129 lines
3.8 KiB
Python
129 lines
3.8 KiB
Python
import paramiko
|
|
import sys
|
|
|
|
sys.stdout.reconfigure(encoding='utf-8')
|
|
key_path = r'C:\Users\Snarf\.ssh\id_ed25519_snarfnet'
|
|
|
|
c = paramiko.SSHClient()
|
|
c.set_missing_host_key_policy(paramiko.AutoAddPolicy())
|
|
c.connect("140.44.4.71", username="root", key_filename=key_path, timeout=10)
|
|
|
|
new_watcher = """#!/usr/bin/env python3
|
|
import json
|
|
import os
|
|
import sys
|
|
import time
|
|
import urllib.request
|
|
import urllib.error
|
|
|
|
sys.stdout.reconfigure(line_buffering=True)
|
|
|
|
LOG_FILE = "/opt/opencanary/logs/opencanary.log"
|
|
GOTIFY_URL = "http://127.0.0.1:8090/message?token=A9oPeNcAnArYhOnEyPoT"
|
|
|
|
LOGTYPE_NAMES = {
|
|
1000: "Portscan Syn Probe",
|
|
1001: "Canary System Event",
|
|
1002: "Portscan Null Scan",
|
|
1003: "Portscan Xmas Scan",
|
|
1004: "Portscan Fin Scan",
|
|
2000: "FTP Connection",
|
|
2001: "FTP Auth Attempt",
|
|
3000: "HTTP Connection",
|
|
3001: "HTTP Web Login Attempt",
|
|
4000: "SSH Connection",
|
|
4001: "SSH Auth Attempt",
|
|
5000: "SMB Session Request",
|
|
6001: "Telnet Login Attempt",
|
|
7001: "HTTP Proxy Request",
|
|
8001: "MySQL Login Attempt",
|
|
9001: "MSSQL Login Attempt",
|
|
10001: "VNC Connection",
|
|
11001: "Git Clone / Pull Attempt",
|
|
12001: "RDP Connection"
|
|
}
|
|
|
|
def send_alert(event):
|
|
logtype = event.get("logtype", 0)
|
|
# Don't alert on internal canary startup messages
|
|
if logtype == 1001 and "Canary" in str(event.get("logdata", {})):
|
|
return
|
|
|
|
service_name = LOGTYPE_NAMES.get(logtype, f"Canary Event {logtype}")
|
|
src_host = event.get("src_host", "Unknown IP")
|
|
src_port = event.get("src_port", "Unknown Port")
|
|
dst_port = event.get("dst_port", "")
|
|
logdata = event.get("logdata", {})
|
|
|
|
title = f"🚨 [Honeypot Alert] {service_name} from {src_host}"
|
|
|
|
details = []
|
|
details.append(f"• Attacker IP: {src_host}:{src_port}")
|
|
if dst_port and dst_port != -1:
|
|
details.append(f"• Targeted Port: {dst_port}")
|
|
details.append(f"• Decoy IP: 14.4.4.99 (VLAN 50 Smart Home)")
|
|
|
|
if isinstance(logdata, dict):
|
|
if "USERNAME" in logdata:
|
|
details.append(f"• Username attempted: {logdata.get('USERNAME')}")
|
|
if "PASSWORD" in logdata:
|
|
details.append(f"• Password attempted: {logdata.get('PASSWORD')}")
|
|
if "PATH" in logdata:
|
|
details.append(f"• Path: {logdata.get('PATH')}")
|
|
if "USERAGENT" in logdata:
|
|
details.append(f"• User-Agent: {logdata.get('USERAGENT')}")
|
|
elif logdata:
|
|
details.append(f"• Payload: {str(logdata)[:200]}")
|
|
|
|
body = "\\n".join(details)
|
|
|
|
payload = {
|
|
"title": title,
|
|
"message": body,
|
|
"priority": 8
|
|
}
|
|
|
|
try:
|
|
req = urllib.request.Request(
|
|
GOTIFY_URL,
|
|
data=json.dumps(payload).encode('utf-8'),
|
|
headers={"Content-Type": "application/json"}
|
|
)
|
|
with urllib.request.urlopen(req, timeout=5) as r:
|
|
pass
|
|
print(f"[Alert Sent] {title}", flush=True)
|
|
except Exception as e:
|
|
print(f"[Alert Error] {e}", flush=True)
|
|
|
|
def main():
|
|
print("OpenCanary Gotify Watcher started...", flush=True)
|
|
if not os.path.exists(LOG_FILE):
|
|
open(LOG_FILE, 'a').close()
|
|
|
|
f = open(LOG_FILE, 'r')
|
|
f.seek(0, os.SEEK_END)
|
|
|
|
while True:
|
|
line = f.readline()
|
|
if line:
|
|
line = line.strip()
|
|
if line:
|
|
try:
|
|
event = json.loads(line)
|
|
send_alert(event)
|
|
except Exception as e:
|
|
pass
|
|
else:
|
|
time.sleep(0.5)
|
|
|
|
if __name__ == '__main__':
|
|
main()
|
|
"""
|
|
|
|
c.exec_command("cat << 'EOF' > /opt/opencanary/alert_watcher.py\n" + new_watcher + "\nEOF\n")
|
|
c.exec_command("systemctl restart opencanary-watcher.service")
|
|
print("Restarted watcher service")
|
|
|
|
c.close()
|
|
|