Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add script for detecting Kippo SSH Honeypots #780

Closed
wants to merge 1 commit into from

Conversation

Varunram
Copy link

Made changes suggested at #72
Added missing require statement.

@fgeek
Copy link

fgeek commented Mar 21, 2017

What version did you use when you tested this script? I tested this with Debian 8.7 (stable) and Kippo's git, but kippo-ssh-honeypot.nse didn't find anything. For normal SSH service it says:

Initiating NSE at 19:59
NSE: Starting kippo-ssh-honeypot against 10.0.0.55:22.
NSE: kippo-ssh-honeypot against 10.0.0.55:22 threw an error!
ERROR
stack traceback:
	[C]: in local 'try'
	...o/build/bin/../share/nmap/scripts/kippo-ssh-honeypot.nse:24: in function <...o/build/bin/../share/nmap/scripts/kippo-ssh-honeypot.nse:21>
	(...tail calls...)

Completed NSE at 19:59, 0.65s elapsed

@Varunram
Copy link
Author

A pretty old version of kippo actually. But that shouldn't matter since there were no significant changes to kippo after that. Will test and update comment

@fgeek
Copy link

fgeek commented Mar 22, 2017

Okay thanks. I can retest also in different environment if needed.

@Varunram
Copy link
Author

Found the catch. Looks like it was patched, but a different exploit described at http:https://morris.sc/detecting-kippo-ssh-honeypots/ should work. Working on it

@fgeek
Copy link

fgeek commented Mar 23, 2017

We should add syntax for the both of these to have better coverage. If the payload works we can make some assumption about the running version. If you can tell me the version numbers I can test that the NSE scripts works with both. I'm in #nmap Freenode if you want to chat for faster feedback :)

@Varunram Varunram closed this Mar 12, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants