98 lines
2.8 KiB
JavaScript
98 lines
2.8 KiB
JavaScript
const { FLAGS, createFlagCollection } = require('../flags.js');
|
|
const logIpToFile = require('../logIpToFile.js');
|
|
const tailFile = require('../services/tailFile.js');
|
|
const logger = require('../logger.js');
|
|
const resolvePath = require('../pathResolver.js');
|
|
const { DIONAEA_LOG_FILE, SERVER_ID } = require('../../config.js').MAIN;
|
|
|
|
const LOG_FILE = resolvePath(DIONAEA_LOG_FILE);
|
|
|
|
const getReportDetails = (entry, dpt) => {
|
|
const proto = entry?.connection?.protocol || 'unknown';
|
|
const timestamp = entry?.timestamp || new Date().toISOString();
|
|
|
|
const flags = createFlagCollection();
|
|
let comment;
|
|
|
|
switch (proto) {
|
|
case 'mssqld': {
|
|
const username = entry?.credentials?.username?.[0];
|
|
const password = entry?.credentials?.password?.[0];
|
|
if (username && !password) {
|
|
flags.add(FLAGS.BRUTE_FORCE);
|
|
comment = `MSSQL traffic (on ${dpt}) with username ${username} and empty password`;
|
|
} else if (username && password) {
|
|
flags.add(FLAGS.BRUTE_FORCE);
|
|
comment = `MSSQL traffic (on ${dpt}) with credentials ${username}:${password}`;
|
|
} else {
|
|
flags.add(FLAGS.PORT_SCAN);
|
|
comment = `MSSQL traffic (on ${dpt}) without login credentials`;
|
|
}
|
|
break;
|
|
}
|
|
case 'httpd':
|
|
flags.add(FLAGS.HTTP, FLAGS.BAD_WEB_BOT);
|
|
comment = `Incoming HTTP traffic on port ${dpt}`;
|
|
break;
|
|
case 'ftp':
|
|
flags.add(FLAGS.FTP, FLAGS.BRUTE_FORCE);
|
|
comment = `FTP brute-force or probing on port ${dpt}`;
|
|
break;
|
|
case 'smbd':
|
|
flags.add(FLAGS.SMB);
|
|
comment = `SMB traffic on port ${dpt}`;
|
|
break;
|
|
case 'mysql':
|
|
flags.add(FLAGS.BRUTE_FORCE);
|
|
comment = `MySQL brute-force or probing on port ${dpt}`;
|
|
break;
|
|
case 'tftp':
|
|
flags.add(FLAGS.EXPLOITED_HOST);
|
|
comment = `TFTP protocol traffic on ${dpt}`;
|
|
break;
|
|
case 'upnp':
|
|
case 'mqtt':
|
|
flags.add(FLAGS.IOT_TARGETED);
|
|
comment = `Unauthorized ${proto.toUpperCase()} traffic on ${dpt}`;
|
|
break;
|
|
default:
|
|
flags.add(FLAGS.PORT_SCAN);
|
|
comment = `Unauthorized traffic on ${dpt}/${proto}`;
|
|
}
|
|
|
|
return {
|
|
proto: proto.toUpperCase(),
|
|
comment: `Honeypot ${SERVER_ID ? `[${SERVER_ID}]` : 'hit'}: ${comment}`,
|
|
categories: flags.toString(),
|
|
timestamp,
|
|
};
|
|
};
|
|
|
|
module.exports = reportIp => {
|
|
tailFile(LOG_FILE, async line => {
|
|
if (!line.length) return;
|
|
|
|
let entry;
|
|
try {
|
|
entry = JSON.parse(line);
|
|
} catch (err) {
|
|
return logger.error(`DIONAEA -> JSON parse error: ${err.message}\nFaulty line: ${JSON.stringify(line)}`);
|
|
}
|
|
|
|
try {
|
|
const srcIp = entry?.src_ip;
|
|
const dpt = entry?.dst_port;
|
|
if (!srcIp || !dpt) return;
|
|
|
|
const { proto, timestamp, categories, comment } = getReportDetails(entry, dpt);
|
|
await reportIp('DIONAEA', { srcIp, dpt, proto, timestamp }, categories, comment);
|
|
|
|
await logIpToFile(srcIp, { honeypot: 'DIONAEA', comment });
|
|
} catch (err) {
|
|
logger.error(err);
|
|
}
|
|
}, { label: 'DIONAEA' }).catch(err => logger.error(err));
|
|
|
|
logger.success('🛡️ DIONAEA » Watcher initialized');
|
|
};
|