まだCentOS 6.5で消耗してるの?
利用していたVPSにデフォルトでCentOS 6.5が入っていたので、他のOSをインストールするのも面倒だという理由でそのまま使っていた。
自前でPython 2.7.11をビルドするなどして無理やり使っていたが、Dionaeaの導入がうまくいかず、記事もDebian系のものが多かったので乗り換えることにした。
yumで入るPythonのバージョンが2.6の時点でCentOS6.5とは決別すべきだったんですよ
— げん (@neglect_yp) 2016年3月17日
というわけで、Ubuntuに乗り換えてcowrieとDionaea入れてハニーポットを運用してみている。
DionaeaFRはVPSのスペックがないのでVPSに入れずに、sqliteのファイルをローカルに保存して確認する形にしようかなと思っている。
2016/03/17のハニーポットのログ
帰宅してハニーポットのログを見ていたら、早速アクセスがあったようなので、一応記事にしておきます。
- 9:30頃に1回と、11:30頃~に1回ログイン試行されていました。
- 9:30頃のアクセスでは一度ログインに成功しているのですが、何もせずに接続を切ったようです。
- 11:30頃のアクセスではよくあるユーザ名とパスワードでひたすらログイン試行しているようですが、一度も成功していません。
- このあたりのユーザ名とパスワードでログイン出来るようにすることも考えたほうがいいかもしれません。
+-----+----------+---------+-------------------+-----------------+---------------------+ | id | session | success | username | password | timestamp | +-----+----------+---------+-------------------+-----------------+---------------------+ | 10 | a612e7c6 | 0 | 51325125123512351 | 523523523525555 | 2016-03-17 09:31:26 | | 11 | 78f203a9 | 0 | 52523532523523523 | 523523525252525 | 2016-03-17 09:31:29 | | 12 | c5fb1271 | 0 | 23523523523523555 | 523523523523523 | 2016-03-17 09:31:32 | | 13 | 2d7e2254 | 0 | root | root | 2016-03-17 09:31:36 | | 14 | 96b7d138 | 1 | root | 963963369 | 2016-03-17 09:31:39 | | 15 | 9a539e46 | 0 | a | a | 2016-03-17 11:27:27 | | 16 | 102c83a0 | 0 | ajay | ajay | 2016-03-17 11:28:43 | | 17 | 102c83a0 | 0 | ajay | ajay123 | 2016-03-17 11:28:44 | | 18 | 102c83a0 | 0 | ajay | ajay@123 | 2016-03-17 11:28:46 | | 19 | bbf78e08 | 0 | ask | ask | 2016-03-17 11:30:02 | | 20 | bbf78e08 | 0 | ask | ask123 | 2016-03-17 11:30:03 | | 21 | bbf78e08 | 0 | ask | ask@123 | 2016-03-17 11:30:05 | | 22 | 31ddfeef | 0 | arun | arun | 2016-03-17 11:31:20 | | 23 | 31ddfeef | 0 | arun | arun123 | 2016-03-17 11:31:21 | | 24 | 31ddfeef | 0 | arun | arun@123 | 2016-03-17 11:31:22 | | 25 | d4b377b3 | 0 | arul | arul | 2016-03-17 11:32:38 | | 26 | d4b377b3 | 0 | arul | arul123 | 2016-03-17 11:32:39 | | 27 | d4b377b3 | 0 | arul | arul@123 | 2016-03-17 11:32:41 | | 28 | 7696c16d | 0 | aman | aman | 2016-03-17 11:33:59 | | 29 | 7696c16d | 0 | aman | aman123 | 2016-03-17 11:34:00 | | 30 | 7696c16d | 0 | aman | aman@123 | 2016-03-17 11:34:01 | | 31 | b04c3f9d | 0 | amit | amit | 2016-03-17 11:35:20 | | 32 | b04c3f9d | 0 | amit | amit123 | 2016-03-17 11:35:21 | | 33 | b04c3f9d | 0 | amit | amit@123 | 2016-03-17 11:35:23 | | 34 | 20932272 | 0 | ashish | ashish | 2016-03-17 11:36:36 | | 35 | 20932272 | 0 | ashish | ashish123 | 2016-03-17 11:36:37 | | 36 | 20932272 | 0 | ashish | ashish@123 | 2016-03-17 11:36:38 | | 37 | 46aba7dc | 0 | altibase | altibase | 2016-03-17 11:37:52 | | 38 | 46aba7dc | 0 | altibase | altibase123 | 2016-03-17 11:37:53 | | 39 | 46aba7dc | 0 | altibase | altibase@123 | 2016-03-17 11:37:54 | | 40 | 20ef6d16 | 0 | alok | alok | 2016-03-17 11:39:07 | | 41 | 20ef6d16 | 0 | alok | alok123 | 2016-03-17 11:39:09 | | 42 | 20ef6d16 | 0 | alok | alok@123 | 2016-03-17 11:39:10 | | 43 | d3f2b908 | 0 | ashok | ashok | 2016-03-17 11:40:28 | | 44 | d3f2b908 | 0 | ashok | ashok123 | 2016-03-17 11:40:29 | | 45 | d3f2b908 | 0 | ashok | ashok@123 | 2016-03-17 11:40:30 | | 46 | c9b24e12 | 0 | applmgr | applmgr | 2016-03-17 11:41:51 | | 47 | c9b24e12 | 0 | applmgr | applmgr123 | 2016-03-17 11:41:52 | | 48 | c9b24e12 | 0 | applmgr | applmgr@123 | 2016-03-17 11:41:53 | | 49 | 52a7ecfe | 0 | ankur | ankur | 2016-03-17 11:43:09 | | 50 | 52a7ecfe | 0 | ankur | ankur123 | 2016-03-17 11:43:11 | | 51 | 52a7ecfe | 0 | ankur | ankur@123 | 2016-03-17 11:43:12 | | 52 | f640d602 | 0 | apache | apache | 2016-03-17 11:44:25 | | 53 | f640d602 | 0 | apache | apache123 | 2016-03-17 11:44:26 | | 54 | f640d602 | 0 | apache | apache@123 | 2016-03-17 11:44:27 | | 55 | 6ee8ee4f | 0 | ankit | ankit | 2016-03-17 11:45:44 | | 56 | 6ee8ee4f | 0 | ankit | ankit123 | 2016-03-17 11:45:45 | | 57 | 6ee8ee4f | 0 | ankit | ankit@123 | 2016-03-17 11:45:46 | | 58 | a6b2f6ba | 0 | butget | budget | 2016-03-17 11:46:36 | | 59 | 7c76b4e0 | 0 | budget | budget123 | 2016-03-17 11:47:31 | | 60 | 7c76b4e0 | 0 | budget | budget@123 | 2016-03-17 11:47:33 | | 61 | 2857a8f2 | 0 | centos | centos | 2016-03-17 11:48:49 | | 62 | 2857a8f2 | 0 | centos | centos123 | 2016-03-17 11:48:50 | | 63 | 2857a8f2 | 0 | centos | centos@123 | 2016-03-17 11:48:51 | | 64 | d42f9d45 | 0 | cmsftp | cmsftp | 2016-03-17 11:50:04 | | 65 | d42f9d45 | 0 | cmsftp | cmsftp123 | 2016-03-17 11:50:05 | | 66 | d42f9d45 | 0 | cmsftp | cmsftp@123 | 2016-03-17 11:50:06 | | 67 | 3bb11fc0 | 0 | cvsadmin | cvsadmin | 2016-03-17 11:51:21 | | 68 | 3bb11fc0 | 0 | cvsadmin | cvsadmin123 | 2016-03-17 11:51:22 | | 69 | 3bb11fc0 | 0 | cvsadmin | cvsadmin@123 | 2016-03-17 11:51:23 | | 70 | 92bdd69f | 0 | chandru | chandru | 2016-03-17 11:52:39 | | 71 | 92bdd69f | 0 | chandru | chandru123 | 2016-03-17 11:52:40 | | 72 | 92bdd69f | 0 | chandru | chandru@123 | 2016-03-17 11:52:42 | | 73 | 4e272623 | 0 | common | common | 2016-03-17 11:54:01 | | 74 | 4e272623 | 0 | common | common123 | 2016-03-17 11:54:02 | | 75 | 4e272623 | 0 | common | common@123 | 2016-03-17 11:54:03 | | 76 | e4219bc9 | 0 | cloud | cloud | 2016-03-17 11:55:20 | | 77 | e4219bc9 | 0 | cloud | cloud123 | 2016-03-17 11:55:21 | | 78 | e4219bc9 | 0 | cloud | cloud@123 | 2016-03-17 11:55:22 | | 79 | ce5a36e9 | 0 | cyrus | cyrus | 2016-03-17 11:56:37 | | 80 | ce5a36e9 | 0 | cyrus | cyrus123 | 2016-03-17 11:56:38 | | 81 | ce5a36e9 | 0 | cyrus | cyrus@123 | 2016-03-17 11:56:39 | | 82 | 128481e3 | 0 | download | download | 2016-03-17 11:57:53 | | 83 | 128481e3 | 0 | download | download123 | 2016-03-17 11:57:54 | | 84 | 128481e3 | 0 | download | download@123 | 2016-03-17 11:57:55 | | 85 | d2d89603 | 0 | db2inst1 | db2inst1 | 2016-03-17 11:58:48 | | 86 | ed135de3 | 0 | db2inst2 | db2inst2 | 2016-03-17 11:59:37 | | 87 | 6762e433 | 0 | db2inst3 | db2inst3 | 2016-03-17 12:00:25 | | 88 | 3d59e70d | 0 | db2fenc1 | db2fenc1 | 2016-03-17 12:01:12 | | 89 | 2aea8a10 | 0 | db2fenc2 | db2fenc2 | 2016-03-17 12:02:00 | | 90 | a4043afd | 0 | db2fenc3 | db2fenc3 | 2016-03-17 12:02:50 | | 91 | ec23138f | 0 | divya | divya | 2016-03-17 12:04:00 | | 92 | ec23138f | 0 | divya | divya123 | 2016-03-17 12:04:01 | | 93 | ec23138f | 0 | divya | divya@123 | 2016-03-17 12:04:02 | | 94 | f7cfc398 | 0 | dc | dc | 2016-03-17 12:05:18 | | 95 | f7cfc398 | 0 | dc | dc123 | 2016-03-17 12:05:19 | | 96 | f7cfc398 | 0 | dc | dc@123 | 2016-03-17 12:05:20 | | 97 | 2c02a412 | 0 | dn | dn | 2016-03-17 12:06:38 | | 98 | 2c02a412 | 0 | dn | dn123 | 2016-03-17 12:06:39 | | 99 | 2c02a412 | 0 | dn | dn@123 | 2016-03-17 12:06:41 | | 100 | 29743a46 | 0 | dfk | dfk | 2016-03-17 12:07:58 | | 101 | 29743a46 | 0 | dfk | dfk123 | 2016-03-17 12:07:59 | | 102 | 29743a46 | 0 | dfk | dfk@123 | 2016-03-17 12:08:00 | | 103 | cf923c55 | 0 | dspace | dspace | 2016-03-17 12:09:16 | | 104 | cf923c55 | 0 | dspace | dspace123 | 2016-03-17 12:09:18 | | 105 | cf923c55 | 0 | dspace | dspace@123 | 2016-03-17 12:09:19 | | 106 | cd4bcabf | 0 | disasterbot | disasterbot | 2016-03-17 12:10:33 | | 107 | cd4bcabf | 0 | disasterbot | disasterbot123 | 2016-03-17 12:10:34 | | 108 | cd4bcabf | 0 | disasterbot | disasterbot@123 | 2016-03-17 12:10:35 | | 109 | 40d0ac98 | 0 | eric | eric | 2016-03-17 12:11:53 | | 110 | 40d0ac98 | 0 | eric | eric123 | 2016-03-17 12:11:54 | | 111 | 40d0ac98 | 0 | eric | eric@123 | 2016-03-17 12:11:55 | | 112 | e9efcc25 | 0 | erp | erp | 2016-03-17 12:13:14 | | 113 | e9efcc25 | 0 | erp | erp123 | 2016-03-17 12:13:15 | | 114 | e9efcc25 | 0 | erp | erp@123 | 2016-03-17 12:13:17 | | 115 | 74a857aa | 0 | electrical | electrical | 2016-03-17 12:14:34 | | 116 | 74a857aa | 0 | electrical | electrical123 | 2016-03-17 12:14:35 | | 117 | 74a857aa | 0 | electrical | electrical@123 | 2016-03-17 12:14:37 | | 118 | d6d9bbf6 | 0 | export | export | 2016-03-17 12:15:47 | | 119 | d6d9bbf6 | 0 | export | export123 | 2016-03-17 12:15:48 | | 120 | d6d9bbf6 | 0 | export | export@123 | 2016-03-17 12:15:49 | | 121 | 25328836 | 0 | ftpuser | ftpuser | 2016-03-17 12:17:03 | | 122 | 25328836 | 0 | ftpuser | ftpuser123 | 2016-03-17 12:17:04 | | 123 | 25328836 | 0 | ftpuser | ftpuser@123 | 2016-03-17 12:17:05 | | 124 | d47cfd95 | 0 | ftpuser1 | ftpuser1 | 2016-03-17 12:17:56 | | 125 | 38b3aecb | 0 | ftptest | ftptest | 2016-03-17 12:19:04 | | 126 | 38b3aecb | 0 | ftptest | ftptest123 | 2016-03-17 12:19:05 | | 127 | 38b3aecb | 0 | ftptest | ftptest@123 | 2016-03-17 12:19:06 | | 128 | 42d9e295 | 0 | finance | finance | 2016-03-17 12:20:25 | | 129 | 42d9e295 | 0 | finance | finance123 | 2016-03-17 12:20:26 | | 130 | 42d9e295 | 0 | finance | finance@123 | 2016-03-17 12:20:27 | | 131 | f6d321ef | 0 | fms | fms | 2016-03-17 12:21:41 | | 132 | f6d321ef | 0 | fms | fms123 | 2016-03-17 12:21:43 | | 133 | f6d321ef | 0 | fms | fms@123 | 2016-03-17 12:21:44 | | 134 | 5c63e5f3 | 0 | git | git | 2016-03-17 12:22:57 | | 135 | 5c63e5f3 | 0 | git | git@123 | 2016-03-17 12:22:58 | | 136 | 5c63e5f3 | 0 | git | git123 | 2016-03-17 12:22:59 | | 137 | 149fc91a | 0 | git | 123456 | 2016-03-17 12:24:00 | | 138 | 149fc91a | 0 | git | 1qaz2wsx | 2016-03-17 12:24:02 | | 139 | 0d9a16bd | 0 | gaurav | gaurav | 2016-03-17 12:25:19 | | 140 | 0d9a16bd | 0 | gaurav | gaurav123 | 2016-03-17 12:25:21 | | 141 | 0d9a16bd | 0 | gaurav | gaurav@123 | 2016-03-17 12:25:22 | | 142 | 7bccae12 | 0 | gitlab | gitlab | 2016-03-17 12:26:40 | | 143 | 7bccae12 | 0 | gitlab | gitlab123 | 2016-03-17 12:26:41 | | 144 | 7bccae12 | 0 | gitlab | gitlab@123 | 2016-03-17 12:26:42 | | 145 | 3a251ec3 | 0 | hdfs | hdfs | 2016-03-17 12:27:56 | | 146 | 3a251ec3 | 0 | hdfs | hdfs123 | 2016-03-17 12:27:57 | | 147 | 3a251ec3 | 0 | hdfs | hdfs@123 | 2016-03-17 12:27:58 | | 148 | 074897a8 | 0 | hadoop | hadoop | 2016-03-17 12:29:10 | | 149 | 074897a8 | 0 | hadoop | hadoop123 | 2016-03-17 12:29:12 | | 150 | 074897a8 | 0 | hadoop | hadoop@123 | 2016-03-17 12:29:13 | | 151 | 196d83e7 | 0 | himanshu | himanshu | 2016-03-17 12:30:27 | | 152 | 196d83e7 | 0 | himanshu | himanshu123 | 2016-03-17 12:30:28 | | 153 | 196d83e7 | 0 | himanshu | himanshu@123 | 2016-03-17 12:30:30 | | 154 | d1ff522b | 0 | its | its | 2016-03-17 12:31:48 | | 155 | d1ff522b | 0 | its | its123 | 2016-03-17 12:31:49 | | 156 | d1ff522b | 0 | its | its@123 | 2016-03-17 12:31:50 | | 157 | 449ebb89 | 0 | info | info | 2016-03-17 12:33:06 | | 158 | 449ebb89 | 0 | info | info123 | 2016-03-17 12:33:07 | | 159 | 449ebb89 | 0 | info | info@123 | 2016-03-17 12:33:08 | | 160 | 911d11ee | 0 | jboss | jboss | 2016-03-17 12:34:25 | | 161 | 911d11ee | 0 | jboss | jboss123 | 2016-03-17 12:34:26 | | 162 | 911d11ee | 0 | jboss | jboss@123 | 2016-03-17 12:34:27 | | 163 | 5ed49205 | 0 | jenkins | 123qwe | 2016-03-17 12:35:41 | | 164 | 5ed49205 | 0 | jenkins | jenkins | 2016-03-17 12:35:43 | | 165 | 5ed49205 | 0 | jenkins | jenkins123 | 2016-03-17 12:35:44 | | 166 | 8dc558fd | 0 | jenkins | jenkins@123 | 2016-03-17 12:36:36 | | 167 | a6607639 | 0 | jayendra | jayendra | 2016-03-17 12:37:49 | | 168 | a6607639 | 0 | jayendra | jayendra123 | 2016-03-17 12:37:50 | | 169 | a6607639 | 0 | jayendra | jayendra@123 | 2016-03-17 12:37:51 | | 170 | 5edf325b | 0 | jira | jira | 2016-03-17 12:39:09 | | 171 | 5edf325b | 0 | jira | jira123 | 2016-03-17 12:39:11 | | 172 | 5edf325b | 0 | jira | jira@123 | 2016-03-17 12:39:12 | | 173 | d4c147fe | 0 | kim | kim | 2016-03-17 12:40:27 | | 174 | d4c147fe | 0 | kim | kim123 | 2016-03-17 12:40:28 | | 175 | d4c147fe | 0 | kim | kim@123 | 2016-03-17 12:40:29 | | 176 | 81b8d0cf | 0 | kiran | kiran | 2016-03-17 12:41:43 | | 177 | 81b8d0cf | 0 | kiran | kiran123 | 2016-03-17 12:41:44 | | 178 | 81b8d0cf | 0 | kiran | kiran@123 | 2016-03-17 12:41:45 | | 179 | e5d58242 | 0 | kishori | kishori | 2016-03-17 12:42:59 | | 180 | e5d58242 | 0 | kishori | kishori123 | 2016-03-17 12:43:00 | | 181 | e5d58242 | 0 | kishori | kishori@123 | 2016-03-17 12:43:01 | | 182 | e47d6378 | 0 | kwong | kwong | 2016-03-17 12:44:19 | | 183 | e47d6378 | 0 | kwong | kwong123 | 2016-03-17 12:44:20 | | 184 | e47d6378 | 0 | kwong | kwong@123 | 2016-03-17 12:44:21 | | 185 | 82d40b0b | 0 | lms | lms | 2016-03-17 12:45:35 | | 186 | 82d40b0b | 0 | lms | lms123 | 2016-03-17 12:45:36 | | 187 | 82d40b0b | 0 | lms | lms@123 | 2016-03-17 12:45:38 | | 188 | 4e4e13cb | 0 | minecraft | minecraft | 2016-03-17 12:46:53 | | 189 | 4e4e13cb | 0 | minecraft | minecraft1 | 2016-03-17 12:46:54 | | 190 | 4e4e13cb | 0 | minecraft | minecraft12 | 2016-03-17 12:46:55 | | 191 | 89adca19 | 0 | minecraft | minecraft123 | 2016-03-17 12:47:53 | | 192 | 89adca19 | 0 | minecraft | minecraft@123 | 2016-03-17 12:47:54 | | 193 | 5a38554e | 0 | melis | melis | 2016-03-17 12:49:09 | | 194 | 5a38554e | 0 | melis | melis123 | 2016-03-17 12:49:10 | | 195 | 5a38554e | 0 | melis | melis@123 | 2016-03-17 12:49:11 | | 196 | 8d1b86cd | 0 | mhlee | mhlee | 2016-03-17 12:50:31 | | 197 | 8d1b86cd | 0 | mhlee | mhlee123 | 2016-03-17 12:50:32 | | 198 | 8d1b86cd | 0 | mhlee | mhlee@123 | 2016-03-17 12:50:33 | | 199 | 86621f20 | 0 | monit | monit | 2016-03-17 12:51:51 | | 200 | 86621f20 | 0 | monit | monit123 | 2016-03-17 12:51:52 | | 201 | 86621f20 | 0 | monit | monit@123 | 2016-03-17 12:51:53 | | 202 | d3a6f2d3 | 0 | manis | manis | 2016-03-17 12:52:43 | | 203 | b0b5bb1e | 0 | mansi | manis123 | 2016-03-17 12:53:30 | | 204 | c3813f7a | 0 | manis | manis@123 | 2016-03-17 12:54:18 | | 205 | 677186a8 | 0 | mega | mega | 2016-03-17 12:55:26 | | 206 | 677186a8 | 0 | mega | mega123 | 2016-03-17 12:55:27 | | 207 | 677186a8 | 0 | mega | mega@123 | 2016-03-17 12:55:28 | | 208 | 868bd8d5 | 0 | moodle | moodle | 2016-03-17 12:56:44 | | 209 | 868bd8d5 | 0 | moodle | moodle123 | 2016-03-17 12:56:46 | | 210 | 868bd8d5 | 0 | moodle | moodle@123 | 2016-03-17 12:56:47 | | 211 | dac08a83 | 0 | mella | mella | 2016-03-17 12:58:05 | | 212 | dac08a83 | 0 | mella | mella123 | 2016-03-17 12:58:06 | | 213 | dac08a83 | 0 | mella | mella@123 | 2016-03-17 12:58:07 | | 214 | 2621e228 | 0 | mq | mq | 2016-03-17 12:59:23 | | 215 | 2621e228 | 0 | mq | mq123 | 2016-03-17 12:59:25 | | 216 | 2621e228 | 0 | mq | mq@123 | 2016-03-17 12:59:26 | | 217 | 282cc144 | 0 | mqm | mqm | 2016-03-17 13:00:39 | | 218 | 282cc144 | 0 | mqm | mqm123 | 2016-03-17 13:00:40 | | 219 | 282cc144 | 0 | mqm | mqm@123 | 2016-03-17 13:00:41 | | 220 | 92892f16 | 0 | mysql | mysql | 2016-03-17 13:01:59 | | 221 | 92892f16 | 0 | mysql | mysql123 | 2016-03-17 13:02:00 | | 222 | 92892f16 | 0 | mysql | mysql@123 | 2016-03-17 13:02:01 | | 223 | db4e5212 | 0 | neeraj | neeraj | 2016-03-17 13:03:19 | | 224 | db4e5212 | 0 | neeraj | neeraj123 | 2016-03-17 13:03:21 | | 225 | db4e5212 | 0 | neeraj | neeraj@123 | 2016-03-17 13:03:22 | | 226 | e98b8f35 | 0 | naga | naga | 2016-03-17 13:04:40 | | 227 | e98b8f35 | 0 | naga | naga123 | 2016-03-17 13:04:41 | | 228 | e98b8f35 | 0 | naga | naga@123 | 2016-03-17 13:04:42 | | 229 | b98827db | 0 | nas | nas | 2016-03-17 13:05:54 | | 230 | b98827db | 0 | nas | nas123 | 2016-03-17 13:05:56 | | 231 | b98827db | 0 | nas | nas@123 | 2016-03-17 13:05:57 | | 232 | 2fa37cac | 0 | ncuser | ncuser | 2016-03-17 13:07:05 | | 233 | 2fa37cac | 0 | ncuser | ncuser123 | 2016-03-17 13:07:06 | | 234 | 2fa37cac | 0 | ncuser | ncuser@123 | 2016-03-17 13:07:07 | | 235 | 58811164 | 0 | oracle | oracle | 2016-03-17 13:08:22 | | 236 | 58811164 | 0 | oracle | oracle123 | 2016-03-17 13:08:24 | | 237 | 58811164 | 0 | oracle | oracle@123 | 2016-03-17 13:08:25 | | 238 | ef65d62a | 0 | oracle | q2w3e4r5 | 2016-03-17 13:09:17 | | 239 | 16aa8d17 | 0 | openerp | openerp | 2016-03-17 13:10:23 | | 240 | 16aa8d17 | 0 | openerp | openerp123 | 2016-03-17 13:10:24 | | 241 | 16aa8d17 | 0 | openerp | openerp@123 | 2016-03-17 13:10:26 | | 242 | cf363c00 | 0 | odoo | odoo | 2016-03-17 13:11:41 | | 243 | cf363c00 | 0 | odoo | odoo123 | 2016-03-17 13:11:42 | | 244 | cf363c00 | 0 | odoo | odoo@123 | 2016-03-17 13:11:43 | | 245 | 90bef3a7 | 0 | openbravo | openbravo | 2016-03-17 13:12:58 | | 246 | 90bef3a7 | 0 | openbravo | openbravo123 | 2016-03-17 13:12:59 | | 247 | 90bef3a7 | 0 | openbravo | openbravo@123 | 2016-03-17 13:13:01 | | 248 | 2d908ac8 | 0 | osman | osman | 2016-03-17 13:14:16 | | 249 | 2d908ac8 | 0 | osman | osman123 | 2016-03-17 13:14:17 | | 250 | 2d908ac8 | 0 | osman | osman@123 | 2016-03-17 13:14:18 | | 251 | 3dec51ad | 0 | oraprod | oraprod | 2016-03-17 13:15:36 | | 252 | 3dec51ad | 0 | oraprod | oraprod123 | 2016-03-17 13:15:37 | | 253 | 3dec51ad | 0 | oraprod | opraprod@123 | 2016-03-17 13:15:38 | | 254 | 9e04fe20 | 0 | prashant | prashant | 2016-03-17 13:16:57 | | 255 | 9e04fe20 | 0 | prashant | prashant123 | 2016-03-17 13:16:58 | | 256 | 9e04fe20 | 0 | prashant | prashant@123 | 2016-03-17 13:17:00 | | 257 | 4b72a6be | 0 | pardeep | pardeep | 2016-03-17 13:18:14 | | 258 | 4b72a6be | 0 | pardeep | pardeep123 | 2016-03-17 13:18:15 | | 259 | 4b72a6be | 0 | pardeep | pardeep@123 | 2016-03-17 13:18:16 | | 260 | a3cc93b4 | 0 | pramod | pramod | 2016-03-17 13:19:29 | | 261 | a3cc93b4 | 0 | pramod | pramod123 | 2016-03-17 13:19:30 | | 262 | a3cc93b4 | 0 | pramod | pramod@123 | 2016-03-17 13:19:31 | | 263 | 99c1d348 | 0 | postgres | postgres | 2016-03-17 13:20:45 | | 264 | 99c1d348 | 0 | postgres | postgres123 | 2016-03-17 13:20:46 | | 265 | 99c1d348 | 0 | postgres | postgres@123 | 2016-03-17 13:20:47 | | 266 | 1d46dd54 | 0 | prashant | prashant | 2016-03-17 13:22:03 | | 267 | 1d46dd54 | 0 | prashant | prashant123 | 2016-03-17 13:22:04 | | 268 | 1d46dd54 | 0 | prashant | prashant@123 | 2016-03-17 13:22:06 | | 269 | 939d4fc8 | 0 | plex | plex | 2016-03-17 13:23:25 | | 270 | 939d4fc8 | 0 | plex | plex123 | 2016-03-17 13:23:26 | | 271 | 939d4fc8 | 0 | plex | plex@123 | 2016-03-17 13:23:27 | | 272 | 00469016 | 0 | pt | pt | 2016-03-17 13:24:43 | | 273 | 00469016 | 0 | pt | pt123 | 2016-03-17 13:24:44 | | 274 | 00469016 | 0 | pt | pt@123 | 2016-03-17 13:24:45 | | 275 | 0faa3e0c | 0 | phuket | phuket | 2016-03-17 13:26:00 | | 276 | 0faa3e0c | 0 | phuket | phuket123 | 2016-03-17 13:26:01 | | 277 | 0faa3e0c | 0 | phuket | phuket@123 | 2016-03-17 13:26:02 | | 278 | b7ecd80e | 0 | pi | pi | 2016-03-17 13:27:17 | | 279 | b7ecd80e | 0 | pi | pi123 | 2016-03-17 13:27:18 | | 280 | b7ecd80e | 0 | pi | pi@123 | 2016-03-17 13:27:19 | | 281 | 08999b17 | 0 | rohit | rohit | 2016-03-17 13:28:38 | | 282 | 08999b17 | 0 | rohit | rohit123 | 2016-03-17 13:28:39 | | 283 | 08999b17 | 0 | rohit | rohit@123 | 2016-03-17 13:28:40 | | 284 | 1d39c929 | 0 | refresh | refresh | 2016-03-17 13:29:58 | | 285 | 1d39c929 | 0 | refresh | refresh123 | 2016-03-17 13:30:00 | | 286 | 1d39c929 | 0 | refresh | refresh@123 | 2016-03-17 13:30:01 | | 287 | 66ce26e8 | 0 | trade | trade | 2016-03-17 13:31:16 | | 288 | 66ce26e8 | 0 | trade | trade123 | 2016-03-17 13:31:17 | | 289 | 66ce26e8 | 0 | trade | trade@123 | 2016-03-17 13:31:18 | | 290 | e4d9517e | 0 | tushar | tushar | 2016-03-17 13:32:33 | | 291 | e4d9517e | 0 | tushar | tushar123 | 2016-03-17 13:32:34 | | 292 | e4d9517e | 0 | tushar | tushar@123 | 2016-03-17 13:32:35 | | 293 | 9280254f | 0 | test | test | 2016-03-17 13:33:50 | | 294 | 9280254f | 0 | test | test123 | 2016-03-17 13:33:51 | | 295 | 9280254f | 0 | test | test@123 | 2016-03-17 13:33:53 | | 296 | bc26030c | 0 | test1 | test1 | 2016-03-17 13:34:42 | | 297 | d986aca0 | 0 | test2 | test2 | 2016-03-17 13:35:30 | | 298 | 22c08e82 | 0 | test3 | test3 | 2016-03-17 13:36:20 | | 299 | 47f67fcd | 0 | ts1 | ts1 | 2016-03-17 13:37:06 | | 300 | b702390d | 0 | ts2 | ts2 | 2016-03-17 13:37:52 | | 301 | c0aff953 | 0 | ts3 | ts3 | 2016-03-17 13:38:47 | | 302 | c0aff953 | 0 | ts3 | test | 2016-03-17 13:38:48 | | 303 | c818701c | 0 | temp | temp | 2016-03-17 13:40:01 | | 304 | c818701c | 0 | temp | temp123 | 2016-03-17 13:40:02 | | 305 | c818701c | 0 | temp | temp@123 | 2016-03-17 13:40:03 | | 306 | b91cddba | 0 | teamspeak | teamspeak | 2016-03-17 13:41:22 | | 307 | b91cddba | 0 | teamspeak | teamspeak123 | 2016-03-17 13:41:23 | | 308 | b91cddba | 0 | teamspeak | teamspeak@123 | 2016-03-17 13:41:24 | | 309 | 7824f9c8 | 0 | teamspeak3 | teamspeak3 | 2016-03-17 13:42:14 | | 310 | 579efb8e | 0 | tomcat | tomcat | 2016-03-17 13:43:27 | | 311 | 579efb8e | 0 | tomcat | tomcat123 | 2016-03-17 13:43:28 | | 312 | 579efb8e | 0 | tomcat | tomcat@123 | 2016-03-17 13:43:29 | | 313 | 9faca778 | 0 | tomcat | 1q2w3e4r | 2016-03-17 13:44:19 | | 314 | 9b5ed04f | 0 | ubuntu | ubuntu | 2016-03-17 13:45:28 | | 315 | 9b5ed04f | 0 | ubuntu | ubuntu123 | 2016-03-17 13:45:29 | | 316 | 9b5ed04f | 0 | ubuntu | ubuntu@123 | 2016-03-17 13:45:30 | | 317 | 4827aa0c | 0 | vikas | vikas | 2016-03-17 13:46:47 | | 318 | 4827aa0c | 0 | vikas | vikas123 | 2016-03-17 13:46:49 | | 319 | 4827aa0c | 0 | vikas | vikas@123 | 2016-03-17 13:46:50 | | 320 | fee4f756 | 0 | vnc | vnc | 2016-03-17 13:48:09 | | 321 | fee4f756 | 0 | vnc | vnc123 | 2016-03-17 13:48:11 | | 322 | fee4f756 | 0 | vnc | vnc@123 | 2016-03-17 13:48:12 | | 323 | 8fd017ef | 0 | vinay | vinay | 2016-03-17 13:49:27 | | 324 | 8fd017ef | 0 | vinay | vinay123 | 2016-03-17 13:49:28 | | 325 | 8fd017ef | 0 | vinay | vinay@123 | 2016-03-17 13:49:30 | | 326 | 6b12ebf6 | 0 | vivek | vivek | 2016-03-17 13:50:43 | | 327 | 6b12ebf6 | 0 | vivek | vivek123 | 2016-03-17 13:50:44 | | 328 | 6b12ebf6 | 0 | vivek | vivek@123 | 2016-03-17 13:50:45 | | 329 | 48050e3e | 0 | vbox | vbox | 2016-03-17 13:51:58 | | 330 | 48050e3e | 0 | vbox | vbox123 | 2016-03-17 13:52:00 | | 331 | 48050e3e | 0 | vbox | vbox@123 | 2016-03-17 13:52:01 | | 332 | 551d045e | 0 | yang | yang | 2016-03-17 13:53:17 | | 333 | 551d045e | 0 | yang | yang123 | 2016-03-17 13:53:18 | | 334 | 551d045e | 0 | yang | yang@123 | 2016-03-17 13:53:19 | | 335 | 984b10c5 | 0 | support | support | 2016-03-17 13:54:40 | | 336 | 984b10c5 | 0 | support | support123 | 2016-03-17 13:54:41 | | 337 | 984b10c5 | 0 | support | support@123 | 2016-03-17 13:54:42 | | 338 | d874a0d1 | 0 | sandeep | sandeep | 2016-03-17 13:56:00 | | 339 | d874a0d1 | 0 | sandeep | sandeep123 | 2016-03-17 13:56:01 | | 340 | d874a0d1 | 0 | sandeep | sandeep@123 | 2016-03-17 13:56:02 | | 341 | 04012fdd | 0 | sanjeev | sanjeev | 2016-03-17 13:57:14 | | 342 | 04012fdd | 0 | sanjeev | sanjeev123 | 2016-03-17 13:57:16 | | 343 | 04012fdd | 0 | sanjeev | sanjeev@123 | 2016-03-17 13:57:17 | | 344 | 443e513f | 0 | sphinx | sphinx | 2016-03-17 13:58:31 | | 345 | 443e513f | 0 | sphinx | sphinx123 | 2016-03-17 13:58:32 | | 346 | 443e513f | 0 | sphinx | sphinx@123 | 2016-03-17 13:58:33 | | 347 | 74506a68 | 0 | sunil | sunil | 2016-03-17 13:59:48 | | 348 | 74506a68 | 0 | sunil | sunil123 | 2016-03-17 13:59:49 | | 349 | 74506a68 | 0 | sunil | sunil@123 | 2016-03-17 13:59:50 | | 350 | 8a3d4ba4 | 0 | student | student | 2016-03-17 14:01:08 | | 351 | 8a3d4ba4 | 0 | student | student123 | 2016-03-17 14:01:10 | | 352 | 8a3d4ba4 | 0 | student | student@123 | 2016-03-17 14:01:11 | | 353 | 8d24fa76 | 0 | siva | siva | 2016-03-17 14:02:28 | | 354 | 8d24fa76 | 0 | siva | siva123 | 2016-03-17 14:02:29 | | 355 | 8d24fa76 | 0 | siva | siva@123 | 2016-03-17 14:02:30 | | 356 | 7cd31f3d | 0 | sk | sk | 2016-03-17 14:03:43 | | 357 | 7cd31f3d | 0 | sk | sk123 | 2016-03-17 14:03:45 | | 358 | 7cd31f3d | 0 | sk | sk@123 | 2016-03-17 14:03:46 | | 359 | 16fe4ee0 | 0 | sh | sh | 2016-03-17 14:05:00 | | 360 | 16fe4ee0 | 0 | sh | sh123 | 2016-03-17 14:05:01 | | 361 | 16fe4ee0 | 0 | sh | sh@123 | 2016-03-17 14:05:02 | | 362 | 6cdb9096 | 0 | soc | soc | 2016-03-17 14:06:19 | | 363 | 6cdb9096 | 0 | soc | soc123 | 2016-03-17 14:06:20 | | 364 | 6cdb9096 | 0 | soc | soc@123 | 2016-03-17 14:06:21 | | 365 | f6962408 | 0 | raju | raju | 2016-03-17 14:07:40 | | 366 | f6962408 | 0 | raju | raju123 | 2016-03-17 14:07:41 | | 367 | f6962408 | 0 | raju | raju@123 | 2016-03-17 14:07:42 | | 368 | 0f85c933 | 0 | raghu | raghu | 2016-03-17 14:08:59 | | 369 | 0f85c933 | 0 | raghu | raghu123 | 2016-03-17 14:09:01 | | 370 | 0f85c933 | 0 | raghu | raghu@123 | 2016-03-17 14:09:02 | | 371 | b22dad05 | 0 | rakesh | rakesh | 2016-03-17 14:10:15 | | 372 | b22dad05 | 0 | rakesh | rakesh123 | 2016-03-17 14:10:16 | | 373 | b22dad05 | 0 | rakesh | rakesh@123 | 2016-03-17 14:10:18 | | 374 | 86c9c6c4 | 0 | rajesh | rajesh | 2016-03-17 14:11:31 | | 375 | 86c9c6c4 | 0 | rajesh | rajesh123 | 2016-03-17 14:11:33 | | 376 | 86c9c6c4 | 0 | rajesh | rajesh@123 | 2016-03-17 14:11:34 | | 377 | e6196576 | 0 | ranjit | ranjit | 2016-03-17 14:12:51 | | 378 | e6196576 | 0 | ranjit | ranjit123 | 2016-03-17 14:12:52 | | 379 | e6196576 | 0 | ranjit | ranjit@123 | 2016-03-17 14:12:53 | | 380 | cc873cc2 | 0 | ranjeet | ranjeet | 2016-03-17 14:14:11 | | 381 | cc873cc2 | 0 | ranjeet | ranjeet123 | 2016-03-17 14:14:13 | | 382 | cc873cc2 | 0 | ranjeet | ranjeet@123 | 2016-03-17 14:14:14 | | 383 | 0faf229b | 0 | redmine | redmine | 2016-03-17 14:15:29 | | 384 | 0faf229b | 0 | redmine | redmine123 | 2016-03-17 14:15:30 | | 385 | 0faf229b | 0 | redmine | redmine@123 | 2016-03-17 14:15:31 | | 386 | 534f150d | 0 | yuvraj | yuvraj | 2016-03-17 14:16:43 | | 387 | 534f150d | 0 | yuvraj | yuvraj123 | 2016-03-17 14:16:44 | | 388 | 534f150d | 0 | yuvraj | yuvraj@123 | 2016-03-17 14:16:45 | | 389 | 88c83731 | 0 | wangyi | wangyi | 2016-03-17 14:18:00 | | 390 | 88c83731 | 0 | wangyi | wangyi123 | 2016-03-17 14:18:02 | | 391 | 88c83731 | 0 | wangyi | wangyi@123 | 2016-03-17 14:18:03 | | 392 | 380022d9 | 0 | webuser | webuser | 2016-03-17 14:19:19 | | 393 | 380022d9 | 0 | webuser | webuser123 | 2016-03-17 14:19:21 | | 394 | 380022d9 | 0 | webuser | webuser@123 | 2016-03-17 14:19:22 | | 395 | 929e7ab9 | 0 | webftp | webftp | 2016-03-17 14:20:37 | | 396 | 929e7ab9 | 0 | webftp | webftp123 | 2016-03-17 14:20:38 | | 397 | 929e7ab9 | 0 | webftp | webftp@123 | 2016-03-17 14:20:40 | | 398 | 35768f1d | 0 | zori | zori | 2016-03-17 14:21:56 | | 399 | 35768f1d | 0 | zori | zori123 | 2016-03-17 14:21:57 | | 400 | 35768f1d | 0 | zori | zori@123 | 2016-03-17 14:21:58 | +-----+----------+---------+-------------------+-----------------+---------------------+
sshハニーポットをkippoからcowrieへ変更した
経緯
@neglect_yp cowrieでたてた方がいい、kippoは色々と使い物にならないよ。
— ジャンクさん@進学?? (@junk_coken) 2016年3月16日
@neglect_yp マ
— ジャンクさん@進学?? (@junk_coken) 2016年3月16日
大抵攻撃者は$ssh ユーザー名@アドレス コマンド
で行動してきて、kippoはその辺のサポートができてなかったような…。
kippoでエミュレートできてない部分ばかり突いてくるからエラー吐くかバレるかしてると思う。
導入
参考にしたサイト
- CentOS 6.5 に MariaDB 5.5 をインストールする | CUBE SUGAR STORAGE
- ハニーポットcowrieのログを、mariaDBで管理しよう。 | Simple blog @atani
色々つっかえたんだが、眠いしほぼ覚えていないのでぼちぼち思い出しつつ書いていく。
CentOS 6.5にkippoを導入した
kippoとは
kippoは、sshdが動いているように見せるハニーポット。
参考にしたサイト
導入
基本的には上記のサイトを見ながらできたので、詰まったところだけ補足として書く。
Pythonのバージョン
CentOS 6.5に入っているPythonのバージョンが2.6なので、
# pip install pyasn1 pycrypto twisted
で詰まる。
これを参考にして、2.7を入れた。
Twistedのバージョン
Twistedのバージョンの違いで、start.sh
を実行した際にエラーが出る。
# pip install twisted==9.0.0
として、古いバージョンを導入するとうまく実行できた。
diffie-hellman-group1-sha1
ログ取得のテストでsshでkippoが動いているポートに接続しようとしたが、 要求されている鍵交換のメソッドが見つからないみたいなことを言われる。
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@addr