Syrup

A SSH honeypot with rich features written in Go

Features

• SSH self-defined accounts and passwords, also allow any logins
• Fake shell. Records shell sessions and upload to asciinema.org (Or, if you wish, can log as UML-compatible format)
• Virtual Filesystem for browsing and fooling intruder
• SFTP/SCP support for uploading/downloading files
• Logs client key fingerprints
• Logs in JSON format for easy parsing
• Push activities to ElasticSearch for analysis and storage
• Record local and remote host when client attempt to create port redirection
• Structure allows extending command sets with ease

See Recorded Session in Action!

Requirements

Running

• Linux, Mac or Windows (I’ve only tested in Windows/WSL/Linux on ARMv7, the other platforms should work as expected)

  Building

• Go 1.9+ and dep, or
• Go 1.11+ and Git

Download

You may find the pre-build packages for various platform on the release tab. If you find the platform you need is not on the list, you can follow the building procedure in the next section.

Building

Go pre-1.11/1.11 with GO111MODULE=auto:

go get -u github.com/mkishere/sshsyrup
cd ~/go/src/github.com/mkishere/sshsyrup
dep ensure
go build -ldflags "-s -w" -o sshsyrup ./cmd/syrup
go build -ldflags "-s -w" -o createfs ./cmd/createfs

Go 1.11 with GO111MODULE=on:

Currently building executable with GO111MODULE=on is a bit tricky in Go 1.11 with module, here is how to do it if you want to leave module on:

git clone https://github.com/mkishere/sshsyrup/
go build -ldflags "-s -w" -o sshsyrup ./cmd/syrup
go build -ldflags "-s -w" -o createfs ./cmd/createfs

Setting up for the first run

• Modify config.yaml. Here is a sample configuration

    server:
        addr: 0.0.0.0           # Host IP
        port: 22                # Port listen to
        allowRandomUser: false  # Allow random user
        speed: 0                # Connection max speed in kb/s
        processDelay: 0         # Artifical delay after server returns responses in ms
        timeout: 0              # Connection timeout, 0 for none

• Prepare the virtual filesystem image by downloading the filesystem.zip from master branch or create your own by running

   ./createfs -p / -o filesystem.zip

  Since we’ll need to read every file from the directory, it will take some time to load.
  For Windows, since there are no user/group information, the file/directory owner will always be root.

  Alternatively, you can create your own image file by using zip in Linux (or any compatible zip utility file that is capable preserving uid/gid, symbolic links and timestamps in zip file). After all the image created is a standard zip file. Theoretically you can zip your entire filesystem into a zip file and hosted in Syrup, but remember to exclude sensitive files like /etc/passwd

• Prepare user and passwd file
  Put passwd and group file in the same directory as config.json. The format of both files are the same as their real-life counterpart in /etc, except that passwd also stores the password in the second field of each line, and asterisk(*) in password field can be used to denote matching any password.

• Generate SSH private key and renamed as id_rsa and put it in the same directory

   ssh-keygen -t rsa

• Start the server

   ./sshsyrup

Running from a Docker instance

A Docker image based on the latest build:

  docker pull mkishere/sshsyrup

By default the internal sshsyrup listens on 22.

docker run -d mkishere/sshsyrup

The following example shows how you can customize stuff while running Syrup in container:

docker run -d -p 9999:22 \
-v /path/to/vfs/image.zip:/filesystem.zip \
-v /path/to/config.yaml:/config.yaml \
-v /path/to/logfiles:/logs \
-v /path/to/group:/group \
-v /path/to/passwd:/passwd \
-v /path/to/private_key:/id_rsa \
-v /path/to/commands.txt:/commands.txt \
-v /path/to/command_output:/cmdOutput \
mkishere/sshsyrup

But you may want to map to port 22 to make your honeypot easier to find.

If you want to see what happens (logs) in the Docker instance, get the instance id (docker ps) and then
run docker logs -f YOUR_INSTANCE_ID.

Configuration parameters

Check out config.yaml

Logging

By default Syrup will create a logging file in logs/ directory with file name activity.log in JSON format.

Please note that Syrup will no longer append dates to log files. Use a proper log rotation tool (e.g. logrotate) to do the work.

Also, each terminal session (the shell) will be logged into a separate file under logs/sessions in asciinema v2 format.

Extending Syrup

Syrup comes with a framework that helps to implement command easier. By implementing the Command interface you can create your own command and being executed by intruders connecting to your honeypot. For more details refer to the wiki.

If your command prints static output every time, you can put the output in cmdOutput/, and Syrup will print that when client type the command in terminal.

Contributing

Feel free to submit feature request/bug report via the GitHub issue tracker.

For submitting PR, do the following steps:

1. Fork
2. Create a branch for the feature/bugfix containing your changes on your fork
3. Submit PR with your branch

It is advised that creating an issue to discuss the matter in advance if your change is large :)

TODO

• Minimal set of POSIX commands/utilities
• Shell parser