cymmetria / mtpot Goto Github PK
View Code? Open in Web Editor NEWOpen Source Telnet Honeypot
License: MIT License
Open Source Telnet Honeypot
License: MIT License
When trying to run the script, I'm getting
c:\Work\MTPot>MTPot.py -v mirai_conf.json
Traceback (most recent call last):
File "C:\Work\MTPot\MTPot.py", line 6, in <module>
from telnetsrv.green import TelnetHandler, command
File "C:\Python\lib\site-packages\telnetsrv\green.py", line 6, in <module>
from telnetsrvlib import TelnetHandlerBase, command
File "C:\Python\lib\site-packages\telnetsrv\telnetsrvlib.py", line 29, in <module>
import curses.ascii
File "C:\Python\lib\curses\__init__.py", line 15, in <module>
from _curses import *
ImportError: No module named _curses
Has this script ever been tested on a Windows machine? I realize that it's not your fault that the author(s) of telnetsrv
seem to think that the whole world is Linux, but perhaps you could contact them and suggest them to resort to wcurses
on Windows machines or something?
getting this error after a connection/login is received
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/gevent/greenlet.py", line 327, in run
result = self._run(*self.args, **self.kwargs)
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 821, in inputcooker
c2 = self._inputcooker_getc(block=False)
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 774, in _inputcooker_getc
if not self.inputcooker_socket_ready():
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/green.py", line 44, in inputcooker_socket_ready
return gevent.select.select([self.sock.fileno()], [], [], 0) != ([], [], [])
AttributeError: 'module' object has no attribute 'select'
<Greenlet at 0x76600080: <bound method MyTelnetHandler.inputcooker of <main.MyTelnetHandler instance at 0x765f5e68>>> failed with AttributeError
The Mirai scanners run the command "cat /bin/echo" in order to determine system architecture, after which the scanner will run a wget command to fetch the mirai malware.
The following response is sufficient to trigger the wget command: '\x7fELF\x01\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x08\x00\x00\x00\x00\x00'
Unfortunately, this string can't be included in the json "commands", since it includes control characters. If you would like to include this functionality, and have an idea for how to include it, I will put it in a pull request. In my local branch I just added a special check for this inside get_busybox_response(), but that is kind of a hacky/ugly solution.
I'm seeing every(?) connection hang about in a CLOSE_WAIT state and they never seem to fully close.
After a few hours MTPot needs restarted as it runs out of FDs. Example output below:
netstat -pn |grep 15439 | grep CLOSE_WAIT |wc -l
234
(15439 is the MTPot PID)
to capture other variants:
"MIRAI": "MIRAI: applet not found",
"DONGS": "DONGS: applet not found",
"MEMES": "MEMES: applet not found",
"THTC": "THTC: applet not found",
When connecting. If you send a built in command or trigger an error, it will send the python error to the connecting host.
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Username:
Password:
welcome
dir
ps faux
ls
help
Help on built in commands
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 992, in handle
self.COMMANDScmd
File "/usr/local/lib/python2.7/dist-packages/telnetsrv/telnetsrvlib.py", line 910, in cmdHELP
doc = method.doc.split("\n")
AttributeError: 'NoneType' object has no attribute 'split'
Connection closed by foreign host.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.