add h0neytr4p honeypot

telekom-security · Nov 12, 2024 · 817fac6 · 817fac6
1 parent 4bedb8d
commit 817fac6
Show file tree

Hide file tree

Showing 18 changed files with 391 additions and 192 deletions.
diff --git a/README.md b/README.md
diff --git a/compose/mac_win.yml b/compose/mac_win.yml
@@ -3,12 +3,12 @@ networks:
   tpotinit_local:
   adbhoney_local:
   ciscoasa_local:
-  citrixhoneypot_local:
   cowrie_local:
   ddospot_local:
   dicompot_local:
   dionaea_local:
   elasticpot_local:
+  h0neytr4p_local:
   heralding_local:
   honeyaml_local:
   ipphoney_local:
@@ -237,6 +237,25 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/elasticpot/log:/opt/elasticpot/log
 
+# H0neytr4p service
+  h0neytr4p:
+    container_name: h0neytr4p
+    restart: always
+    depends_on:
+      tpotinit:
+        condition: service_healthy
+    networks:
+     - h0neytr4p_local
+    ports:
+      - "443:443"
+    # - "80:80"
+    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
+    pull_policy: ${TPOT_PULL_POLICY}
+    read_only: true
+    volumes:
+      - ${TPOT_DATA_PATH}/h0neytr4p/log/:/opt/h0neytr4p/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/payloads/:/data/h0neytr4p/payloads/
+
 # Heralding service
   heralding:
     container_name: heralding

diff --git a/compose/mobile.yml b/compose/mobile.yml
@@ -5,14 +5,14 @@
 #       desktop environment such as LXDE and meet the minimum requirements of 8GB RAM.
 networks:
   ciscoasa_local:
-  citrixhoneypot_local:
   conpot_local_IEC104:
   conpot_local_ipmi:
   conpot_local_kamstrup_382:
   cowrie_local:
   dicompot_local:
   dionaea_local:
   elasticpot_local:
+  h0neytr4p_local:
   heralding_local:
   honeyaml_local:
   ipphoney_local:
@@ -79,23 +79,6 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/ciscoasa/log:/var/log/ciscoasa
 
-# CitrixHoneypot service
-  citrixhoneypot:
-    container_name: citrixhoneypot
-    restart: always
-    depends_on:
-      logstash:
-        condition: service_healthy
-    networks:
-     - citrixhoneypot_local
-    ports:
-     - "443:443"
-    image: ${TPOT_REPO}/citrixhoneypot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/citrixhoneypot/log:/opt/citrixhoneypot/logs
-
 # Conpot IEC104 service
   conpot_IEC104:
     container_name: conpot_iec104
@@ -276,6 +259,25 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/elasticpot/log:/opt/elasticpot/log
 
+# H0neytr4p service
+  h0neytr4p:
+    container_name: h0neytr4p
+    restart: always
+    depends_on:
+      logstash:
+        condition: service_healthy
+    networks:
+     - h0neytr4p_local
+    ports:
+      - "443:443"
+    # - "80:80"
+    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
+    pull_policy: ${TPOT_PULL_POLICY}
+    read_only: true
+    volumes:
+      - ${TPOT_DATA_PATH}/h0neytr4p/log/:/opt/h0neytr4p/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/payloads/:/data/h0neytr4p/payloads/
+
 # Heralding service
   heralding:
     container_name: heralding

diff --git a/compose/sensor.yml b/compose/sensor.yml
@@ -2,7 +2,6 @@
 networks:
   adbhoney_local:
   ciscoasa_local:
-  citrixhoneypot_local:
   conpot_local_IEC104:
   conpot_local_guardian_ast:
   conpot_local_ipmi:
@@ -12,6 +11,7 @@ networks:
   dicompot_local:
   dionaea_local:
   elasticpot_local:
+  h0neytr4p_local:
   heralding_local:
   honeyaml_local:
   ipphoney_local:
@@ -95,23 +95,6 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/ciscoasa/log:/var/log/ciscoasa
 
-# CitrixHoneypot service
-  citrixhoneypot:
-    container_name: citrixhoneypot
-    restart: always
-    depends_on:
-      tpotinit:
-        condition: service_healthy
-    networks:
-     - citrixhoneypot_local
-    ports:
-     - "443:443"
-    image: ${TPOT_REPO}/citrixhoneypot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/citrixhoneypot/log:/opt/citrixhoneypot/logs
-
 # Conpot IEC104 service
   conpot_IEC104:
     container_name: conpot_iec104
@@ -340,6 +323,25 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/elasticpot/log:/opt/elasticpot/log
 
+# H0neytr4p service
+  h0neytr4p:
+    container_name: h0neytr4p
+    restart: always
+    depends_on:
+      tpotinit:
+        condition: service_healthy
+    networks:
+     - h0neytr4p_local
+    ports:
+      - "443:443"
+    # - "80:80"
+    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
+    pull_policy: ${TPOT_PULL_POLICY}
+    read_only: true
+    volumes:
+      - ${TPOT_DATA_PATH}/h0neytr4p/log/:/opt/h0neytr4p/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/payloads/:/data/h0neytr4p/payloads/
+
 # Heralding service
   heralding:
     container_name: heralding

diff --git a/compose/standard.yml b/compose/standard.yml
@@ -2,7 +2,6 @@
 networks:
   adbhoney_local:
   ciscoasa_local:
-  citrixhoneypot_local:
   conpot_local_IEC104:
   conpot_local_guardian_ast:
   conpot_local_ipmi:
@@ -12,6 +11,7 @@ networks:
   dicompot_local:
   dionaea_local:
   elasticpot_local:
+  h0neytr4p_local:
   heralding_local:
   honeyaml_local:
   ipphoney_local:
@@ -97,23 +97,6 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/ciscoasa/log:/var/log/ciscoasa
 
-# CitrixHoneypot service
-  citrixhoneypot:
-    container_name: citrixhoneypot
-    restart: always
-    depends_on:
-      tpotinit:
-        condition: service_healthy
-    networks:
-     - citrixhoneypot_local
-    ports:
-     - "443:443"
-    image: ${TPOT_REPO}/citrixhoneypot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/citrixhoneypot/log:/opt/citrixhoneypot/logs
-
 # Conpot IEC104 service
   conpot_IEC104:
     container_name: conpot_iec104
@@ -342,22 +325,24 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/elasticpot/log:/opt/elasticpot/log
 
-# Honeyaml service
-  honeyaml:
-    container_name: honeyaml
+# H0neytr4p service
+  h0neytr4p:
+    container_name: h0neytr4p
     restart: always
     depends_on:
       tpotinit:
         condition: service_healthy
     networks:
-     - honeyaml_local
+     - h0neytr4p_local
     ports:
-      - "3000:8080"
-    image: ${TPOT_REPO}/honeyaml:${TPOT_VERSION}
+      - "443:443"
+    # - "80:80"
+    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
     pull_policy: ${TPOT_PULL_POLICY}
     read_only: true
     volumes:
-     - ${TPOT_DATA_PATH}/honeyaml/log:/opt/honeyaml/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/log/:/opt/h0neytr4p/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/payloads/:/data/h0neytr4p/payloads/
 
 # Heralding service
   heralding:
@@ -393,6 +378,23 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/heralding/log:/var/log/heralding
 
+# Honeyaml service
+  honeyaml:
+    container_name: honeyaml
+    restart: always
+    depends_on:
+      tpotinit:
+        condition: service_healthy
+    networks:
+     - honeyaml_local
+    ports:
+      - "3000:8080"
+    image: ${TPOT_REPO}/honeyaml:${TPOT_VERSION}
+    pull_policy: ${TPOT_PULL_POLICY}
+    read_only: true
+    volumes:
+     - ${TPOT_DATA_PATH}/honeyaml/log:/opt/honeyaml/log/
+
 # Honeytrap service
   honeytrap:
     container_name: honeytrap

diff --git a/compose/tpot_services.yml b/compose/tpot_services.yml
@@ -19,6 +19,7 @@ networks:
   endlessh_local:
   galah_local:
   go-pot_local:
+  h0neytr4p_local:
   hellpot_local:
   heralding_local:
   honeyaml_local:
@@ -465,6 +466,25 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/go-pot/log:/opt/go-pot/log/
 
+# H0neytr4p service
+  h0neytr4p:
+    container_name: h0neytr4p
+    restart: always
+    depends_on:
+      tpotinit:
+        condition: service_healthy
+    networks:
+     - h0neytr4p_local
+    ports:
+      - "443:443"
+    # - "80:80"
+    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
+    pull_policy: ${TPOT_PULL_POLICY}
+    read_only: true
+    volumes:
+      - ${TPOT_DATA_PATH}/h0neytr4p/log/:/opt/h0neytr4p/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/payloads/:/data/h0neytr4p/payloads/
+
 # Hellpot service
   hellpot:
     container_name: hellpot

diff --git a/doc/architecture.png b/doc/architecture.png
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -2,7 +2,6 @@
 networks:
   adbhoney_local:
   ciscoasa_local:
-  citrixhoneypot_local:
   conpot_local_IEC104:
   conpot_local_guardian_ast:
   conpot_local_ipmi:
@@ -12,6 +11,7 @@ networks:
   dicompot_local:
   dionaea_local:
   elasticpot_local:
+  h0neytr4p_local:
   heralding_local:
   honeyaml_local:
   ipphoney_local:
@@ -97,23 +97,6 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/ciscoasa/log:/var/log/ciscoasa
 
-# CitrixHoneypot service
-  citrixhoneypot:
-    container_name: citrixhoneypot
-    restart: always
-    depends_on:
-      tpotinit:
-        condition: service_healthy
-    networks:
-     - citrixhoneypot_local
-    ports:
-     - "443:443"
-    image: ${TPOT_REPO}/citrixhoneypot:${TPOT_VERSION}
-    pull_policy: ${TPOT_PULL_POLICY}
-    read_only: true
-    volumes:
-     - ${TPOT_DATA_PATH}/citrixhoneypot/log:/opt/citrixhoneypot/logs
-
 # Conpot IEC104 service
   conpot_IEC104:
     container_name: conpot_iec104
@@ -342,22 +325,24 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/elasticpot/log:/opt/elasticpot/log
 
-# Honeyaml service
-  honeyaml:
-    container_name: honeyaml
+# H0neytr4p service
+  h0neytr4p:
+    container_name: h0neytr4p
     restart: always
     depends_on:
       tpotinit:
         condition: service_healthy
     networks:
-     - honeyaml_local
+     - h0neytr4p_local
     ports:
-      - "3000:8080"
-    image: ${TPOT_REPO}/honeyaml:${TPOT_VERSION}
+      - "443:443"
+    # - "80:80"
+    image: ${TPOT_REPO}/h0neytr4p:${TPOT_VERSION}
     pull_policy: ${TPOT_PULL_POLICY}
     read_only: true
     volumes:
-     - ${TPOT_DATA_PATH}/honeyaml/log:/opt/honeyaml/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/log/:/opt/h0neytr4p/log/
+      - ${TPOT_DATA_PATH}/h0neytr4p/payloads/:/data/h0neytr4p/payloads/
 
 # Heralding service
   heralding:
@@ -393,6 +378,23 @@ services:
     volumes:
      - ${TPOT_DATA_PATH}/heralding/log:/var/log/heralding
 
+# Honeyaml service
+  honeyaml:
+    container_name: honeyaml
+    restart: always
+    depends_on:
+      tpotinit:
+        condition: service_healthy
+    networks:
+     - honeyaml_local
+    ports:
+      - "3000:8080"
+    image: ${TPOT_REPO}/honeyaml:${TPOT_VERSION}
+    pull_policy: ${TPOT_PULL_POLICY}
+    read_only: true
+    volumes:
+     - ${TPOT_DATA_PATH}/honeyaml/log:/opt/honeyaml/log/
+
 # Honeytrap service
   honeytrap:
     container_name: honeytrap