diff --git a/bin/clean.sh b/bin/clean.sh index 44c805f9..e3e2f5b6 100755 --- a/bin/clean.sh +++ b/bin/clean.sh @@ -65,11 +65,32 @@ logrotate -s $mySTATUS $myCONF } # Let's create a function to clean up and prepare conpot data -fuCONPOT () { - if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/conpot/*; fi - mkdir -p /data/conpot/log - chmod 760 /data/conpot -R - chown tpot:tpot /data/conpot -R +fuCONPOT_DEFAULT () { + if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/conpot_default/*; fi + mkdir -p /data/conpot_default/log + chmod 760 /data/conpot_default -R + chown tpot:tpot /data/conpot_default -R +} + +fuCONPOT_KAMSTRUP () { + if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/conpot_kamstrup/*; fi + mkdir -p /data/conpot_kamstrup/log + chmod 760 /data/conpot_kamstrup -R + chown tpot:tpot /data/conpot_kamstrup -R +} + +fuCONPOT_GUARDIANAST () { + if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/conpot_guardianast/*; fi + mkdir -p /data/conpot_guardianast/log + chmod 760 /data/conpot_guardianast -R + chown tpot:tpot /data/conpot_guardianast -R +} + +fuCONPOT_IEC104 () { + if [ "$myPERSISTENCE" != "on" ]; then rm -rf /data/conpot_IEC104/*; fi + mkdir -p /data/conpot_IEC104/log + chmod 760 /data/conpot_IEC104 -R + chown tpot:tpot /data/conpot_IEC104 -R } # Let's create a function to clean up and prepare cowrie data @@ -201,7 +222,10 @@ if [ "$myPERSISTENCE" = "on" ]; fuLOGROTATE else echo "Cleaning up and preparing data folders." - fuCONPOT + fuCONPOT_DEFAULT + fuCONPOT_KAMSTRUP + fuCONPOT_GUARDIANAST + fuCONPOT_IEC104 fuCOWRIE fuDIONAEA fuELASTICPOT diff --git a/docker/conpot_IEC104/docker-compose.yml b/docker/conpot_IEC104/docker-compose.yml index eb529982..ad518721 100644 --- a/docker/conpot_IEC104/docker-compose.yml +++ b/docker/conpot_IEC104/docker-compose.yml @@ -1,4 +1,4 @@ -version: '2.1a' +version: '2.1' networks: conpot_IEC104_local: diff --git a/docker/conpot_default/dist/default/bacnet/bacnet.xml b/docker/conpot_default/dist/default/bacnet/bacnet.xml new file mode 100644 index 00000000..c1e36d55 --- /dev/null +++ b/docker/conpot_default/dist/default/bacnet/bacnet.xml @@ -0,0 +1,39 @@ + + + SystemName + 36113 + Alerton Technologies, Inc. + 15 + 1024 + segmentedBoth + VAV-DD Controller + 1 + + + + + 12 + BI 01 + Binary Input + + + + + 14 + AI 01 + Analog Input + 68.0 + + + + + 16 + Door 01 + Access Door + 0 + True + 2 + + + + diff --git a/docker/conpot_default/dist/default/template.xml b/docker/conpot_default/dist/default/template.xml index 75b6ce55..975515fd 100644 --- a/docker/conpot_default/dist/default/template.xml +++ b/docker/conpot_default/dist/default/template.xml @@ -4,7 +4,7 @@ S7-200 Siemens Rough simulation of a basic Siemens S7-200 CPU with 2 slaves - HTTP, MODBUS, s7comm, SNMP + MODBUS, s7comm, SNMP, Bacnet the conpot team diff --git a/docker/conpot_default/docker-compose.yml b/docker/conpot_default/docker-compose.yml index 2b0759ce..0da38e8e 100644 --- a/docker/conpot_default/docker-compose.yml +++ b/docker/conpot_default/docker-compose.yml @@ -1,4 +1,4 @@ -version: '2.1a' +version: '2.1' networks: conpot_default_local: @@ -14,6 +14,7 @@ services: ports: - "102:102" - "502:502" + - "47808:47808" - "161:161/udp" image: "dtagdevsec/conpot:1710" volumes: diff --git a/docker/conpot_guardianast/docker-compose.yml b/docker/conpot_guardianast/docker-compose.yml index e84c27ce..ad132432 100644 --- a/docker/conpot_guardianast/docker-compose.yml +++ b/docker/conpot_guardianast/docker-compose.yml @@ -1,4 +1,4 @@ -version: '2.1a' +version: '2.1' networks: conpot_guardianast_local: diff --git a/docker/conpot_kamstrup/docker-compose.yml b/docker/conpot_kamstrup/docker-compose.yml index 52fb5adb..298c9a49 100644 --- a/docker/conpot_kamstrup/docker-compose.yml +++ b/docker/conpot_kamstrup/docker-compose.yml @@ -1,4 +1,4 @@ -version: '2.1a' +version: '2.1' networks: conpot_kamstrup_local: diff --git a/etc/compose/all.yml b/etc/compose/all.yml index 21c8a676..9cb4ad53 100644 --- a/etc/compose/all.yml +++ b/etc/compose/all.yml @@ -1,6 +1,6 @@ # T-Pot (Everything) # For docker-compose ... -version: '2.2a' +version: '2.2' networks: conpot_kamstrup_local: @@ -43,7 +43,8 @@ services: ports: - "102:102" - "502:502" - - "161:161/udp + - "47808:47808" + - "161:161/udp" image: "dtagdevsec/conpot:1710" volumes: - /data/conpot_default_local/log:/var/log/conpot_default_local diff --git a/etc/compose/industrial.yml b/etc/compose/industrial.yml index 1dded7b2..7685ce14 100644 --- a/etc/compose/industrial.yml +++ b/etc/compose/industrial.yml @@ -1,6 +1,6 @@ # T-Pot (Industrial) # For docker-compose ... -version: '2.2a' +version: '2.2' networks: conpot_kamstrup_local: @@ -36,7 +36,8 @@ services: ports: - "102:102" - "502:502" - - "161:161/udp + - "47808:47808" + - "161:161/udp" image: "dtagdevsec/conpot:1710" volumes: - /data/conpot_default_local/log:/var/log/conpot_default_local diff --git a/host/etc/systemd/tpot.service b/host/etc/systemd/tpot.service index 61339899..2fa6da76 100644 --- a/host/etc/systemd/tpot.service +++ b/host/etc/systemd/tpot.service @@ -37,7 +37,7 @@ ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 64295:64303 ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 20:23,25,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 3306,3389,5060,5061,5601,5900,27017 -j ACCEPT ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT -ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 102,502,2404,10001 -j ACCEPT +ExecStartPre=/sbin/iptables -w -A INPUT -p tcp -m multiport --dports 102,502,2404,10001,47808 -j ACCEPT ExecStartPre=/sbin/iptables -w -A INPUT -p udp -m multiport --dports 69,161 -j ACCEPT ExecStartPre=/sbin/iptables -w -A INPUT -p tcp --syn -m state --state NEW -j NFQUEUE @@ -54,7 +54,7 @@ ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 64295:64303 ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 20:23,25,42,69,80,135,443,445,1433,1723,1883,1900 -j ACCEPT ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 3306,3389,5060,5061,5601,5900,27017 -j ACCEPT ExecStopPost=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 1025,50100,8080,8081,9200 -j ACCEPT -ExecStartPre=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 102,502,2404,10001 -j ACCEPT +ExecStartPre=/sbin/iptables -w -D INPUT -p tcp -m multiport --dports 102,502,2404,10001,47808 -j ACCEPT ExecStartPre=/sbin/iptables -w -D INPUT -p udp -m multiport --dports 69,161 -j ACCEPT ExecStopPost=/sbin/iptables -w -D INPUT -p tcp --syn -m state --state NEW -j NFQUEUE