Alex-Devera/tpotce
1
0
Fork 0
mirror of https://github.com/telekom-security/tpotce.git synced 2025-07-01 12:32:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Begin of restructuring ...

Browse source 
- tweaking before re-work tpotinit
This commit is contained in:
Marco Ochse 2023-06-14 02:17:09 +02:00
parent ecb1dcd338
commit 050c898149
5 changed files with 72 additions and 102 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
docker/tpotinit/Dockerfile
View file

@ -17,6 +17,7 @@ RUN apk --no-cache -U add \
grep \ grep \
iproute2 \ iproute2 \
iptables \ iptables \
iptables-legacy \
jq \ jq \
logrotate \ logrotate \
lsblk \ lsblk \
@ -33,17 +34,6 @@ RUN apk --no-cache -U add \
adduser -S -s /bin/ash -u 2000 -D -g 2000 tpot && \ adduser -S -s /bin/ash -u 2000 -D -g 2000 tpot && \
# #
# Install tpot # Install tpot
#sed -i "s#/opt/tpot/etc/logrotate/status#/data/tpot/etc/logrotate/status#g" bin/clean.sh && \
#sed -i "s#/opt/tpot/etc/compose/elk_environment#/data/tpot/etc/compose/elk_environment#g" bin/clean.sh && \
#sed -i "s#/usr/sbin/iptables-legacy#/sbin/iptables-legacy#g" bin/rules.sh && \
#sed -i "s/tr -d '\", '/tr -d '\", ,#,-'/g" bin/rules.sh && \
#sed -i "s#/opt/tpot/etc/compose/elk_environment#/data/tpot/etc/compose/elk_environment#g" bin/updateip.sh && \
#sed -i "s#.*myLOCALIP=.*#myLOCALIP=\$(/sbin/ip address show | awk '/inet .*brd/{split(\$2,a,\"/\"); print a[1]; exit}')#" bin/updateip.sh && \
#sed -i "s#.*myUUID=.*#myUUID=\$(cat /data/uuid)#" bin/updateip.sh && \
#sed -i "s#/etc/issue#/tmp/etc/issue#g" bin/updateip.sh && \
#sed -i "/toilet/d" bin/updateip.sh && \
#sed -i "/source \/etc\/environment/d" bin/updateip.sh && \
#touch /opt/tpot/etc/tpot.yml && \
cp /root/dist/entrypoint.sh . && \ cp /root/dist/entrypoint.sh . && \
# #
# Clean up # Clean up

4
docker/tpotinit/dist/bin/clean.sh vendored
View file

@ -20,8 +20,8 @@ echo $(ls $myFOLDER | wc -l)
# Let's create a function to rotate and compress logs # Let's create a function to rotate and compress logs
fuLOGROTATE () { fuLOGROTATE () {
local mySTATUS="/opt/tpot/etc/logrotate/status" local mySTATUS="/data/tpot/etc/logrotate/status"
local myCONF="/opt/tpot/etc/logrotate/logrotate.conf" local myCONF="/data/tpot/etc/logrotate/logrotate.conf"
local myADBHONEYTGZ="/data/adbhoney/downloads.tgz" local myADBHONEYTGZ="/data/adbhoney/downloads.tgz"
local myADBHONEYDL="/data/adbhoney/downloads/" local myADBHONEYDL="/data/adbhoney/downloads/"
local myCOWRIETTYLOGS="/data/cowrie/log/tty/" local myCOWRIETTYLOGS="/data/cowrie/log/tty/"

30
docker/tpotinit/dist/bin/rules.sh vendored
View file

@ -33,7 +33,7 @@ fi
function fuGETPORTS { function fuGETPORTS {
### Get ports from docker-compose.yml ### Get ports from docker-compose.yml
myDOCKERCOMPOSEPORTS=$(cat $myDOCKERCOMPOSEYML | yq -r '.services[].ports' | grep ':' | sed -e s/127.0.0.1// | tr -d '", ' | sed -e s/^:// | cut -f1 -d ':' ) myDOCKERCOMPOSEPORTS=$(cat $myDOCKERCOMPOSEYML | yq -r '.services[].ports' | grep ':' | sed -e s/127.0.0.1// | tr -d '", ,#,-' | sed -e s/^:// | cut -f1 -d ':' )
myDOCKERCOMPOSEPORTS+=" $myHOSTPORTS" myDOCKERCOMPOSEPORTS+=" $myHOSTPORTS"
myRULESPORTS=$(for i in $myDOCKERCOMPOSEPORTS; do echo $i; done | sort -gu) myRULESPORTS=$(for i in $myDOCKERCOMPOSEPORTS; do echo $i; done | sort -gu)
echo "Setting up / removing these ports:" echo "Setting up / removing these ports:"
@ -44,24 +44,24 @@ function fuSETRULES {
### Setting up iptables-legacy rules for honeytrap ### Setting up iptables-legacy rules for honeytrap
if [ "$myNFQCHECK" == "honeytrap" ]; if [ "$myNFQCHECK" == "honeytrap" ];
then then
/usr/sbin/iptables-legacy -w -A INPUT -s 127.0.0.1 -j ACCEPT iptables-legacy -w -A INPUT -s 127.0.0.1 -j ACCEPT
/usr/sbin/iptables-legacy -w -A INPUT -d 127.0.0.1 -j ACCEPT iptables-legacy -w -A INPUT -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/usr/sbin/iptables-legacy -w -A INPUT -p tcp --dport $myPORT -j ACCEPT iptables-legacy -w -A INPUT -p tcp --dport $myPORT -j ACCEPT
done done
/usr/sbin/iptables-legacy -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE iptables-legacy -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
fi fi
### Setting up iptables-legacy rules for glutton ### Setting up iptables-legacy rules for glutton
if [ "$myNFQCHECK" == "glutton" ]; if [ "$myNFQCHECK" == "glutton" ];
then then
/usr/sbin/iptables-legacy -w -t raw -A PREROUTING -s 127.0.0.1 -j ACCEPT iptables-legacy -w -t raw -A PREROUTING -s 127.0.0.1 -j ACCEPT
/usr/sbin/iptables-legacy -w -t raw -A PREROUTING -d 127.0.0.1 -j ACCEPT iptables-legacy -w -t raw -A PREROUTING -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/usr/sbin/iptables-legacy -w -t raw -A PREROUTING -p tcp --dport $myPORT -j ACCEPT iptables-legacy -w -t raw -A PREROUTING -p tcp --dport $myPORT -j ACCEPT
done done
# No need for NFQ forwarding, such rules are set up by glutton # No need for NFQ forwarding, such rules are set up by glutton
fi fi
@ -71,24 +71,24 @@ function fuUNSETRULES {
### Removing iptables-legacy rules for honeytrap ### Removing iptables-legacy rules for honeytrap
if [ "$myNFQCHECK" == "honeytrap" ]; if [ "$myNFQCHECK" == "honeytrap" ];
then then
/usr/sbin/iptables-legacy -w -D INPUT -s 127.0.0.1 -j ACCEPT iptables-legacy -w -D INPUT -s 127.0.0.1 -j ACCEPT
/usr/sbin/iptables-legacy -w -D INPUT -d 127.0.0.1 -j ACCEPT iptables-legacy -w -D INPUT -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/usr/sbin/iptables-legacy -w -D INPUT -p tcp --dport $myPORT -j ACCEPT iptables-legacy -w -D INPUT -p tcp --dport $myPORT -j ACCEPT
done done
/usr/sbin/iptables-legacy -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE iptables-legacy -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE
fi fi
### Removing iptables-legacy rules for glutton ### Removing iptables-legacy rules for glutton
if [ "$myNFQCHECK" == "glutton" ]; if [ "$myNFQCHECK" == "glutton" ];
then then
/usr/sbin/iptables-legacy -w -t raw -D PREROUTING -s 127.0.0.1 -j ACCEPT iptables-legacy -w -t raw -D PREROUTING -s 127.0.0.1 -j ACCEPT
/usr/sbin/iptables-legacy -w -t raw -D PREROUTING -d 127.0.0.1 -j ACCEPT iptables-legacy -w -t raw -D PREROUTING -d 127.0.0.1 -j ACCEPT
for myPORT in $myRULESPORTS; do for myPORT in $myRULESPORTS; do
/usr/sbin/iptables-legacy -w -t raw -D PREROUTING -p tcp --dport $myPORT -j ACCEPT iptables-legacy -w -t raw -D PREROUTING -p tcp --dport $myPORT -j ACCEPT
done done
# No need for removing NFQ forwarding, such rules are removed by glutton # No need for removing NFQ forwarding, such rules are removed by glutton
fi fi

94
docker/tpotinit/dist/bin/updateip.sh vendored
View file

@ -1,29 +1,22 @@
#!/bin/bash #!/bin/bash
# Let's add the first local ip to the /etc/issue and external ip to ews.ip file # Let's add the first local ip to the /tmp/etc/issue and external ip to ews.ip file
# If the external IP cannot be detected, the internal IP will be inherited. # If the external IP cannot be detected, the internal IP will be inherited.
source /etc/environment #myCHECKIFSENSOR=$(head -n 1 /opt/tpot/etc/tpot.yml | grep "Sensor" | wc -l)
myCHECKIFSENSOR=$(head -n 1 /opt/tpot/etc/tpot.yml | grep "Sensor" | wc -l) myUUID=$(cat /data/uuid)
myUUID=$(lsblk -o MOUNTPOINT,UUID | grep -e "^/ " | awk '{ print $2 }') myLOCALIP=$(ip address show | awk '/inet .*brd/{split($2,a,"/"); print a[1]; exit}')
myLOCALIP=$(hostname -I | awk '{ print $1 }')
myEXTIP=$(/opt/tpot/bin/myip.sh) myEXTIP=$(/opt/tpot/bin/myip.sh)
if [ "$myEXTIP" = "" ]; if [ "$myEXTIP" = "" ];
then then
myEXTIP=$myLOCALIP myEXTIP=$myLOCALIP
myEXTIP_LAT="49.865835022498125"
myEXTIP_LONG="8.62606472775735"
else
myEXTIP_LOC=$(curl -s ipinfo.io/$myEXTIP/loc)
myEXTIP_LAT=$(echo "$myEXTIP_LOC" | cut -f1 -d",")
myEXTIP_LONG=$(echo "$myEXTIP_LOC" | cut -f2 -d",")
fi fi
# Load Blackhole routes if enabled # Load Blackhole routes if enabled
myBLACKHOLE_FILE1="/etc/blackhole/mass_scanner.txt" #myBLACKHOLE_FILE1="/etc/blackhole/mass_scanner.txt"
myBLACKHOLE_FILE2="/etc/blackhole/mass_scanner_cidr.txt" #myBLACKHOLE_FILE2="/etc/blackhole/mass_scanner_cidr.txt"
if [ -f "$myBLACKHOLE_FILE1" ] || [ -f "$myBLACKHOLE_FILE2" ]; #if [ -f "$myBLACKHOLE_FILE1" ] || [ -f "$myBLACKHOLE_FILE2" ];
then # then
/opt/tpot/bin/blackhole.sh add # /opt/tpot/bin/blackhole.sh add
fi #fi
myBLACKHOLE_STATUS=$(ip r | grep "blackhole" -c) myBLACKHOLE_STATUS=$(ip r | grep "blackhole" -c)
if [ "$myBLACKHOLE_STATUS" -gt "500" ]; if [ "$myBLACKHOLE_STATUS" -gt "500" ];
@ -33,57 +26,44 @@ if [ "$myBLACKHOLE_STATUS" -gt "500" ];
myBLACKHOLE_STATUS="| BLACKHOLE: [ DISABLED ]" myBLACKHOLE_STATUS="| BLACKHOLE: [ DISABLED ]"
fi fi
mySSHUSER=$(cat /etc/passwd | grep 1000 | cut -d ':' -f1)
# Export
export myUUID
export myLOCALIP
export myEXTIP
export myEXTIP_LAT
export myEXTIP_LONG
export myBLACKHOLE_STATUS
export mySSHUSER
# Build issue # Build issue
echo "" > /etc/issue echo "" > /tmp/etc/issue
toilet -f ivrit -F metal --filter border:metal "T-Pot 22.04" | sed 's/\\/\\\\/g' >> /etc/issue echo "T-Pot 23.12" >> /tmp/etc/issue
echo >> /etc/issue echo >> /tmp/etc/issue
echo ",---- [ \n ] [ \d ] [ \t ]" >> /etc/issue echo ",---- [ \n ] [ \d ] [ \t ]" >> /tmp/etc/issue
echo "|" >> /etc/issue echo "|" >> /tmp/etc/issue
echo "| IP: $myLOCALIP ($myEXTIP)" >> /etc/issue echo "| IP: $myLOCALIP ($myEXTIP)" >> /tmp/etc/issue
echo "| SSH: ssh -l tsec -p 64295 $myLOCALIP" >> /etc/issue echo "| SSH: ssh -l tsec -p 64295 $myLOCALIP" >> /tmp/etc/issue
if [ "$myCHECKIFSENSOR" == "0" ]; #if [ "$myCHECKIFSENSOR" == "0" ];
then # then
echo "| WEB: https://$myLOCALIP:64297" >> /etc/issue echo "| WEB: https://$myLOCALIP:64297" >> /tmp/etc/issue
fi #fi
echo "| ADMIN: https://$myLOCALIP:64294" >> /etc/issue echo "| ADMIN: https://$myLOCALIP:64294" >> /tmp/etc/issue
echo "$myBLACKHOLE_STATUS" >> /etc/issue echo "$myBLACKHOLE_STATUS" >> /tmp/etc/issue
echo "|" >> /etc/issue echo "|" >> /tmp/etc/issue
echo "\`----" >> /etc/issue echo "\`----" >> /tmp/etc/issue
echo >> /etc/issue echo >> /tmp/etc/issue
tee /data/ews/conf/ews.ip << EOF tee /data/ews/conf/ews.ip << EOF
[MAIN] [MAIN]
ip = $myEXTIP ip = $myEXTIP
EOF EOF
tee /opt/tpot/etc/compose/elk_environment << EOF tee /data/tpot/etc/compose/elk_environment << EOF
HONEY_UUID=$myUUID HONEY_UUID=$myUUID
MY_EXTIP=$myEXTIP MY_EXTIP=$myEXTIP
MY_EXTIP_LAT=$myEXTIP_LAT
MY_EXTIP_LONG=$myEXTIP_LONG
MY_INTIP=$myLOCALIP MY_INTIP=$myLOCALIP
MY_HOSTNAME=$HOSTNAME MY_HOSTNAME=$HOSTNAME
EOF EOF
if [ -s "/data/elk/logstash/ls_environment" ]; #if [ -s "/data/elk/logstash/ls_environment" ];
then # then
source /data/elk/logstash/ls_environment # source /data/elk/logstash/ls_environment
tee -a /opt/tpot/etc/compose/elk_environment << EOF # tee -a /data/tpot/etc/compose/elk_environment << EOF
MY_TPOT_TYPE=$MY_TPOT_TYPE #MY_TPOT_TYPE=$MY_TPOT_TYPE
MY_SENSOR_PRIVATEKEYFILE=$MY_SENSOR_PRIVATEKEYFILE #MY_SENSOR_PRIVATEKEYFILE=$MY_SENSOR_PRIVATEKEYFILE
MY_HIVE_USERNAME=$MY_HIVE_USERNAME #MY_HIVE_USERNAME=$MY_HIVE_USERNAME
MY_HIVE_IP=$MY_HIVE_IP #MY_HIVE_IP=$MY_HIVE_IP
EOF #EOF
fi #fi
chown tpot:tpot /data/ews/conf/ews.ip chown tpot:tpot /data/ews/conf/ews.ip
chmod 770 /data/ews/conf/ews.ip chmod 770 /data/ews/conf/ews.ip