start working on glutton

docker/cowrie/Dockerfile

@@ -8,7 +8,6 @@ RUN apk -U upgrade && \
     apk add build-base \
             git \
             gmp-dev \
-#            libcap \
             libffi-dev \
             mpc1-dev \
             mpfr-dev \

docker/glutton/Dockerfile

@@ -0,0 +1,48 @@
+FROM alpine
+
+# Include dist
+ADD dist/ /root/dist/
+  
+# Setup apk
+RUN apk -U --no-cache add bash \
+                          build-base \
+                          git \
+                          go \
+                          g++ \
+                          iptables-dev \
+                          libnetfilter_queue-dev \
+                          libpcap-dev \
+                          procps && \
+
+# Setup go, glutton
+    export GOPATH=/opt/go/ && \
+    mkdir -p /opt/go/ && \
+    go get -d github.com/mushorg/glutton && \
+    go get -u github.com/golang/dep/cmd/dep && \
+    cd /opt/go/src/github.com/mushorg/glutton/ && \
+    /opt/go/bin/dep ensure && \
+    make build && \
+    cd / && \
+    mkdir -p /opt/glutton && \
+    mv /opt/go/src/github.com/mushorg/glutton/bin /opt/glutton/ && \
+    mv /opt/go/src/github.com/mushorg/glutton/config /opt/glutton/ && \
+    mv /opt/go/src/github.com/mushorg/glutton/rules /opt/glutton/ && \
+
+# Setup user, groups and configs
+    addgroup -g 2000 glutton && \
+    adduser -S -s /bin/bash -u 2000 -D -g 2000 glutton && \
+    mkdir -p /var/log/glutton && \
+    mv /root/dist/rules.yaml /opt/glutton/rules/ && \
+
+# Clean up
+    apk del --purge build-base \
+                    git \
+                    go \
+                    g++ && \
+    rm -rf /var/cache/apk/* \
+           /opt/go \
+           /root/dist
+
+# Run supervisor upon container start
+WORKDIR /opt/glutton
+CMD bin/server -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:]) -l /var/log/glutton/glutton.log -d true

docker/glutton/dist/rules.yaml

@@ -0,0 +1,38 @@
+rules:
+  - match: tcp dst port 64295
+    type: passthrough
+    name: ssh
+  - match: tcp dst port 22 or port 2222
+    type: conn_handler
+    name: proxy_ssh
+    target: tcp://172.17.0.2:22
+  - match: tcp dst port 23 or port 2323 or port 23231
+    type: conn_handler
+    target: telnet
+  - match: tcp dst port 25
+    type: conn_handler
+    target: smtp
+  - match: tcp dst port 3389
+    type: conn_handler
+    target: rdp
+  - match: tcp dst port 445
+    type: conn_handler
+    target: smb
+  - match: tcp dst port 21
+    type: conn_handler
+    target: ftp
+  - match: tcp dst port 5060
+    type: conn_handler
+    target: sip
+  - match: tcp dst port 1080
+    type: passthrough
+    name: http
+  - match: tcp dst port 6000 or port 7000
+    type: conn_handler
+    name: proxy_tcp
+    target: tcp://172.17.0.2:22
+  - match: tcp
+    type: conn_handler
+    target: default
+  - match: udp
+    type: drop

docker/glutton/docker-compose.yml

@@ -0,0 +1,21 @@
+# For docker-compose ...
+version: '2.2'
+
+networks:
+  glutton_local:
+
+services:
+
+# glutton service
+  glutton:
+    container_name: glutton
+    restart: always
+    network_mode: "host"
+    #networks:
+    # - glutton_local
+    cap_add:
+     - NET_ADMIN
+    image: "dtagdevsec/glutton:1804"
+    volumes:
+     - /data/glutton/log:/var/log/glutton
+

docker/glutton/notes

@@ -0,0 +1,50 @@
+1  apk add golang
+    2  apk add go
+    3  apk -U --no-cache add bash                           build-base                           git                           go                           g++                           iptables-dev                           libnetfilter_queue-dev                           libpcap-dev                           procps
+    4  ls
+    5  go get github.com/mushorg/glutton
+    6  go get -d github.com/mushorg/glutton
+    7  ls
+    8  cd $GOPATH
+    9  ls
+   10  cd go/
+   11  ls
+   12  cd src/github.com/mushorg/glutton/
+   13  ls
+   14  go get -u github.com/golang/dep/cmd/dep
+   15  dep
+   16  find / -name dep
+   17  pwd
+   18  cd ..
+   19  ls
+   20  cd ..
+   21  ls
+   22  cd ..
+   23  ls
+   24  cd golang.org/
+   25  ls
+   26  cd x/
+   27  ls
+   28  cd ..
+   29  ls
+   30  cd ..
+   31  ls
+   32  cd ..
+   33  ls
+   34  cd bin
+   35  ls
+   36  dep ensure
+   37  ./dep ensure
+   38  cd ..
+   39  ls
+   40  cd ..
+   41  ls
+   42  cd ..
+   43  ls
+   44  cd root/go/src/github.com/mushorg/glutton/
+   45  which dep
+   46  /root/go/bin/dep ensure
+   47  make build
+   48  bin/server
+   49  history
+

etc/compose/collect.yml

@@ -88,6 +88,10 @@ services:
   heralding:
     container_name: heralding
     restart: always
+    environment:
+      - PYTHON_EGG_CACHE=/tmp/heralding
+    tmpfs:
+      - /tmp/heralding:exec
     networks:
      - heralding_local
     ports:
@@ -104,6 +108,7 @@ services:
      - "5432:5432"
      - "5900:5900"
     image: "dtagdevsec/heralding:1804"
+    read_only: true
     volumes:
      - /data/heralding/log:/var/log/heralding
 
@@ -157,8 +162,8 @@ services:
     image: "dtagdevsec/nginx:1804"
     read_only: true
     volumes:
-     - /data/nginx/cert/:/etc/nginx/cert/
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
-     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
      - /data/nginx/log/:/var/log/nginx/
 
 # Spiderfoot service

etc/compose/tpot.yml

@@ -173,12 +173,17 @@ services:
 # Glastopf service
   glastopf:
     container_name: glastopf
+    environment:
+      - PYTHON_EGG_CACHE=/tmp/glastopf
+    tmpfs:
+      - /tmp/glastopf:exec
     restart: always
     networks:
      - glastopf_local
     ports:
      - "80:80"
     image: "dtagdevsec/glastopf:1804"
+    read_only: true
     volumes:
      - /data/glastopf/db:/opt/glastopf/db
      - /data/glastopf/log:/opt/glastopf/log
@@ -205,6 +210,7 @@ services:
     ports:
      - "25:2525"
     image: "dtagdevsec/mailoney:1804"
+    read_only: true
     volumes:
      - /data/mailoney/log:/opt/mailoney/logs
 
@@ -245,8 +251,8 @@ services:
     image: "dtagdevsec/nginx:1804"
     read_only: true
     volumes:
-     - /data/nginx/cert/:/etc/nginx/cert/
+     - /data/nginx/cert/:/etc/nginx/cert/:ro
-     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd
+     - /data/nginx/conf/nginxpasswd:/etc/nginx/nginxpasswd:ro
      - /data/nginx/log/:/var/log/nginx/
 
 # Rdpy service