mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
new automated detection testing
This commit is contained in:
P4T12ICK
@@ -0,0 +1,20 @@
|
||||
FROM ubuntu:18.04
|
||||
|
||||
RUN apt-get update
|
||||
RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
|
||||
RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli
|
||||
RUN apt-get install -y python-gitdb
|
||||
RUN apt-get install -y wget unzip
|
||||
|
||||
RUN wget --quiet https://releases.hashicorp.com/terraform/0.13.1/terraform_0.13.1_linux_amd64.zip \
|
||||
&& unzip terraform_0.13.1_linux_amd64.zip \
|
||||
&& mv terraform /usr/bin \
|
||||
&& rm terraform_0.13.1_linux_amd64.zip
|
||||
|
||||
ADD . /app
|
||||
|
||||
WORKDIR /app
|
||||
RUN pip3 install -r requirements.txt
|
||||
|
||||
ENTRYPOINT ["python3", "honeypot_service.py"]
|
||||
CMD ["-a", "build", "-r", "eu-west-2", "-n", "songoku"]
|
||||
+95
@@ -0,0 +1,95 @@
|
||||
from shutil import which
|
||||
import secrets
|
||||
import string
|
||||
import os
|
||||
import logging
|
||||
import sys
|
||||
import time
|
||||
|
||||
from helpers import aws_service
|
||||
|
||||
|
||||
# Logger
|
||||
logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO"))
|
||||
LOGGER = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def create_random_password():
|
||||
alphabet = string.ascii_letters + string.digits
|
||||
password = ''.join(secrets.choice(alphabet) for i in range(10))
|
||||
password = '!1' + password + 'n:'
|
||||
return password
|
||||
|
||||
|
||||
def configure_attack_range_honeypot(region, honeypot_name, password):
|
||||
sys.path.append(os.path.join(os.getcwd(),'attack_range_honeypot'))
|
||||
|
||||
with open('attack_range_honeypot/terraform/aws/resources.tf', 'r') as file :
|
||||
filedata = file.read()
|
||||
|
||||
filedata = filedata.replace('[region]', region)
|
||||
filedata = filedata.replace('[name]', honeypot_name)
|
||||
|
||||
with open('attack_range_honeypot/terraform/aws/resources.tf', 'w+') as file:
|
||||
file.write(filedata)
|
||||
|
||||
|
||||
with open('attack_range_honeypot/attack_range.conf.template', 'r') as file :
|
||||
filedata = file.read()
|
||||
|
||||
filedata = filedata.replace('attack_range_password = asda:?wlflas1234qw?', 'attack_range_password = ' + password)
|
||||
filedata = filedata.replace('windows_server = 0', 'windows_server = 1')
|
||||
filedata = filedata.replace('region = eu-central-1', 'region = ' + region)
|
||||
filedata = filedata.replace('range_name = default', 'range_name = ' + honeypot_name)
|
||||
|
||||
with open('attack_range_honeypot/attack_range.conf', 'w') as file:
|
||||
file.write(filedata)
|
||||
|
||||
# check if terraform is installed
|
||||
if which('terraform') is None:
|
||||
sys.exit(1)
|
||||
else:
|
||||
# init terraform
|
||||
os.system('cd attack_range_honeypot/terraform/aws && terraform init && cd ../../..')
|
||||
|
||||
|
||||
def build_attack_range_honeypot(region, honeypot_name):
|
||||
|
||||
password = create_random_password()
|
||||
|
||||
configure_attack_range_honeypot(region, honeypot_name, password)
|
||||
|
||||
module = __import__('attack_range')
|
||||
module.sys.argv = ['attack_range', '--config', 'attack_range_honeypot/attack_range.conf', 'build']
|
||||
|
||||
try:
|
||||
LOGGER.info(f"Build Attack Range Honeypot")
|
||||
results = module.main(module.sys.argv)
|
||||
except Exception as e:
|
||||
LOGGER.error('Build Error: ' + str(e))
|
||||
module.sys.argv = ['attack_range', '--config', 'attack_range_honeypot/attack_range.conf', 'destroy']
|
||||
module.main(module.sys.argv)
|
||||
sys.exit(1)
|
||||
|
||||
return password
|
||||
|
||||
|
||||
def destroy_attack_range_honeypot(data):
|
||||
|
||||
region = data['region']
|
||||
honeypot_name = data['name']
|
||||
password = data['password']
|
||||
|
||||
configure_attack_range_honeypot(region, honeypot_name, password)
|
||||
|
||||
module = __import__('attack_range')
|
||||
module.sys.argv = ['attack_range', '--config', 'attack_range_honeypot/attack_range.conf', 'destroy']
|
||||
|
||||
try:
|
||||
LOGGER.info(f"Destroy Attack Range Honeypot")
|
||||
results = module.main(module.sys.argv)
|
||||
except Exception as e:
|
||||
LOGGER.error('Build Error: ' + str(e))
|
||||
module.sys.argv = ['attack_range', '--config', 'attack_range_honeypot/attack_range.conf', 'destroy']
|
||||
module.main(module.sys.argv)
|
||||
sys.exit(1)
|
||||
@@ -0,0 +1,64 @@
|
||||
import boto3
|
||||
from botocore.config import Config
|
||||
import time
|
||||
import os
|
||||
import json
|
||||
|
||||
|
||||
|
||||
def create_tf_state_store(honeypot_name, region):
|
||||
my_config = Config(region_name = region)
|
||||
s3 = boto3.client('s3', config=my_config)
|
||||
response = s3.create_bucket(Bucket=str('attack-range-detection-testing-bucket-' + honeypot_name), CreateBucketConfiguration={'LocationConstraint': region})
|
||||
|
||||
client = boto3.client('dynamodb', config=my_config)
|
||||
response = client.create_table(
|
||||
TableName=str('attack-range-detection-testing-state-' + honeypot_name),
|
||||
KeySchema=[
|
||||
{
|
||||
'AttributeName': 'LockID',
|
||||
'KeyType': 'HASH' # Partition key
|
||||
}
|
||||
],
|
||||
AttributeDefinitions=[
|
||||
{
|
||||
'AttributeName': 'LockID',
|
||||
'AttributeType': 'S'
|
||||
}
|
||||
],
|
||||
ProvisionedThroughput={
|
||||
'ReadCapacityUnits': 10,
|
||||
'WriteCapacityUnits': 10
|
||||
}
|
||||
)
|
||||
|
||||
|
||||
def delete_tf_state_store(region, honeypot_name):
|
||||
s3 = boto3.resource('s3', region_name=region)
|
||||
bucket = s3.Bucket(str('attack-range-detection-testing-bucket-' + honeypot_name))
|
||||
bucket.objects.all().delete()
|
||||
bucket.delete()
|
||||
|
||||
dynamodb = boto3.resource('dynamodb', region_name=region)
|
||||
table = dynamodb.Table(str('attack-range-detection-testing-state-' + honeypot_name))
|
||||
table.delete()
|
||||
|
||||
|
||||
def get_secret(secret_name):
|
||||
region_name = "eu-central-1"
|
||||
session = boto3.session.Session()
|
||||
client = session.client(
|
||||
service_name='secretsmanager',
|
||||
region_name=region_name
|
||||
)
|
||||
|
||||
get_secret_value_response = client.get_secret_value(SecretId=secret_name)
|
||||
|
||||
if 'SecretString' in get_secret_value_response:
|
||||
secret = get_secret_value_response['SecretString']
|
||||
secret_obj = json.loads(secret)
|
||||
|
||||
return secret_obj[secret_name]
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
import git
|
||||
import os
|
||||
import logging
|
||||
|
||||
from helpers import aws_service
|
||||
|
||||
# Logger
|
||||
logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO"))
|
||||
LOGGER = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def clone_honeypot_project():
|
||||
LOGGER.info(f"Clone Honeypot Project")
|
||||
O_AUTH_TOKEN_GITHUB = aws_service.get_secret("github_token")
|
||||
repo_obj = git.Repo.clone_from('https://' + O_AUTH_TOKEN_GITHUB + ':x-oauth-basic@github.com/splunk/attack_range_honeypot', "attack_range", branch='develop')
|
||||
return repo_obj
|
||||
@@ -0,0 +1,45 @@
|
||||
import os
|
||||
from os import path
|
||||
import sys
|
||||
import argparse
|
||||
|
||||
from helpers import github_service, aws_service, attack_range_controller
|
||||
|
||||
|
||||
def main(args):
|
||||
|
||||
parser = argparse.ArgumentParser(description="Attack Range Honeypot Service")
|
||||
parser.add_argument("-a", "--action", required=True,
|
||||
help="action")
|
||||
parser.add_argument("-r", "--region", required=False,
|
||||
help="aws region")
|
||||
parser.add_argument("-n", "--name", required=True,
|
||||
help="name of the honeypot")
|
||||
|
||||
args = parser.parse_args()
|
||||
region = args.region
|
||||
name = args.name
|
||||
action = args.action
|
||||
|
||||
|
||||
if action == "build":
|
||||
response = aws_service.get_entry_database(name)
|
||||
if not response:
|
||||
github_service.clone_honeypot_project()
|
||||
#ssh_key_name, key_material = aws_service.create_key_pair(region)
|
||||
aws_service.create_tf_state_store(name, region)
|
||||
aws_service.create_entry_database(region, name, "building")
|
||||
password = attack_range_controller.build_attack_range_honeypot(region, name)
|
||||
aws_service.update_entry_database(name, password, "running")
|
||||
|
||||
elif action == "destroy":
|
||||
data = aws_service.get_entry_database(name)
|
||||
if data:
|
||||
github_service.clone_honeypot_project()
|
||||
attack_range_controller.destroy_attack_range_honeypot(data)
|
||||
aws_service.delete_entry_database(name)
|
||||
aws_service.delete_tf_state_store(data['region'], name)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main(sys.argv[1:])
|
||||
@@ -0,0 +1,79 @@
|
||||
ansible==3.1.0
|
||||
ansible-runner==1.4.7
|
||||
apipkg==1.5
|
||||
aspy.yaml==1.3.0
|
||||
atomicwrites==1.4.0
|
||||
attackcti==0.3.4.3
|
||||
attrs==20.3.0
|
||||
azure-common==1.1.25
|
||||
azure-core==1.8.2
|
||||
azure-identity==1.4.1
|
||||
azure-mgmt-compute==17.0.0
|
||||
azure-mgmt-core==1.2.1
|
||||
azure-mgmt-network==16.0.0
|
||||
azure-mgmt-resource==15.0.0
|
||||
bcrypt==3.2.0
|
||||
boto3==1.17.30
|
||||
botocore==1.20.30
|
||||
certifi==2020.12.5
|
||||
cffi==1.14.5
|
||||
cfgv==2.0.1
|
||||
chardet==4.0.0
|
||||
configparser==5.0.2
|
||||
contextlib2==0.6.0.post1
|
||||
Deprecated==1.2.12
|
||||
dnspython==2.1.0
|
||||
docutils==0.16
|
||||
execnet==1.8.0
|
||||
gitdb==4.0.5
|
||||
GitPython==3.1.14
|
||||
identify==2.1.3
|
||||
idna==2.8
|
||||
importlib-metadata==3.7.3
|
||||
Jinja2==2.11.3
|
||||
jmespath==0.10.0
|
||||
lockfile==0.12.2
|
||||
MarkupSafe==1.1.1
|
||||
mock==4.0.3
|
||||
more-itertools==8.7.0
|
||||
mysql-connector-python==8.0.23
|
||||
nodeenv==1.3.4
|
||||
ntlm-auth==1.5.0
|
||||
packaging==20.9
|
||||
path==15.1.2
|
||||
path.py==12.5.0
|
||||
pexpect==4.8.0
|
||||
pluggy==0.13.1
|
||||
pre-commit==2.11.1
|
||||
protobuf==3.15.6
|
||||
psutil==5.8.0
|
||||
ptyprocess==0.7.0
|
||||
py==1.10.0
|
||||
pycparser==2.20
|
||||
PyGithub==1.54.1
|
||||
PyInquirer==1.0.3
|
||||
PyJWT<2.0.1
|
||||
PyNaCl==1.4.0
|
||||
pyparsing==2.4.7
|
||||
pytest==6.2.2
|
||||
python-daemon==2.3.0
|
||||
python-dateutil==2.8.1
|
||||
python-terraform==0.10.1
|
||||
pywinrm==0.4.1
|
||||
PyYAML==5.4.1
|
||||
requests==2.25.1
|
||||
requests-ntlm==1.1.0
|
||||
s3transfer==0.3.4
|
||||
six==1.13.0
|
||||
smmap==3.0.5
|
||||
splunk-sdk==1.6.15
|
||||
tabulate==0.8.9
|
||||
termcolor==1.1.0
|
||||
toml==0.10.2
|
||||
urllib3==1.26.4
|
||||
virtualenv==20.4.3
|
||||
wcwidth==0.2.5
|
||||
wget==3.2
|
||||
wrapt==1.12.1
|
||||
xmltodict==0.12.0
|
||||
zipp==3.4.1
|
||||
Reference in New Issue
Block a user