Re: Honeyd-Windows emulation scripts and experience

["Peter Bates" <Peter.Bates () lshtm ac uk>]

Hello all...

> "Roger A. Grimes" <rogerg () cox net> 24/07/03 14:52:17 >>>
> I'm in the process of writing a book about Honeypots for Windows.  I'm >using Michael Davis' port of Niels Provos' 
> Honeyd as one of the main 
> parts of the book.

> I'm interested in if anyone has produce any Windows emulation service
> scripts beyond the one or two that I can find with the normal 
> distributions?

This is an interesting question, as I've been thinking about much the same area recently... I would hasten to add 
though that I don't use, or choose to use, honeyd on Windows, but I'm happily using it on other platforms.

Recently, inspired by an article on 'SMB Lures', I've been investigating using Samba to attract the attention of 
Windows share propogating worms, etc. Honeyd of course, with the 'proxy' option allows you to map the traffic destined 
for virtual addresses to a 'real' box. I haven't, however, so far found an entirely convincing Samba configuration that 
doesn't suggest the whole process would be easier with a high-interaction, actual install of Windows itself.

I was thinking the other day about a generic 'call/response' type listener for honeyd... it would know the destination 
port when requested (e.g. 1433) and then have a big list of call/response type things, e.g. for SMTP:

- Host connects to port 25
- Script is invoked and passed destination port 25
- Script checks 'response dictionary' for port 25, and returns
'220 a.b.c.d' (possibly substituting in)
- Host sends 'HELO x'
- Script responds... etc. etc.

Similar things could be set up for each simple unencrypted protocol, with substitution, or possibly other commands set 
off as a result of certain 'calls' ...

I don't know whether such a thing is possible or too over simplistic, but it might help in this instance.



--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, Network Support Team.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838