Customizing Honeypots

Customizing the behavior of some honeypots can be achieved by modifying the default configuration features and adding custom files to your honeypot deployments.

The 2 most common honeypots to customize are Cowrie & Dionaea.

Cowrie customization

For more details on customization options for Cowrie visit : https://docs.cowrie.org/en/latest/README.html

Modifying Cowrie login banners:

The pre-login banner can be set by creating the file honeyfs/etc/issue.net. The post-login banner can be customized by editing honeyfs/etc/motd.

Dionaea custom Config

You can customize the behaviour of Dionaea by enabling different services, files and ports. Common service are enabling smb file sharing on port 445 and modifying the defaul html page it displays.

For more details on configuring Dionaea visit : https://dionaea.readthedocs.io/en/latest/configuration.html

You will need to mount volumes on your honeypot host file system that map into specific locations of Dionaea (see this example docker-compose.yml for how this is done):

version: '3.0'
services:
  dionaea:
    depends_on:
    - fluentbit
    env_file: stingar-hp.env
    image: 4warned/dionaea
    links:
    - fluentbit:fluentbit
    ports:
    - 21:21
    - 80:80
    - 1883:1883
    - 1433:1433
    - 3306:3306
    - 1723:1723
    - 5060:5060
    - 445:445
    - 69:69
    - 1900:1900
    volumes:
    - ./volumes/config:/opt/dionaea/etc/dionaea/services-enabled
    - ./volumes/html:/opt/dionaea/var/dionaea/roots/www
    - ./volumes/share:/my_share/
  fluentbit:
    env_file: stingar-hp.env
    image: 4warned/fluentbit
    ports:
    - 127.0.0.1:24284:24284
    - 127.0.0.1:24284:24284/udp

and the local directories contain the following files:

volumes/config:
total 44
-rw-rw-r-- 1 azureuser azureuser  224 Nov 21 14:37 ORIG_smb.yaml
-rw-rw-r-- 1 azureuser azureuser  240 Nov 20 21:15 blackhole.yaml
-rw-rw-r-- 1 azureuser azureuser  143 Nov 20 21:14 ftp.yaml
-rw-rw-r-- 1 azureuser azureuser 1071 Nov 21 13:10 http.yaml
-rw-rw-r-- 1 azureuser azureuser   15 Nov 20 21:14 mssql.yaml
-rw-rw-r-- 1 azureuser azureuser  315 Nov 20 21:13 mysql.yaml
-rw-rw-r-- 1 azureuser azureuser  452 Nov 20 21:13 pptp.yaml
-rw-rw-r-- 1 azureuser azureuser  964 Nov 20 21:13 sip.yaml
-rw-rw-r-- 1 azureuser azureuser  575 Nov 21 14:38 smb.yaml
-rw-rw-r-- 1 azureuser azureuser   69 Nov 20 21:11 tftp.yaml
-rw-rw-r-- 1 azureuser azureuser 1566 Nov 20 21:11 upnp.yaml

volumes/html:
total 8
-rw-rw-r-- 1 azureuser azureuser 5076 Nov 21 13:38 index.html

volumes/share:
total 4
-rw-rw-r-- 1 azureuser azureuser 27 Nov 20 20:38 payroll1124.csv

where smb.yaml contains:

- name: smb
  config:
    os_type: 4
    native_os: Windows 7 Professional 7600
    native_lan_manager: Windows 7 Professional 6.1
    shares:
      ADMIN$:
        comment: Remote Admin
        path: C:\\Windows
        type: disktree
      C$:
        comment: Default Share
        path: C:\\
        type:
          - disktree
          - special
      IPC$:
        comment: Remote IPC
        type: ipc
      Printer:
        comment: Microsoft XPS Document Writer
        type: printq
    my_share:
      comment: my_share
      path: \\my_share
      type: disktree

and html.yaml contains:

- name: http
  config:
    root: "/opt/dionaea/var/dionaea/roots/www"
    ports:
      - 80
    ssl_ports:
      - 443
    max_request_size: 32768 # maximum size in kbytes of the request (32MB)
    global_headers:
      - ["Server", "NGiNX"]
    headers:
      - filename_pattern: ".*\\.php"
        headers:
          - ["Content-Type", "text/html; charset=utf-8"]
          - ["Content-Length", "{content_length}"]
          - ["Connection", "{connection}"]
          - ["X-Powered-By", "PHP/5.5.9-1ubuntu4.5"]
    # soap_enabled: false
    template:
      # set to true to enable template processing
      # this feature requires jinja2 template engine http://jinja.pocoo.org/
      enabled: false
      file_extension: .j2
      path: "/opt/dionaea/var/dionaea/share/python/http/template/nginx"
      templates:
        autoindex:
          filename: autoindex.html.j2
        error_pages:
          - filename: error.html.j2
          # - filename: error/{code}.html.j2
      # used to specify additional template values
      values:
        # full_name: nginx/1.1

For more information about customizing Dionaea see here : https://communityhoneynetwork.readthedocs.io/en/stable/dionaea/ And more examples here : https://github.com/CommunityHoneyNetwork/dionaea/tree/master/personalities/debian

Dionaea CPU usage 100%

Dionaea takes 100% available CPU cycles when running inside docker container. To limit the amount of CPU cycles you can modify the docker-compose.yml file to add the cpu_period and cpu_quote values to define the ratio & hence % cpu usage allocation to the container e.g. inside the docker-compose.yml file you can define cpu_period as 50000 ms and cpu_quota as 10000 (i.e. 20%)

version: 2.4
dionaea:
    depends_on:
    - fluentbit
    env_file: stingar-hp.env
    image: 4warned/dionaea
    cpu_period: 50000
    cpu_quota: 10000
    links:
    - fluentbit:fluentbit 
    ports:
    - '21:21'
    - 80:80
    - 1883:1883
    - 1433:1433
    - 3306:3306
    - 1723:1723
    - 5060:5060
    - 445:445
    - 69:69
    - 1900:1900

For more details on docker-compose usage see : https://medium.com/codex/how-to-limit-cpu-and-memory-usage-in-docker-containers-a024b429f55e#:~:text=CPU%20limits%20can%20be%20set,to%20use%20in%20that%20period. OR for more recent versions of docker-compose

version: '3.8'
    services:
      dionaea:
        image: 4warned/dionaea:latest
        deploy:
          resources:
            limits:
              cpu: '0.5' # Equivalent to 50% CPU
        # other configurations