Jannich Brendle on January 20th, 2012

Once upon a time, I registered a user on demonoid.me, the bittorrent tracker. I noticed that people are searching for demonoid invitation codes on Google. I found out that I have ten invites that I can use as I wish (except selling!), so I decided to give them away here. Yes, the invitation codes are behind a content locker, meaning you have to fill out a survey in order to get the invitation code – if you don’t want to, don’t do it, I’m not forcing you. ;-)

Anyhow, here’s the links to the demonoid invitation code:

Demonoid invitation code 1
Demonoid invitation code 2
Demonoid invitation code 3
Demonoid invitation code 4
Demonoid invitation code 5
Demonoid invitation code 6
Demonoid invitation code 7
Demonoid invitation code 8
Demonoid invitation code 9
Demonoid invitation code 10

I will add a new demonoid invitation code as often as I can, so this list will keep growing.

Jannich Brendle on January 19th, 2012

Quite a mouthful that title, eh? ;-)

Anyhow, if you get tons of an alert like

(snort decoder) IPV6 truncated header

and would like to remove it, open the file /etc/snort/threshold.conf/ in your favorite browser and add this line:

suppress gen_id 116, sig_id 273

Next, if you have just installed snort, open /etc/snort/snort.conf and find the following line:
# include threshold.conf
and replace it with:
include threshold.conf

Restart snort: /etc/init.d/snort restart

Now you should be set to go! :-)

Jannich Brendle on January 18th, 2012

The practice of running a honeypot, or, running a system with a bad configuration ON PURPOSE, might seem a it odd to most people. However, running an honeypot server can be quite fun and you might learn a bit or two about those evil hax0rs while you’re at it.

I decided to run an SSH honeypot on my server, to get better insight into what crackers are doing once they get root on a box they don’t own already. So, I installed Kippo and I thought you should know how to do it.

BEFORE ANYTHING ELSE:

Remember to set your REAL SSH daemon to listen on another port than port 22, or this will not work!

Now, log in to the server you want to run the honeypot on. Next, download kippo and unpack it on your server:

wget http://kippo.googlecode.com/files/kippo-0.5.tar.gz
tar xzf kippo-0.5.tar.gz
cd kippo-0.5

Next, you must install a couple of packages:

sudo apt-get install python-twisted authbind

Now, because you don’t want to run Kippo as root, the fake SSH daemon will not, by default listen on port 22, like the real SSH daemon, so we need to fix that!

Open the file kippo.cfg in your favorite editor and find the line that says ssh_port = 2222 change it to ssh_port = 22 and save the file.

Then, open start.sh and replace twistd -y kippo.tac -l log/kippo.log --pidfile kippo.pid with authbind --deep twistd -y kippo.tac -l log/kippo.log --pidfile kippo.pid

Next, input these three lines, and substitute kippo:kippo with the username running the honeypot:
sudo touch /etc/authbind/byport/22
sudo chown kippo:kippo /etc/authbind/byport/22
sudo chmod 777 /etc/authbind/byport/22

And then, you start Kippo: ./start.sh

Now hopefully, if everything works out, you should be able to connect via SSH client to your new honeypot. Now, the really cool part comes when someone actually think that they’ve “pwned ur box”. See, in the log/tty/ directory, there will be saved replays of everything the attacker writes in the terminal. To play one of those replays: python utils/playlog.py log/tty/somenumbershere.log where somenumbershere of course should be replaced with an existing file in the log/tty/ directory.

How cool is THAT?! :-D