SentryPeer addition?

[ghenry]

Hi all,

I couldn’t see a FAQ or guidance on how to submit a new HoneyPot?

I’m working on SentryPeer and it would be suitable at v1 to be used in your project.

https://github.com/SentryPeer/SentryPeer

Take a look and have a play? I’m currently working on the data sharing and replication features.

Thanks.

[t3chn0m4g3]

Thank you for the submission, I will play with it, hopefully even for 22.03 release.
Two questions right away, will the user be able to opt in / out of data sharing and does it have JSON logging to feed ES?

[t3chn0m4g3]

Works as advertised 😃

{
  "app_name": "sentrypeer",
  "app_version": "1.0.1",
  "event_timestamp": "2022-02-23 22:11:50.776640982",
  "event_uuid": "dbf16d72-16c4-46fa-b897-863804bbab92",
  "created_by_node_id": "dbf16d72-16c4-46fa-b897-863804bbab92",
  "collected_method": "responsive",
  "transport_type": "UDP",
  "source_ip": "172.20.254.190",
  "destination_ip": "172.26.0.2",
  "called_number": "john",
  "sip_method": "REGISTER",
  "sip_user_agent": "Telephone 1.5.2",
  "sip_message": "REGISTER sip:172.20.254.102 SIP/2.0\r\nVia: SIP/2.0/UDP 172.20.254.190:62533;rport;branch=z9hG4bKPjfceo9WR9VToeMFRZQG1poZhUehWz1cTC\r\nFrom: \"john\" <sip:[email protected]>;tag=.NcE0pMdOUA-X3oKzGeHFY36PlaHADSL\r\nTo: \"john\" <sip:[email protected]>\r\nCall-ID: bi.sbkm1J4fdbpyChfhcmc3S1ZxCW-yX\r\nCSeq: 4429 REGISTER\r\nContact: \"john\" <sip:[email protected]:62533;ob>\r\nAllow: PRACK\r\nAllow: INVITE\r\nAllow: ACK\r\nAllow: BYE\r\nAllow: CANCEL\r\nAllow: UPDATE\r\nAllow: INFO\r\nAllow: SUBSCRIBE\r\nAllow: NOTIFY\r\nAllow: REFER\r\nAllow: MESSAGE\r\nAllow: OPTIONS\r\nMax-forwards: 70\r\nUser-agent: Telephone 1.5.2\r\nExpires: 300\r\nContent-Length: 0\r\n\r\n"
}

Will ping you, once integration with ELK is finalized.

Thank you very much for the great collaboration!

[ghenry]

Ding Ding!!! Nice work! I've met, worked and connected with tons of great people since starting SentryPeer. Side projects rule!

Keep up the great work and let me know if there's anything else you'd like to see.

Thanks again!

[ghenry]

There might be a funny smell with the timestamp, let me know how you get on parsing it in ELK. I stick nanoseconds on for when SentryPeer gets hammered by probes:

https://github.com/SentryPeer/SentryPeer/blob/main/src/utils.c#L25

[ghenry]

Perfect!

I just noticed you seem to have the same problem with libosip2 here. My build shows me the same warning.

This should be gone now too.

[t3chn0m4g3]

Awesome, works just fine and likewise 😃

[ghenry]

Are you guys all from https://www.telekom.com/ then?

[t3chn0m4g3]

Yes, from the Deutsche Telekom Security GmbH unit.

[ghenry]

Very cool :-)

[t3chn0m4g3]

I just played around a little and noticed the following:

sentrypeer    | Source IP: 172.27.0.1
sentrypeer    | Called Number: .oO.oO
sentrypeer    | SIP Method: REGISTER
sentrypeer    | Transport Type: UDP
sentrypeer    | User Agent: Linphone Desktop/4.3.2 (macOS 10.16, Qt 5.15.2) LinphoneCore/5.0.49
sentrypeer    | Collected Method: responsive
sentrypeer    | Created by Node Id: 4753e0ad-c760-4c60-94cb-55723c28ea3d
sentrypeer    | SentryPeer db file location is: sentrypeer.db
sentrypeer    | Destination IP address of UDP packet is: 172.27.0.2
sentrypeer    | epochtime: 1645484236
sentrypeer    | Received (544 bytes): REGISTER sip:172.20.254.102 SIP/2.0
sentrypeer    | Via: SIP/2.0/UDP 172.20.254.190:56475;rport;branch=z9hG4bKPjJkPF7ao3MJ01hmE.291uVCqgNlq-y78a
sentrypeer    | Max-Forwards: 70
sentrypeer    | From: "john" <sip:[email protected]>;tag=LhdIkBaASo4qQL7US617wS7m1TToEqMA
sentrypeer    | To: "john" <sip:[email protected]>
sentrypeer    | Call-ID: XIcogmOV01Baa0JHOJ1KB6T.hqpw2JsG
sentrypeer    | CSeq: 42804 REGISTER
sentrypeer    | User-Agent: Telephone 1.5.2
sentrypeer    | Contact: "john" <sip:[email protected]:56475;ob>
sentrypeer    | Expires: 300
sentrypeer    | Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
sentrypeer    | Content-Length:  0
sentrypeer    |
sentrypeer    |
sentrypeer    | read_packet_buf size is: 1024:
sentrypeer    | read_packet_buf length is: 544:
sentrypeer    | bytes_received size is: 544:
sentrypeer    |
sentrypeer    | Bad Actor is:
sentrypeer    | Event Timestamp: 2022-02-21 22:57:16.303844711
sentrypeer    | Event UUID: 71a122f7-d17c-4db9-a3db-88a08b00b171
sentrypeer    | SIP Message: REGISTER sip:172.20.254.102 SIP/2.0
sentrypeer    | Via: SIP/2.0/UDP 172.20.254.190:56475;rport;branch=z9hG4bKPjJkPF7ao3MJ01hmE.291uVCqgNlq-y78a
sentrypeer    | From: "john" <sip:[email protected]>;tag=LhdIkBaASo4qQL7US617wS7m1TToEqMA
sentrypeer    | To: "john" <sip:[email protected]>
sentrypeer    | Call-ID: XIcogmOV01Baa0JHOJ1KB6T.hqpw2JsG
sentrypeer    | CSeq: 42804 REGISTER
sentrypeer    | Contact: "john" <sip:[email protected]:56475;ob>
sentrypeer    | Allow: PRACK
sentrypeer    | Allow: INVITE
sentrypeer    | Allow: ACK
sentrypeer    | Allow: BYE
sentrypeer    | Allow: CANCEL
sentrypeer    | Allow: UPDATE
sentrypeer    | Allow: INFO
sentrypeer    | Allow: SUBSCRIBE
sentrypeer    | Allow: NOTIFY
sentrypeer    | Allow: REFER
sentrypeer    | Allow: MESSAGE
sentrypeer    | Allow: OPTIONS
sentrypeer    | Max-forwards: 70
sentrypeer    | User-agent: Telephone 1.5.2
sentrypeer    | Expires: 300
sentrypeer    | Content-Length: 0

The logs contain anything you might wish for, but the source IP will currently only be reflected correctly if the container's network is running in host mode, which I want to avoid unless completely necessary. While this is typical for Docker with regard to the destination IP I was not aware this might be an issue with the source IP.

You can reproduce with the following docker-compose.yml:

version: '2.3'

networks:
  sentrypeer_local:

services:

# SentryPeer service
  sentrypeer:
    build: .
    container_name: sentrypeer
    restart: always
    networks:
     - sentrypeer_local
    #network_mode: "host"
    ports:
     - "5060:5060/udp"
     - "8082:8082"
    image: "dtagdevsec/sentrypeer:2203"

I used the Dockerfile provided from the v1.0.0 with the adjustment of RUN git clone https://github.com/SentryPeer/SentryPeer.git -b v1.0.0 (or it would not build due to missing Zyre.h).

[ghenry]

Thanks for testing!

I’ll look at the Dockerfile. I plan to clean it up more as it’s including the source files.

See last comment on moby/libnetwork#1994

Does that work? This is a Docker issue as I’m using what ever the source of the packet is at the lowest level possible.

[t3chn0m4g3]

Thanks, correct, re-checked this with other UDP based services, same result. Will test conntrack -D -p udp next.

[t3chn0m4g3]

Confirmed working! Thx!

[ghenry]

Awesome! That should help with the other projects too?

[t3chn0m4g3]

Yes, with ddospot which will be introduced in 22.03.

[ghenry]

Thanks. It's a real PITA for everyone.

[t3chn0m4g3]

So, this works 😄

[ghenry]

Awesome work! Can I pretty please steal those?

Thank you for all of this.

PS. We don't do TCP yet for SIP.

[t3chn0m4g3]

Of course 😊

Thanks for the great work and collaboration.

[ghenry]

My pleasure. Teamwork!

[t3chn0m4g3]

Dashboard is done (artificial attack data) and integration will be finalized soon.

[ghenry]

Amazing! Saves me so much work too. Is it possible to search for SentryPeer in that case?

[t3chn0m4g3]

Yes, all data is indexed as type:"Sentrypeer".

[ghenry]

Awesome! Does SentryPeer make SIP easier to manage than others you've used then? I think it's Dionaea?

Will this data show up at https://www.sicherheitstacho.eu/start/main ?

[t3chn0m4g3]

Once the integration in ewsposter is done by @trixam and T-Pot 22.03 is released it should be shown in Sicherheitstacho.

[ghenry]

Cool. I''ve clicked Watch on the main project. I'm going to do a v1.2.0 tag tonight so you could use that for the json instead of main

[t3chn0m4g3]

Perfect! Thank you!

[ghenry]

Hi @t3chn0m4g3

Is this line working for you in your Dockerfile?

chown -R sentrypeer:sentrypeer /opt/sentrypeer && \

Don't you also need /var/log to be owned by the sentrypeer user?

[ghenry]

Yeah, actually I had to change to:

    chown -R sentrypeer:sentrypeer /opt/sentrypeer /var/lib/sentrypeer /var/log/sentrypeer && \

[t3chn0m4g3]

This is happening on the T-Pot host by using volumes and owning the path. You can see that in the installer and the docker-compose.yml.

[ghenry]

Yeah, thought that after I tested my own Dockerfile. Ignore me :-)

[t3chn0m4g3]

Been there, done that 🤪

[ghenry]

AND I forgot 5060:5060/udp !!!

[ghenry]

Might be handy for you @t3chn0m4g3 SentryPeer/SentryPeer@dd5bc4d

[t3chn0m4g3]

Thanks!