Unlink scripts submodule and commit contents as normal directory

scripts/honeypots/dionaea.js

@@ -0,0 +1,97 @@
+const { FLAGS, createFlagCollection } = require('../flags.js');
+const logIpToFile = require('../logIpToFile.js');
+const tailFile = require('../services/tailFile.js');
+const logger = require('../logger.js');
+const resolvePath = require('../pathResolver.js');
+const { DIONAEA_LOG_FILE, SERVER_ID } = require('../../config.js').MAIN;
+
+const LOG_FILE = resolvePath(DIONAEA_LOG_FILE);
+
+const getReportDetails = (entry, dpt) => {
+	const proto = entry?.connection?.protocol || 'unknown';
+	const timestamp = entry?.timestamp || new Date().toISOString();
+
+	const flags = createFlagCollection();
+	let comment;
+
+	switch (proto) {
+	case 'mssqld': {
+		const username = entry?.credentials?.username?.[0];
+		const password = entry?.credentials?.password?.[0];
+		if (username && !password) {
+			flags.add(FLAGS.BRUTE_FORCE);
+			comment = `MSSQL traffic (on ${dpt}) with username ${username} and empty password`;
+		} else if (username && password) {
+			flags.add(FLAGS.BRUTE_FORCE);
+			comment = `MSSQL traffic (on ${dpt}) with credentials ${username}:${password}`;
+		} else {
+			flags.add(FLAGS.PORT_SCAN);
+			comment = `MSSQL traffic (on ${dpt}) without login credentials`;
+		}
+		break;
+	}
+	case 'httpd':
+		flags.add(FLAGS.HTTP, FLAGS.BAD_WEB_BOT);
+		comment = `Incoming HTTP traffic on port ${dpt}`;
+		break;
+	case 'ftp':
+		flags.add(FLAGS.FTP, FLAGS.BRUTE_FORCE);
+		comment = `FTP brute-force or probing on port ${dpt}`;
+		break;
+	case 'smbd':
+		flags.add(FLAGS.SMB);
+		comment = `SMB traffic on port ${dpt}`;
+		break;
+	case 'mysql':
+		flags.add(FLAGS.BRUTE_FORCE);
+		comment = `MySQL brute-force or probing on port ${dpt}`;
+		break;
+	case 'tftp':
+		flags.add(FLAGS.EXPLOITED_HOST);
+		comment = `TFTP protocol traffic on ${dpt}`;
+		break;
+	case 'upnp':
+	case 'mqtt':
+		flags.add(FLAGS.IOT_TARGETED);
+		comment = `Unauthorized ${proto.toUpperCase()} traffic on ${dpt}`;
+		break;
+	default:
+		flags.add(FLAGS.PORT_SCAN);
+		comment = `Unauthorized traffic on ${dpt}/${proto}`;
+	}
+
+	return {
+		proto: proto.toUpperCase(),
+		comment: `Honeypot ${SERVER_ID ? `[${SERVER_ID}]` : 'hit'}: ${comment}`,
+		categories: flags.toString(),
+		timestamp,
+	};
+};
+
+module.exports = reportIp => {
+	tailFile(LOG_FILE, async line => {
+		if (!line.length) return;
+
+		let entry;
+		try {
+			entry = JSON.parse(line);
+		} catch (err) {
+			return logger.error(`DIONAEA -> JSON parse error: ${err.message}\nFaulty line: ${JSON.stringify(line)}`);
+		}
+
+		try {
+			const srcIp = entry?.src_ip;
+			const dpt = entry?.dst_port;
+			if (!srcIp || !dpt) return;
+
+			const { proto, timestamp, categories, comment } = getReportDetails(entry, dpt);
+			await reportIp('DIONAEA', { srcIp, dpt, proto, timestamp }, categories, comment);
+
+			await logIpToFile(srcIp, { honeypot: 'DIONAEA', comment });
+		} catch (err) {
+			logger.error(err);
+		}
+	}, { label: 'DIONAEA' }).catch(err => logger.error(err));
+
+	logger.success('🛡️ DIONAEA » Watcher initialized');
+};