrote:
> Hello,
>
> Darn, I wished it was easier. I managed to get a 'dumb' Karaf Dhell up
> and running by passing a org.apache.karaf.shell.ssh.ShellFactoryImpl
> to the server [1], [2].
> Like you said, I should delegate all commands except for the ones that
> on the 'Fake List' which will be treated separately.
>
> But I still wonder if I could delegate command completion to the
> native shell somehow, maybe in the background. I mean, command
> completion is done when the user sends some text followed by two TAB
> characters. At that point the shell responds with some text. I guess
> I'll use a native interactive shell and run some experiments.
>
> Wish me luck and ping me if you get some ideas.
>
> Cheers,
>
> [1]
> https://github.com/apache/karaf/blob/trunk/shell/ssh/src/main/resources/OSGI-INF/blueprint/shell-ssh.xml
> [2]
> https://github.com/apache/karaf/blob/trunk/shell/console/src/test/java/org/apache/karaf/shell/console/ExampleSubclassMain.java
>
>
> On Thu, Jan 24, 2013 at 1:11 PM, Guillaume Nodet <gn...@gmail.com> wrote:
> > If I understand you correcly, you're trying to launch a native shell, but
> > have some kind of pre-processing of commands in java.
> > The problem is that there's no way afaik to get back from the native
> shell
> > to the sshd environement.
> > I guess you could customize your native shell to some point to do some of
> > the processing in scripts, like creating bash functions that will act as
> > proxy to the native commands and do your ignore/execute logic there.
> > Else, I'd really suggest using jline as the shell and implement jline
> > commands that would then delegate to native commands.
> >
> >
> >
> > On Thu, Jan 24, 2013 at 11:37 AM, Ioan Eugen Stan <stan.ieugen@gmail.com
> >wrote:
> >
> >> Hello Guillaume,
> >>
> >> Thank you for your quick response and the pointers. I know SSHD does
> >> not aim at providing an interactive shell, but I'm not planning to
> >> re-implement it myself also. Is it possible for example to delegate
> >> all characters to the native shell and on new-line to decide one of
> >> the two:
> >>
> >> - if the command entered so far is not to be executed then drop it
> >> silently and return fake output to the user
> >> - if the command should be executed - forward the newline to the
> >> native, interactive shell
> >>
> >> This should avoid the need for re-implementing the commands and
> >> command completers and leverage the native shells command completing
> >> capabilities. Is this ok?
> >>
> >> By the way, you did incredible work on SSHD and jline.
> >>
> >> Cheers,
> >>
> >> --
> >> Ioan Eugen Stan / CTO / http://axemblr.com
> >>
> >
> >
> >
> > --
> > ------------------------
> > Guillaume Nodet
> > ------------------------
> > Blog: http://gnodet.blogspot.com/
> > ------------------------
> > FuseSource, Integration everywhere
> > http://fusesource.com
>
>
>
> --
> Ioan Eugen Stan / CTO / http://axemblr.com
>
--
------------------------
Guillaume Nodet
------------------------
Blog: http://gnodet.blogspot.com/
------------------------
FuseSource, Integration everywhere
http://fusesource.com
Re: ssh honey pot - tamper with commands
Posted by Ioan Eugen Stan <st...@gmail.com>.
Hello,
Darn, I wished it was easier. I managed to get a 'dumb' Karaf Dhell up
and running by passing a org.apache.karaf.shell.ssh.ShellFactoryImpl
to the server [1], [2].
Like you said, I should delegate all commands except for the ones that
on the 'Fake List' which will be treated separately.
But I still wonder if I could delegate command completion to the
native shell somehow, maybe in the background. I mean, command
completion is done when the user sends some text followed by two TAB
characters. At that point the shell responds with some text. I guess
I'll use a native interactive shell and run some experiments.
Wish me luck and ping me if you get some ideas.
Cheers,
[1] https://github.com/apache/karaf/blob/trunk/shell/ssh/src/main/resources/OSGI-INF/blueprint/shell-ssh.xml
[2] https://github.com/apache/karaf/blob/trunk/shell/console/src/test/java/org/apache/karaf/shell/console/ExampleSubclassMain.java
On Thu, Jan 24, 2013 at 1:11 PM, Guillaume Nodet <gn...@gmail.com> wrote:
> If I understand you correcly, you're trying to launch a native shell, but
> have some kind of pre-processing of commands in java.
> The problem is that there's no way afaik to get back from the native shell
> to the sshd environement.
> I guess you could customize your native shell to some point to do some of
> the processing in scripts, like creating bash functions that will act as
> proxy to the native commands and do your ignore/execute logic there.
> Else, I'd really suggest using jline as the shell and implement jline
> commands that would then delegate to native commands.
>
>
>
> On Thu, Jan 24, 2013 at 11:37 AM, Ioan Eugen Stan <st...@gmail.com>wrote:
>
>> Hello Guillaume,
>>
>> Thank you for your quick response and the pointers. I know SSHD does
>> not aim at providing an interactive shell, but I'm not planning to
>> re-implement it myself also. Is it possible for example to delegate
>> all characters to the native shell and on new-line to decide one of
>> the two:
>>
>> - if the command entered so far is not to be executed then drop it
>> silently and return fake output to the user
>> - if the command should be executed - forward the newline to the
>> native, interactive shell
>>
>> This should avoid the need for re-implementing the commands and
>> command completers and leverage the native shells command completing
>> capabilities. Is this ok?
>>
>> By the way, you did incredible work on SSHD and jline.
>>
>> Cheers,
>>
>> --
>> Ioan Eugen Stan / CTO / http://axemblr.com
>>
>
>
>
> --
> ------------------------
> Guillaume Nodet
> ------------------------
> Blog: http://gnodet.blogspot.com/
> ------------------------
> FuseSource, Integration everywhere
> http://fusesource.com
--
Ioan Eugen Stan / CTO / http://axemblr.com
Re: ssh honey pot - tamper with commands
Posted by Guillaume Nodet <gn...@gmail.com>.
If I understand you correcly, you're trying to launch a native shell, but
have some kind of pre-processing of commands in java.
The problem is that there's no way afaik to get back from the native shell
to the sshd environement.
I guess you could customize your native shell to some point to do some of
the processing in scripts, like creating bash functions that will act as
proxy to the native commands and do your ignore/execute logic there.
Else, I'd really suggest using jline as the shell and implement jline
commands that would then delegate to native commands.
On Thu, Jan 24, 2013 at 11:37 AM, Ioan Eugen Stan <st...@gmail.com>wrote:
> Hello Guillaume,
>
> Thank you for your quick response and the pointers. I know SSHD does
> not aim at providing an interactive shell, but I'm not planning to
> re-implement it myself also. Is it possible for example to delegate
> all characters to the native shell and on new-line to decide one of
> the two:
>
> - if the command entered so far is not to be executed then drop it
> silently and return fake output to the user
> - if the command should be executed - forward the newline to the
> native, interactive shell
>
> This should avoid the need for re-implementing the commands and
> command completers and leverage the native shells command completing
> capabilities. Is this ok?
>
> By the way, you did incredible work on SSHD and jline.
>
> Cheers,
>
> --
> Ioan Eugen Stan / CTO / http://axemblr.com
>
--
------------------------
Guillaume Nodet
------------------------
Blog: http://gnodet.blogspot.com/
------------------------
FuseSource, Integration everywhere
http://fusesource.com
Re: ssh honey pot - tamper with commands
Posted by Ioan Eugen Stan <st...@gmail.com>.
Hello Guillaume,
Thank you for your quick response and the pointers. I know SSHD does
not aim at providing an interactive shell, but I'm not planning to
re-implement it myself also. Is it possible for example to delegate
all characters to the native shell and on new-line to decide one of
the two:
- if the command entered so far is not to be executed then drop it
silently and return fake output to the user
- if the command should be executed - forward the newline to the
native, interactive shell
This should avoid the need for re-implementing the commands and
command completers and leverage the native shells command completing
capabilities. Is this ok?
By the way, you did incredible work on SSHD and jline.
Cheers,
--
Ioan Eugen Stan / CTO / http://axemblr.com
Re: ssh honey pot - tamper with commands
Posted by Guillaume Nodet <gn...@gmail.com>.
SSHD does not provide an interactive shell you can use and does not really
aim to do so anyway.
I would have a look at jline2, it's the one we use in Karaf. Jline
provides completion, history, key bindings, etc...
ROughly, you need to create a jline ConsoleReader by using the streams
provided by SSHD and then configure it by registering commands, completers,
etc...
I'd suggest you have a look at Karaf, and then eventually grab some of its
code if you don't want OSGi at all, but the easiest would surely to just
reuse Karaf.
On Thu, Jan 24, 2013 at 11:22 AM, Ioan Eugen Stan <st...@gmail.com>wrote:
> Hello,
>
> I'm working on a SSH Honeypot and using SSHD as a server. I need help
> figuring out how can I have for example command completion and the
> ability to tamper with some commands (choose between executing,
> delaying or faking their execution - not running them and returning
> some other data)
>
> Right now I managed to create a server that can execute commands and
> can open a Shell connection where I can type in commands. The server
> echoes them back but does not display them.
>
> I know it's possible, but the lack of documentation is killing me so
> any help is appreciated.
>
> Cheers,
> --
> Ioan Eugen Stan
>
--
------------------------
Guillaume Nodet
------------------------
Blog: http://gnodet.blogspot.com/
------------------------
FuseSource, Integration everywhere
http://fusesource.com