\u30fbCowrie\u306e\u5c0e\u5165(\u307b\u3068\u3093\u3069GitHub – micheloosterhof\/cowrie<\/a>\u306e\u624b\u9806\u901a\u308a) \u25a02. \u5fc5\u8981\u306a\u30d1\u30c3\u30b1\u30fc\u30b8\u985e\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb<\/p>\n \u25a03. \u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb<\/p>\n \u25a04. \u5b9f\u884c\u3068\u7d42\u4e86<\/p>\n Cowrie\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u30672222\u756a\u304c\u5f85\u3061\u53d7\u3051\u30dd\u30fc\u30c8\u306a\u306e\u3067\uff0c\u6b21\u306e\u8a2d\u5b9a\u306b\u3088\u308a22\u756a\u306b\u6765\u305f\u901a\u4fe1\u30922222\u756a\u306b\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3059\u308b\u3002 \u4ee5\u4e0a\u306e\u8a2d\u5b9a\u3067\uff0cssh\u30cf\u30cb\u30fc\u30dd\u30c3\u30c8Cowrie\u304c\u69cb\u7bc9\u3067\u304d\u308b\u3002\u3061\u306a\u307f\u306b\uff0cCowrie\u7528\u306e\u30c0\u30df\u30fc\u30e6\u30fc\u30b6\u30fc\u60c5\u5831\u306f \u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306b\uff0c \u30fbKippo-Graph\u306e\u5c0e\u5165 \u25a02. Cowrie\u7528\u306e\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u306e\u4f5c\u6210<\/p>\n \u25a03. Cowrie\u306e\u30ed\u30b0\u3092MySql\u306b\u4fdd\u5b58\u3059\u308b\u8a2d\u5b9a<\/p>\n \u25a04. Apache2\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\u8a2d\u5b9a<\/p>\n \u25a05. Kippo-Graph\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb(ver.1.5.1)<\/p>\n Kippo-Graph\u306f\u3082\u3068\u3082\u3068Kippo\u306e\u305f\u3081\u306b\u4f5c\u6210\u3055\u308c\u305f\u3082\u306e\u306a\u306e\u3067\uff0cCowrie\u3067\u306f\u52d5\u304b\u306a\u3044\u90e8\u5206\u3082\u3042\u308b\u306e\u3067\uff0c\u305d\u306e\u90e8\u5206\u306e\u4fee\u6b63\u3092\u884c\u3046\u3002 \u25a07. Cowrie\u8d77\u52d5\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u4fee\u6b63<\/p>\n \u25a08. Cowrie\u306e\u518d\u8d77\u52d5<\/p>\n \u4ee5\u4e0a\u3067 Cowrie \u3068 Kippo-Graph \u306e\u5c0e\u5165\u306f\u5b8c\u4e86<\/p>\n \u3053\u3093\u306a\u611f\u3058\u306e\u753b\u9762\u304c\u8868\u793a\u3055\u308c\u308b\u3002 \u53c2\u8003\u30b5\u30a4\u30c8 \u4e45\u3057\u3076\u308a\u306e\u6295\u7a3f\u306b\u306a\u308b\u3002 \u4ee5\u524d\u304b\u3089\u8208\u5473\u306e\u3042\u3063\u305f\u30cf\u30cb\u30fc\u30dd\u30c3\u30c8\u306b\u3064\u3044\u3066\uff0cSSH\u306e\u3082\u306e\u304c\u3042\u308b\u3068\u805e\u304d\uff0c\u7720\u3063\u3066\u3044\u305f Paspberry Pi3 Model B \u3092\u7528\u3044\u3066\u69cb\u7bc9\u3092\u884c\u3063\u305f\u3002 \u4f7f\u7528\u3057\u305f\u30cf\u30cb\u30fc\u30dd\u30c3\u30c8\u306f Cowrie \u3068\u547c\u3070\u308c\u308b […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,6],"tags":[],"class_list":["post-505","post","type-post","status-publish","format-standard","hentry","category-linux","category-6"],"_links":{"self":[{"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=505"}],"version-history":[{"count":14,"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/505\/revisions"}],"predecessor-version":[{"id":809,"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/505\/revisions\/809"}],"wp:attachment":[{"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.alprovs.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\u25a01. Cowrie\u7528\u306e\u30e6\u30fc\u30b6\u30fc\u8ffd\u52a0<\/p>\nadduser cowrie\r\npasswd cowrie<\/pre>\n
$ sudo apt-get install git python-virtualenv libmpfr-dev libssl-dev libmpc-dev libffi-dev build-essential libpython-dev python2.7-minimal authbind python-setuptools python-dev\r\n$ sudo su - cowrie\r\n$ git clone http:\/\/github.com\/micheloosterhof\/cowrie\r\n$ cd cowrie\r\n$ pwd\r\n\/home\/cowrie\/cowrie\r\n$ virtualenv cowrie-env\r\n$ source cowrie-env\/bin\/activate\r\n(cowrie-env) $ pip install -r requirements.txt<\/pre>\n
$ pwd\r\n\/home\/cowrie\/cowrie\r\n$ cp cowrie.dfg.dist cowrie.cfg\r\n$ vi cowrie.cfg <- \u5fc5\u8981\u306a\u8a2d\u5b9a\u3092\u884c\u3063\u3066\u304f\u3060\u3055\u3044(\u305d\u306e\u307e\u307e\u3067\u3082\u52d5\u4f5c\u3059\u308b\u305d\u3046\u3067\u3059)<\/pre>\n
$ .\/bin\/cowrie start\r\n$ .\/bin\/cowrie stop<\/pre>\n
\n\u25a05. \u30dd\u30fc\u30c8\u30ea\u30c0\u30a4\u30ec\u30af\u30c8<\/p>\n$ sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222<\/pre>\n
\/home\/cowrie\/cowrie\/data\/userdb.txt<\/code>\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u3002
\n\u25a0vi \/home\/cowrie\/cowrie\/data\/userdb.txt<\/p>\nroot:x:!root\r\nroot:x:123456\r\nroot:x:password<\/pre>\n
\u30e6\u30fc\u30b6\u30fc\u540d:x:\u30d1\u30b9\u30ef\u30fc\u30c9<\/code>\u306e\u3088\u3046\u306b\u8a18\u8ff0\u3059\u308b\u3053\u3068\u3067\uff0c\u30c0\u30df\u30fc\u30e6\u30fc\u30b6\u30fc\u3092\u5b9a\u7fa9\u3067\u304d\u308b\u3002(\u4e0a\u306e\u8a2d\u5b9a\u3067\u306f\uff0croot\/123456 , root\/password\u306e\u7d44\u307f\u5408\u308f\u305b\u3067ssh\u306b\u30ed\u30b0\u30a4\u30f3\u3067\u304d\u308b)<\/p>\n
\n\u25a01. MySql\u306e\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7<\/p>\n$ sudo apt-get install mysql-server libmysqlclient-dev \r\n\r\n$ mysql_secure_installation\r\n\r\nNOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL\r\n SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!\r\n\r\nIn order to log into MySQL to secure it, we'll need the current\r\npassword for the root user. If you've just installed MySQL, and\r\nyou haven't set the root password yet, the password will be blank,\r\nso you should just press enter here.\r\n\r\nEnter current password for root (enter for none): \r\nOK, successfully used password, moving on...\r\n\r\nSetting the root password ensures that nobody can log into the MySQL\r\nroot user without the proper authorisation.\r\n\r\nYou already have a root password set, so you can safely answer 'n'.\r\n\r\nChange the root password? [Y\/n] n\r\n ... skipping.\r\n\r\nBy default, a MySQL installation has an anonymous user, allowing anyone\r\nto log into MySQL without having to have a user account created for\r\nthem. This is intended only for testing, and to make the installation\r\ngo a bit smoother. You should remove them before moving into a\r\nproduction environment.\r\n\r\nRemove anonymous users? [Y\/n] Y\r\n ... Success!\r\n\r\nNormally, root should only be allowed to connect from 'localhost'. This\r\nensures that someone cannot guess at the root password from the network.\r\n\r\nDisallow root login remotely? [Y\/n] Y\r\n ... Success!\r\n\r\nBy default, MySQL comes with a database named 'test' that anyone can\r\naccess. This is also intended only for testing, and should be removed\r\nbefore moving into a production environment.\r\n\r\nRemove test database and access to it? [Y\/n] Y\r\n - Dropping test database...\r\nERROR 1008 (HY000) at line 1: Can't drop database 'test'; database doesn't exist\r\n ... Failed! Not critical, keep moving...\r\n - Removing privileges on test database...\r\n ... Success!\r\n\r\nReloading the privilege tables will ensure that all changes made so far\r\nwill take effect immediately.\r\n\r\nReload privilege tables now? [Y\/n] Y\r\n ... Success!\r\n\r\nCleaning up...\r\n\r\nAll done! If you've completed all of the above steps, your MySQL\r\ninstallation should now be secure.\r\n\r\nThanks for using MySQL!\r\n\r\n$ sudo vi \/etc\/mysql\/my.cnf\r\n\r\n[mysql]\r\ndefault-character-set=utf8\r\n\r\n$ sudo systemctl restart mysql<\/pre>\n
$ mysql -u root -p\r\nEnter password:\r\nmysql> create database cowrie;\r\nmysql> grant all privileges on cowrie.* to cowrie@localhost identified by 'cowrie_password';\r\nmysql> quit\r\n\r\n$ cd \/home\/cowrie\/cowrie\r\n$ mysql -u cowrie -p\r\nEnter password:\r\nmysql> source doc\/sql\/mysql.sql\r\nmysql> quit<\/pre>\n
$ pwd\r\n\/home\/cowrie\/cowrie\r\n$ vi cowrie.cfg\r\n#[output_mysql]\r\n#host = localhost\r\n#database = cowrie\r\n#username = cowrie\r\n#password = secret\r\n#port = 3306\r\n \u2193\r\n[output_mysql]\r\nhost = localhost\r\ndatabase = cowrie\r\nusername = cowrie\r\npassword = cowrie_password\r\nport = 3306<\/pre>\n
$ sudo apt-get install apache2\r\n$ sudo nano \/etc\/apache2\/conf-available\/security.conf\r\nServerTokens Prod\r\nServerSignature Off\r\n\r\n$ sudo vi \/etc\/apache2\/conf-available\/charset.conf\r\n#AddDefaultCharset UTF-8\r\n\r\n$ sudo apachectl configtest\r\n$ sudo systemctl restart apache2<\/pre>\n
$ wget http:\/\/bruteforce.gr\/wp-content\/uploads\/kippo-graph-1.5.1.tar.gz\r\n$ sudo tar zxvf kippo-graph-1.5.1.tar.gz -C \/usr\/share\r\n$ sudo vi \/etc\/apache2\/conf-available\/kippo-graph.conf\r\n<IfModule mod_alias.c>\r\n Alias \/kippo-graph \/usr\/share\/kippo-graph-1.5.1\r\n<\/IfModule>\r\n$ sudo a2enconf kippo-graph\r\n$ sudo apachectl configtest\r\n$ sudo systemctl restart apache2\r\n$ sudo chmod 777 \/usr\/share\/kippo-graph-1.5.1\/generated-graphs\/\r\n$ sudo cp -p \/usr\/share\/kippo-graph-1.5.1\/config.php.dist \/usr\/share\/kippo-graph-1.5.1\/config.php\r\n$ sudo vi \/usr\/share\/kippo-graph-1.5.1\/config.php\r\ndefine('DB_HOST', 'localhost');\r\ndefine('DB_USER', 'cowrie');\r\ndefine('DB_PASS', 'cowrie_password');\r\ndefine('DB_NAME', 'cowrie');\r\ndefine('DB_PORT', '3306');<\/pre>\n
\n\u25a06. Kippo-Graph\u306e\u4fee\u6b63<\/p>\n$ cd \/usr\/share\/kippo-graph-1.5.1\r\n$ sudo cp -p class\/KippoPlayLog.class.php class\/KippoPlayLog.class.php.org\r\n$ sudo vi class\/KippoPlayLog.class.php\r\n$ $ diff class\/KippoPlayLog.class.php.org class\/KippoPlayLog.class.php\r\n21c21\r\n< SELECT ttylog.session, timestamp, ROUND(LENGTH(ttylog)\/1024, 2) AS size --- > SELECT ttylog.session, timestamp, ROUND(size\/1024, 2) AS sizediff class\/KippoPlayLog.class.php.org class\/KippoPlayLog.class.php\r\n21c21\r\n< SELECT ttylog.session, timestamp, ROUND(LENGTH(ttylog)\/1024, 2) AS size --- > SELECT ttylog.session, timestamp, ROUND(size\/1024, 2) AS size\r\n$ cd \/usr\/share\/kippo-graph-1.5.1\r\n$ sudo cp -p include\/play.php include\/play.php.org\r\n$ sudo vi include\/play.php\r\n$ diff -u .\/include\/play.php.org .\/include\/play.php \r\n--- .\/include\/play.php.org 2017-04-27 21:53:10.404195307 +0900 \r\n+++ .\/include\/play.php 2017-04-27 21:53:44.363874892 +0900 \r\n@@ -67,7 +67,7 @@ \r\n $rows = R::getAll($db_query); \r\n \r\n foreach ($rows as $row) { \r\n- $log = base64_encode($row['ttylog']); \r\n+ $log = base64_encode(file_get_contents($row['ttylog'])); \r\n } \r\n \r\n $db_query = \"SELECT ip, starttime FROM sessions WHERE id='$session'\";\r\n\r\n$ cd \/usr\/share\/kippo-graph-1.5.1\/include\r\n$ sudo ln -s ${COWRIE_INSTALL_DIR}\/log\/ log\r\n$ sudo chgrp www-data \/home\/cowrie\/cowrie\/log\/tty\/\r\n$ sudo chmod g+s \/home\/cowrie\/cowrie\/log\/tty\/<\/pre>\n$ pwd\r\n\/home\/cowrie\/cowrie\r\n$ cp -p start.sh start.sh.org\r\n$ vi start.sh\r\n$ diff -u start.sh.org start.sh\r\n--- .\/start.sh.org 2017-04-27 21:55:42.942756469 +0900 \r\n+++ .\/start.sh 2017-04-27 21:56:47.512147707 +0900 \r\n@@ -37,7 +37,7 @@ \r\n echo \"Starting cowrie with extra arguments [$XARGS $DAEMONIZE] ...\" \r\n if [ $AUTHBIND_ENABLED = \"no\" ] \r\n then \r\n- twistd $XARGS $DAEMONIZE -l log\/cowrie.log --umask 0077 --pidfile ${PIDFILE} cowrie \r\n+ twistd $XARGS $DAEMONIZE -l log\/cowrie.log --umask 0027 --pidfile ${PIDFILE} cowrie \r\n else \r\n- authbind --deep twistd $DAEMONIZE $XARGS -l log\/cowrie.log --umask 0077 --pidfile ${PIDFILE} cowrie\r\n+ authbind --deep twistd $DAEMONIZE $XARGS -l log\/cowrie.log --umask 0027 --pidfile ${PIDFILE} cowrie\r\n fi<\/pre>\n$ pwd\r\n\/home\/cowrie\r\n$ .\/bin\/cowrie stop\r\n$ .\/bin\/cowrie start<\/pre>\n
\n![\"\"](\"https:\/\/www.alprovs.com\/wordpress\/wp-content\/uploads\/2017\/04\/1f9199f82ad11dad3695308195576b00.png\")
<\/a><\/p>\n
\n\u30cf\u30cb\u30fc\u30dd\u30c3\u30c8Cowrie\u3092CentOS7\u306b\u5165\u308c\u3066\u307f\u305f\u3002<\/a>
\n\u30cf\u30cb\u30fc\u30dd\u30c3\u30c8Cowrie\u306e\u30ed\u30b0\u3092MySQL\u306b\u7a81\u3063\u8fbc\u3093\u3067Kippo-Graph\u3067\u53ef\u8996\u5316\u3057\u305f\u8a71<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"