Sophie: nepenthes-0:0.2.2-5mdv2009.1 i586

nepenthes-0.2.2-5mdv2009.1.i586.rpm

Nepenthes
- the finest collection -

Our documentation and installation instructions is available online at

http://nepenthes.sourceforge.net/documentation:readme

( if you are offline and need a README file scroll down, there is a paste of the online version)

Nepenthes
- the finest collection -

IMPORTANT NOTE
the same README in a better readable format can be found on
http://nepenthes.sourceforge.net/documentation:readme
not to mention the online doc is updatet more often.

Table of Contents

* Nepenthes Readme
* 1. What is Nepenthes?
* 2. How does Nepenthes work?
o 2.1 Why would one want to run Nepenthes?
* 3. Installing Nepenthes
o precompiled binaries/prebuild setups
o from source
+ linux
+ Mac OSX
+ BSD
+ cygwin/Windows
o getting the code
+ svn repository
+ release packages
o patching the source
+ 0.1.3 patches
+ 0.1.4 patches
o compiling the source
+ linux
+ Mac OSX
+ NetBSD
+ OpenBSD
+ cygwin
o adjust the configuration
o update an existing configuration
+ the lazy way
+ diff it
o run it
* 4. Current Status
o 4.1 Nepenthes core
o 4.2 Nepenthes Modules
+ 4.2.1 download handler
+ 4.2.2 submit Handler
+ 4.2.3 shellcode handler
+ 4.2.4 vulnerability modules
+ 4.2.5 ShellEmulation modules
+ 4.2.6 eXample modules
+ 4.2.7 GeoLocationHandler
+ 4.2.8 DNSHandler
* 5. Modules Interface
* 6. Contribute to Nepenthes
* 7. Trouble Shooting
* 8. FAQ

Nepenthes Readme
1. What is Nepenthes?

Nepenthes is a low interaction honeypot like honeyd or mwcollect. Low Interaction Honeypots emulate _known_ vulnerabilities to collect information about potential attacks. Nepenthes is designed to emulate vulnerabilties worms use to spread, and to capture these worms. As there are many possible ways for worms to spread, Nepenthes is modular. There are module interface to

* resolve dns asynchronous
* emulate vulnerabilities
* download files
* submit the downloaded files
* trigger events (sounds abstract and it is abstract but is still quite useful)
* shellcode handler

Refer to FIXME for more information about the Module Interface.
2. How does Nepenthes work?

Nepenthes vulnerability modules require knowledge about weaknesses so one can draft a Dialogue how the virus will exploit the weakness, gain the needed information to download the file and send the attacker just enough information he does not notice he gets fooled.
On the other hand Nepenthes is quite usefull to capture new exploits for old vulnerabilities.
As Nepenthes does not know these exploits, they will appear in the logfiles.
By running these captures against a real vulnerable machine one can gain new information about the exploit and start writing an Nepenthes Dialogue.
2.1 Why would one want to run Nepenthes?

The first argument is, its free. The software is free, the viruses you can capture are free. You can collect this annoying stuff like stamps without paying a diam. The rest of the arguments are security related an discussable. Setting up a host running Nepenthes can improve network security drastically, as you can see who scans for which known vulnerabilities.
3. Installing Nepenthes

If you update an existing install, please read this, else you may miss something and screw your install.
precompiled binaries/prebuild setups

Check the download section before trying to compile nepenthes from source, there are prebuild or preconfigured packages for

* gentoo
* debian
* FreeBSD

from source

Nepenthes will use automake to verify your system satisfies the needed depencies.

* g++ do not use g++ 4.0.* it wont work properly) (g++ 4.0.2 may work ) 2.9? wont work too, as these versions are not c99 compatible
* libcurl
* libmagic
* libpcre
* libadns

linux
Debian

On debian just do

apt-get install libcurl3-dev
apt-get install libmagic-dev
apt-get install libpcre3-dev
apt-get install libadns1-dev

or ( paste it in one line )

apt-get install libcurl3-dev libmagic-dev libpcre3-dev libadns1-dev

SuSE

SuSE (10) needs you to

apt-get install libadns
apt-get install libadns-devel
apt-get install file-devel
apt-get install pcre-devel
apt-get install pcre
apt-get install curl
apt-get install curl-devel

and once again the single line for easy pasting

apt-get install libadns libadns-devel file-devel pcre-devel pcre curl curl-devel

Fedora Core 4

pretty easy again.

yum install pcre-devel pcre adns adns-devel curl curl-devel file

Mac OSX

You need to install updated autotools with darwinports:

sudo port install libtool # libtoolize
sudo port install autoconf
sudo port install automake

Install the dependencies as well:

sudo port install adns
sudo port install pcre
sudo port install file # for libmagic
sudo port install curl

BSD
FreeBSD

Installing the depencies from ports

dns/adns
ftp/curl
devel/pcre

worked for me
OpenBSD

file & libmagic
OpenBSD lacks libmagic, the file utility is not linked against libmagic, it was compile including the magic source. So there is no way but to install (gnu) file from source, so you can link against libmagic. But apart from file everything could be taken from ports, (gnu) file with libmagic is missing on OpenBSD.

stdint.h
And please do

echo "#include <inttypes.h>" > /usr/include/stdint.h

else OpenBSD won\u2019t have stdint.h

So 2 ways to install on openbsd, either get all but file from ports, or build every depency from source, without using ports.
ports

taking

net/adns
net/curl
devel/pcre

from ports worked, but the pcre version used in OpenBSD 3.8 was pretty old (version 4.3 where 6.4 is current), so you you may want to install pcre from source too, please install file from source to get libmagic.
plan b

Installing the depencies from source

file
adns
curl
pcre

to /opt and specify their path with the configure flags worked for me.
NetBSD

Installing the depencies adns curl pcre file from pkg worked for me
cygwin/Windows

Compiling nepenthes >= 0.1.6 on windows using cygwin is possible . Installing

* autoconf2.5
* automake1.9
* bzip2
* curl-devel
* file
* gcc-core 3.3.3-3
* gcc-g++ 3.3.3-3
* gzip
* inetutils
* libcurl3
* libtool1.5
* make
* openssl-devel
* pcre-devel
* tar
* wget
* zlib

from cygwin worked for me. Some packages will install its specific depencies.
Installing adns in cygwin

Get it

wget http://www.chiark.greenend.org.uk/~ian/adns/adns.tar.gz

unpack it

tar xfz adns.tar.gz
cd adns-1.1

configure & compile

./configure --prefix=/usr
make

this will fail when linking the adns client, we have to copy the created library by hand

cd dynamic
cp libadns.so libadns.dll
cd ..
make

for d in src dynamic client regress; do make -C $d install; done
cp dynamic/libadns.dll /bin/libadns.dll

create /etc/resolv.conf

Now adns needs the /etc/resolv.conf file we have to create it, first check your nameservers ip

ipconfig /all | grep DNS-Server

will give you something like

DNS-Server. . . . . . . . . . . . : 194.25.2.129

I recommend you use your real nameserver and not just take this examples values.

echo nameserver 194.2.25.129 > /etc/resolv.conf

test adns

adnshost kernel.org

kernel.org A INET 204.152.191.5
kernel.org A INET 204.152.191.37

getting the code

You can download a source package, or get the latest code from the svn repository.

Svn will offer the latest version, but may not build properly, have bugs, requires some additional time reading the install guide, and additional software.
svn repository

If you think you can handle it, we recommend using svn, if you hit a bug, you can help us fixing it by filing a bug report. But using svn is not that easy, as the svn snapshot does not contain preconfigured autoconf files, you have to create them yourself with the help of

* libtool (1.5.20)
o libtoolize
* automake (1.9.6)
o aclocal
* autoconf (2.59)
o autoheader

Some operating systems (FreeBSD 6.0 for example) ship broken autotools, I was unable to get the shipped autotools create the required files, so using svn may be tricky on some operating systems.
Others (debian for example) make using autotools very easy

apt-get install autoconf automake1.9 autotools-dev libtool

For more information about autoconf I can recommend the autoconf docs.
get it down now

if you \u201csvn checkout\u201d a repository, you can update this checkout incremental with \u201csvn update\u201d, so you don\u2019t need to download the complete source again when just some lines were changes.

\u201csvn export\u201d does not allow incremental updates, but uses less diskspace as an export, as the export stores some additional data (local private copy of the whole source).

So whatever you want to run, its up to you.

svn checkout svn://svn.mwcollect.org/nepenthes/trunk/
cd trunk

autobreak it
*any* non freebsd operting system

Now we have to run the famous autotools to get the \u201c./configure\u201d file we\u2019ll need to install it.

autoreconf -v -i --force

What happens when doing this is ... sometimes a picture says more than words.

configure.ac --.
| .------> autoconf* -----> configure
[aclocal.m4] --+---+
| `-----> [autoheader*] --> [config.h.in]
[acsite.m4] ---'

(taken from the autoconf 2.57 manual)

the configure on the right side indicates we get this as a result.
Mac OSX

/opt/local/bin/autoreconf -v -i --force

FreeBSD

As you can imagine, this does not work everywhere, FreeBSD is special, that special that I was unable to autoreconf svn on a FreeBSD host myself for a long time, that special that I had no real motivation looking for it, as everything automake depended really sucks .....

But today I got mail, mail how to get it working on FreeBSD.

For what it's worth, here's what I did to build the current SVN code on
FreeBSD 6.0. I thought we might want to add this to the wiki:

# -- checkout code && cd to src directory --
# /usr/local/bin/libtoolize --copy --force
# /usr/local/bin/aclocal19 --force
# cat /usr/local/share/aclocal/libtool.m4 >>aclocal.m4
# /usr/local/bin/autoheader259 --force
# /usr/local/bin/automake19 -ai
# /usr/local/bin/autoconf259 -f
# ./configure
# make

I'm sure this isn't the minimal set of operations, but it works ;)

release packages

Check the projects file releases repository on sourceforge and download the latest version.
unpacking the source

Unpack your source tarball.

if you got a bzip2 package use

tar vxjf nepenthes-VERSION.tar.bz2

else

tar vxzf nepenthes-VERSION.tar.gz

patching the source

from time to time things show up, that have to be fixed

patches are run against /, so you can apply them with

cd nepenthes-VERSION
cat ../example_patch.diff | patch -p0

0.1.3 patches
bugfixes

you need them as we did mistakes :\

* nepenthes 0.1.3 logging path patch
* nepenthes 0.1.3 download-nepenthes connection close patch

features

patches that add additional features, we recommend them

* nepenthes 0.1.3 advanced xor and bindshell patch ( highly recommended )

0.1.4 patches

none yet
compiling the source

Starting with 0.1.6 every depencie can be resolved with its own specific path. If you got everything in its normal path (we ignore FreeBSDs definition of normal path here), you won\u2019t need this, but if you need it, you dont want to miss it.

For example

./configure \
--with-curl-include=/opt/curl/include/ \
--with-curl-lib=/opt/curl/lib/ \
--with-adns-include=/opt/adns/include/ \
--with-adns-lib=/opt/adns/lib/ \
--with-pcre-include=/opt/pcre/include/ \
--with-pcre-lib=/opt/pcre/lib/ \
--with-magic-include=/opt/file/include/ \
--with-magic-lib=/opt/file/lib/ \
--prefix=/opt/nepenthes

check

./configure --help

If you rely on user defined pathes.
linux

This worked for debian, Fedora Core 4 and SuSE 10 for me.

./configure --prefix=/opt/nepenthes
make
make install

Mac OSX

./configure \
--libdir=/opt/local/lib \
--includedir=/opt/local/include/ \
--prefix=/opt/nepenthes

make
make install

NetBSD

Some depencies ( curl, pcre ) hide in /usr/pkg/, so we have to include this path, including the path once is enough.

./configure --prefix=/opt/nepenthes \
--with-curl-include=/usr/pkg/include --with-curl-lib=/usr/pkg/lib

make
make install

OpenBSD

We assume you followed the advice and installed (gnu) file to /opt/file, and got a shell understanding \ escapes ...
ports

./configure \
--with-curl-include=/usr/local/include/ --with-curl-lib=/usr/local/lib/ \
--with-magic-include=/opt/file/include/ --with-magic-lib=/opt/file/lib/ \
--prefix=/opt/nepenthes

plan b

If you want plan b, ...

./configure \
--with-curl-include=/opt/curl/include/ --with-curl-lib=/opt/curl/lib/ \
--with-adns-include=/opt/adns/include/ --with-adns-lib=/adns/lib/ \
--with-pcre-include=/opt/pcre/include/ --with-pcre-lib=/opt/pcre/lib/ \
--with-magic-include=/opt/file/include/ --with-magic-lib=/opt/file/lib/ \
--prefix=/opt/nepenthes

cygwin

cygwin g++ is a little special, won\u2019t compile the sourc out of the box, so we have to tweak it.

./configure --prefix=/opt/nepenthes --with-adns-lib=/bin
make

this *will* quit with

/usr/lib/gcc/i686-pc-cygwin/3.4.4/include/c++/bits/stl_uninitialized.h: In membe
r function `virtual int32_t nepenthes::VFSCommandCMD::run(std::vector<std::string, std::allocator<std::string> >*)':
/usr/lib/gcc/i686-pc-cygwin/3.4.4/include/c++/bits/stl_uninitialized.h:82: warning: '__cur' might be used uninitialized in this function
make[3]: *** [VFSCommandCMD.lo] Error 1
make[3]: Leaving directory `/home/foobar/Svn/nepenthes/trunk/modules/shellemu-winnt'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/home/foobar/Svn/nepenthes/trunk/modules'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/foobar/Svn/nepenthes/trunk'
make: *** [all] Error 2

actually this is not nepenthes fault, but cygwins g++, and the error is not critical, it just fails as the compiler wants to warn us about a *possible* problem, and the Makefile.am says -Werror ( handle warnings as errors )

So, open modules/shellemu-winnt/Makefile.am with editor of your choice, and change

AM_CXXFLAGS = -Wall -Werror

AM_CXXFLAGS = -Wall

this will still show the warning, but won\u2019t treat it as error any longer.

then finish it

make
make install

adjust the configuration

cd /opt/nepenthes

less etc/nepenthes/nepenthes.conf

less etc/nepenthes/submit-norman.conf

less etc/nepenthes/log-irc.conf

\u2019less\u2019 means you should have a look in the config file, and edit it using an editor of your choice.

If something fails, check the Trouble Shooting section. Compiling nepenthes can take some time, here it takes 1:20 minutes on an amd64 3500 cpu with one gb ram.
update an existing configuration

nepenthes won\u2019t overwrite your existing config files on make install that means if you update to a new version, and don\u2019t care about updating the configs, you may break your install.

As of 0.1.7 there is a real need to do this.

There are at least 2 ways of verifiying your config works
the lazy way

If you run the default config without any changes, just remove the etc/nepenthes dir, and make install again, it will copy all new versions of all config files.
diff it

this is the way to go if you tweaked your config.

get this shellscript, and call it like

./diffconfigs.sh /tmp/nepenthes-0.1.7 /opt/nepenthes

#!/bin/sh

SRCDIR=$1
INSTALLDIR=$2/etc/nepenthes

for i in $(find $SRCDIR | grep conf.dist$ | grep -v svn);
do CFGNAME=$( basename $i| sed "s/\.dist$//");
THEDIFF=$(diff $i $INSTALLDIR/$CFGNAME);
DIFFLINES=$(echo $THEDIFF | wc -c)
if [ $DIFFLINES -gt 1 ]; then
echo -e "\x1b[31mdiff $i $CFGNAME ($DIFFLINES bytes difference) \x1b[0m";
diff $i $INSTALLDIR/$CFGNAME
fi
done

run it

If everything went fine, run nepenthes.

bin/nepenthes

4. Current Status

All in all Nepenthes is stable code,
but some things are ... lets say a little raw
Current status is everything which is marked \u201cwork\u201ding runs fine.
4.1 Nepenthes core
Component Status Comment
Config File works -
SocketManager works tcp and udp connections nonblocking, bufferd, no real rawsocket support
ShellcodeManager works -
SubmitManager works -
EventManager works -
LuaInterface planned?/dropped? -
ModuleManager works unloading modules at runtime is not really possible as its really hard to make sure there is no shared code left
DNSManager works i love this one
GeoLocationManager works was a hack to draw some maps with dots where the attacker may be located, but the homies love it

4.2 Nepenthes Modules
4.2.1 download handler
Name Protocol Status comment
download_csend csend works
download_curl http/ftp works not recommended
download_tftp tftp works
download_nepenthes own works
download_ftp ftp works can even do active ftp behind nat
download_http http works
download_rcp rcp should work the protocol sucks
download_link linkbot works pretty smart thing
download_creceive creceive works

4.2.2 submit Handler
Name status description
submit_file works writes viri files to local disk
submit_norman works submits files to normans online sandbox
submit_nepenthes works submits files to some other box running nepenthes
submit_postgres removed removed due to issues with nonblocking postgres api
submit_xmlrpc works submit files to a xmlrpc server
submit_gotek works submit files to a gotek server

4.2.3 shellcode handler
Name status comment
sch_generic_createprocess old to be removed
sch_generic_url old to be removed
sch_generic_xor old to be removed
sch_generic_linkxor old to be removed
sch_generic_stuttgart old to be removed
sch_generic_link_trans old to be removed
sch_generic_link_bind_trans old to be removed
sch_namespace testing tomorrow today
sch_engine_unicode testing tomorrow today

4.2.4 vulnerability modules
Port Vulnerbility Module a free field
42 MS04-006 vuln_wins
MS04-045
80 MS03-007 vuln_asn1
MS03-051
MS04-011
135 MS03-039 vuln_dcom
MS04-012
139 vuln_netbiosname
MS04-031 vuln_netdde
443 FIXME vuln_iis
445 FIXME vuln_asn1
MS04-011 vuln_lsass
MS04-012 vuln_dcom
MS03-039
1023 vuln_sasserftpd
1025 FIXME vuln_dcom
1434 MS02-039 vuln_mssql
2103 MS05-017 vuln_msmq
2105 MS05-017 vuln_msmq
2107 MS05-017 vuln_msmq
2745 vuln_bagle
3127 vuln_mydoom
3140 vuln_optix
5000 MS01-059 vuln_upnp
5554 vuln_sasserftpd
17300 vuln_kuang2
27347 vuln_sub7

4.2.5 ShellEmulation modules
4.2.5.1 shellemu-winnt

status: works

description:

provides a windows nt shell supporting all commands one needs to download a file.
4.2.6 eXample modules
Name Status Feature
eXample 1 works writing a module
eXample 2 works accepting connections, creating dialogues, *the module to write a vuln emu*
eXample 3 works download handler example, downloads files from /dev/urandom
eXample 4 works submit handler example, hexdumps downloaded files to stdout
eXample 5 works eventhandler example, hooks some events
eXample 6 works dnscallback example, resolve some async
eXample 7 dropped raw sockets example, dropped
eXample 8 works geolocation example, resolve some ips geolocation

4.2.7 GeoLocationHandler
Name status comment
geolocation_hostip
geolocation_geoip
geolocation_ip2location

4.2.8 DNSHandler
Name status comment
dnsresolve_adns works resolve ips using libadns
dnsresolve_uns planned resolve ips using libudns

5. Modules Interface

Refer to the online doxygen documentation of the eXample modules on FIXME.
6. Contribute to Nepenthes

Post suggestions, bugs, patches, new modules to nepenthes.sf.net or mail them to nepenthesdev@gmail.com
If you want to donate hardware, ipranges, whatever, mail us.
7. Trouble Shooting
7.1

P: It does not work!
S: find out why it does not work

7.2

P: the makefiles suck
S: send us a patch using the auto(conf|make) foobar we are unable to use.

7.3

P: compiling fails
S: google for it, if this does not help out, file a bugreport and mention your
- operating system version
- g++ version
- libcurl version
- libpcre version
- libmagic version
and paste the compilererror too.

7.4

P: nepenthes leaks memory
S: first verify it _is_ a memoryleak
currently all files downloaded are kept in memory until they are downloaded and submittet.
then
run nepenthes with
valgrind --num-callers=12 --tool=memcheck --leak-check=yes --leak-resolution=high --show-reachable=yes -v --logfile=valg bin/nepenthes
and mail us the valgrind logfiles to nepenthesdev@gmail.com
or
fix the memleak and post the patch to http://sf.net/projects/nepenthes

7.5

P: i dont have any connection incoming!
S: verify you are not firewalled.

8. FAQ
8.0

Q: Is this the official FAQ?
A: Yes.

8.1

Q: Why choose Nepenthes as the name?
A: read http://en.wikipedia.org/wiki/Nepenthes

8.2

Q: What do you do with the samples committed to the nepenthes central server?
A: We collect them.
All samples are committed to clamav.
Some samples get analysed.

8.3

Q: Can I get access to your malware database?
A: In general No.
If you think you will be able to persuade us that you should have access as you are an AV product vendor,
or do research in this field, mail us at samples@stargazer.at
Currently we _lack_ hardware and connection for a central server.

8.4

Q: I want to write my own modules, will you publish them?
A: Depends. If the module adds new features
- shellcodehandler
- downloadhandler
- submithandler
- vulnerability module
and you are willing to accept the gpl license, there is a really good chance that we will.
Of course, the feature also has to be useful.
Submitting files to /dev/null can't be considered a good feature.

8.5

Q: Why don't you write the whole documentation in english?
A: Although we know our English is poor, we think it's more useful to write poor English
than to write good Russian.
Send us patches fixing this issue.

8.6

Q: is autocommiting files to sandbox.norman.no not a bad idea?
A: so far we have committed about 400 files and nobody has complained yet.
and we like getting the results via mail.

8.7

Q: how can i autocommit to clamav?
A: clamav does not want to be the victim of autocommits
if you use the submit-nepenthes, our central server will commit the files for you.

8.8

Q: how can i see whether the file i submitted to your central server has got a clamav signature?
A: wait some time and then scan the file using clamscan

8.9

Q: why should i run nepenthes?
A: you improve security in various ways which we can discuss over a beer.

8.10

Q: there is nothing in the cvs repository on sourceforge.net
A: we use svn as we don't like cvs

8.11

Q: can i get access to the svn?
A: so far no as the svn is 'hosted' on a dialup.

8.12

Q: i get
Got signal 25
Exit 'cause of 25
A: signal 25 is SIGFSZE, that means filesize exceeded, and mainly referrs to the logfiles
located in log/, rm them, rotate them, just get rid of it, and it will work again, fixed in 0.1.1

8.13

Q: my avscanner complains about a virus in the nepenthes source package.
like:
clamscan nepenthes-0.1.1.tar.gz: Trojan.Downloader.FTP.Gen-4 FOUND
A: actually this is not a false positive, but on the other hand it is a false positive ...
the tarball contains a file in doc/README.VFS containing wide used batchjobs viri use to download and execute themselves
on a remotehost once the gained a shell for documentation purposes.
so your virusscanner is cool if he recognizes the file as a virus, but this single file does not make nepenthes a virus.
as we dont want to sap av scanners we wont ask them to remove this signature.

in my opinion the signature is very good, using such av signature on a snort_inline firewall can stopp attacks in the
last state, after successfull exploitation, before infecting the host.

8.14

Q: whats the problem with g++ 4.0.1?
A: it will compile, and maybe even start, but it will fail if you resolve dns async.
for some reason the destructor of list<unsigned long> segfaults the programm.
to me this is a g++ 4 bug.

8.15

Q: what about OS X, or _any_ other big endian architecture?
A: we guess it will compile, but we never had a look on endianess in any shellcodehandler.
actually we can't say if it will work on big endian boxes, and as we do not own any big endian machine, we cant debug&fix it.
if you want to donate a osx box so we can support big endian, mail us for a delievery address.