taskSavannah Administration - Tasks: task #3771, Submission of Big Bear Honeypot

 
 

task #3771: Submission of Big Bear Honeypot

Submitter:  Johann Cornet <cast>
Submitted:  Tue 22 Feb 2005 02:25:45 AM UTC
   
 
Should Start On:  Thu 24 Feb 2005 12:00:00 AM UTC Should be Finished on:  Thu 24 Feb 2005 12:00:00 AM UTC
Category:  Project Approval Priority:  * 5 - Normal
Status:  Cancelled Privacy:  Public
Assigned to:  Beuc Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 17 Mar 2005 10:26:50 PM UTC, comment #5: 

Hi,

We did not get a response from you, so we deleted your project from the pending queue.

If you would still like to have your project hosted at Savannah, please register it again.

The re-registration URL found in our acknowledgment of your earlier registration will direct you to the proper location where you can re-register your project.

Regards.

Sylvain Beucler <Beuc>
Sat 05 Mar 2005 09:10:22 AM UTC, comment #4: 

Hello,

Any news?

Sylvain Beucler <Beuc>
Thu 24 Feb 2005 08:56:08 PM UTC, comment #3: 

The notices look good.

As far as I see, libpcap is under an Expat-like non-copylefted license (which compatible with the GNU GPL, so there is no problem).

For the report, we are just concerned that if it is uploaded at Savananh, it is released under a GNU or GDFL-compatible license.

Regarding headers.h, I suggest you contact the authors of the tutorials and ask them if you use their code in a GPL'd program. You can also recreate it from scrach, or derive it from the Linux kernel headers you saw (the Linux kernel is released under the GNU GPL).

Please contact us again via this tracker once you have dealt with this last issue.

Sylvain Beucler <Beuc>
Thu 24 Feb 2005 07:01:32 PM UTC, comment #2: 

Hi thanks for the feedback of the submissions
I just finsih to modifie all my source code files with the GPL copiright notice, i also create the COPYING file.
You may notice the code change a little bit since last time.
All the code is in the BigBear.tar file attach to the task.

And i will make an effort to refer to GNU/Linux instead of Linux.

Otherwise for the license of my report i think the GFDL is a good idea, but first i need to see my project tutor to speak about it.

Last thing , about dependencies of my project i use libpcap which one is under GPL.

I also have a doubt about the file headers.h which one is made with the help of different tutorial founds on internet.
The problem is there is no license for this tutorial and as i see some piece of code (or nearly similar) in numerous website without any reference (except some linux headers but the code is not strictly the same) i do not know how to make apply any author rights (because i do not know who they are)
 
Regards

Johann Cornet <cast>
Thu 24 Feb 2005 08:10:23 AM UTC, comment #1: 

Hi,

I'm evaluating the project you submitted for approval in Savannah.

In order to release your project properly and unambiguously under the GPL, please place copyright notices and permission-to-copy statements at the beginning of every file of source code.

In addition, if you haven't already, please include a copy of the plain text version of the GPL, available from http://www.gnu.org/licenses/gpl.txt, into a file named "COPYING".

For more information, see http://www.gnu.org/licenses/gpl-howto.html.

The GPL FAQ explains why these procedures must be followed.  To learn why a copy of the GPL must be included with every copy of the code, for example, see http://www.gnu.org/licenses/gpl-faq.html#WhyMustIInclude.

Please send an updated version of your source code for us to review. You can attach files to this tracker in the "Attached Files" section.


Also, note that "Linux" is just a kernel of a more complex system that we like to refer to as GNU/Linux, to emphasize the ideals of the Free Software movement.

For more information, see http://www.gnu.org/gnu/linux-and-gnu.html.


Last, can you tell me under what license you plan to release your report? We recommand using the GNU Free Documentation License.


Regards.

Sylvain Beucler <Beuc>
Tue 22 Feb 2005 02:25:45 AM UTC, original submission:  


Site Admin. Approval/Edition URL:
 <https://savannah.gnu.org/admin/groupedit.php?group_id=7349>


###### ORIGINAL SUBMISSION DETAILS ######

System Group Name:
-----------------
  bigbear


Full Name:
----------
  Big Bear Honeypot


Type:
-----
  non-GNU


License:
--------
  GNU General Public License V2 or later


Other License:
--------------



Description:
------------
  The project, is an Honeypot system, including a sniffer an Intrusion Detection System (IDS) and a php frontend.This project is the main subject of my final year study of B.Sc computer system security at swansea institute of high education, (sihe.ac.uk), but as i want to find a job in this domain , i will clearly continue to works on the project after my graduation.
The main objectives of this one, are to improve my knowledge in C programation about Linux networks and gain knowledge about computer threats based on networks use.
So the programation start at a really basic level and do not use a lot of external program (libpcap (under GPL) for the moment)
Others characteristics of the projects are a description in details of the source code, testing of the Honeypots, explanation of the technologies chosen for the project, comparison of the Honeypot with other Honeypot, management of a team (if possible), management of feedback. As i am supposed to write a a huge report on this one for my graduation i will include it in the projects (as related works and documentation of the projects)

The aim of Honeypots can be defined by : Learning the tools, tactics, and motives involved in computer and network attacks, and share the lessons learned. for more information on honeypot i advise you to have a look on www.honeypots.com and www.honeynet.org

For the moment a simple TCP-IP sniffer improved as an IDS is done, but unfortunately it is not avaible on the web.

below the code source (sorry for the barbarian way to present the source code, if you want me to send a copy via e mail just contact me)

do not care about headers structure they are just here to avoid incompatibility
////////////
Listen computer interface with the help of libpcap
#include <stdio.h>
#include <stdlib.h>
#include <pcap.h> 
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/types.h>
typedef unsigned int u_int32;
/*
struct in_addr {
u_long s_addr;
};
*/
*********************************Ethernet header structure*********************************

struct ether_header {
u_char ether_dhost[6]; destination host (adresse de destination)
u_char ether_shost[6]; source host (adresse source)
u_short ether_type;    type de trame
};

********************************IP header structure *************************************

#define ETHERTYPE_IP 0x0800

struct ip_header {


#if BYTE_ORDER == LITTLE_ENDIAN   // l'ordre des bits dépendant des systèmes
u_char  ip_hl:4;          // header length (taille)
u_char  ip_v:4;           // version
#endif
#if BYTE_ORDER == BIG_ENDIAN
        u_char  ip_v:4;           // version 4 4
        u_char  ip_hl:4;          // header length 4 8 start at the 61th bit ?
#endif
u_char  ip_tos;           // Type de service 8 16
short   ip_len;           // taille totale 16 32
u_short ip_id;            // identification 15? 47
short   ip_off;           // champ de décalage du fragment 3 50
#define IP_DF 0x4000              // drapeau de non fragmentation 13 63
#define IP_MF 0x2000              // drapeau de fragmentation
#define IP_OFFMASK 0x1fff         // masque pour la fragmentation
u_char  ip_ttl;   // time to live 8 71
u_char  ip_p;             // protocole 8 79
u_short ip_sum;   // somme de controle 16 95 141 en realitee
struct in_addr ip_src;    // adresse source 32 start at the 144th bit
struct in_addr ip_dest;   // adresse destination 32

};


//************************************** TCP header **************************************
typedef u_int32_t tcp_seq; declaration of tcp_seq

struct tcp_header {
    u_short th_sport; /* source port */
    u_short th_dport; /* destination port */
    tcp_seq th_seq; /* sequence number */
    tcp_seq th_ack; /* acknowledgement number */
    #if BYTE_ORDER == LITTLE_ENDIAN
    u_int th_x2:4, /* (unused) */
    th_off:4; /* data offset */
    #endif
    #if BYTE_ORDER == BIG_ENDIAN
    u_int th_off:4, /* data offset */
    th_x2:4; /* (unused) */
    #endif
    u_char th_flags;
    #define TH_FIN 0x01
    #define TH_SYN 0x02
    #define TH_RST 0x04
    #define TH_PUSH 0x08
    #define TH_ACK 0x10
    #define TH_URG 0x20
    #define TH_ECE 0x40
    #define TH_CWR 0x80
    #define TH_FLAGS (TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG|TH_ECE|TH_CWR)
    u_short th_win; /* window */
    u_short th_sum; /* checksum */
    u_short th_urp; /* urgent pointer */
};


****************************Network device variable declaration****************************

char *dev;
char *net;
char *mask;
char *buffer; pointer to the buffer countaining the ip adress in the packet ?
struct ip *paquetip; pointer to the IP packet
struct sniff_tcp *paquettcp;
struct in_addr addr;
bpf_u_int32 maski;                     /* netmask */
bpf_u_int32 neti;                        /* IP */

**************************Pcap varaiables declaration************************************

char errbuf[PCAP_ERRBUF_SIZE]; /* Error string */
int packetsize; size of the packet captured
int timer; timer to capture the packet
int ret; return code value (error or not)
int display_flag;

pcap_t *handle; handle session
int datalink; data from the physical layer
int offset;
struct pcap_pkthdr header;          structure defining the header from pcap
u_char *packet;                 // the packet
int counter;
int i;
int port[18] = {9,13,21,22,25,37,80,111,113,139,445,538,869,893,1313,3306,10000,32768};
int p;
int packetcounter;

********************************Function to read and print data inside the ethernet headers*************

void print_ether_header(struct ether_header *paquet)
{
printf ( "\n\n---------------Packet intercepted , bytes %d\n" , header.len);
printf ("\n\n:::::::::::::::::::::Ethernet HEADER:::::::::::::::::\n");
printf("%d",sizeof (struct ether_header));
printf ("\n-----MAC DESTINATION ADRESS: ");
for (i=0 ; i <6 ; i++)
{
printf("%.2x ",paquet->ether_shost[i]); print the value contain in the ether_shost (source host), two by two
// packet ++;
}

printf ("\n-----MAC SOURCE ADRESS : ");
for (i=0 ; i <6 ; i++) same with destination host
{
printf("%.2x ",paquet->ether_dhost[i]);

}

printf ("\nType of packet : ");
printf("%.4x ",ntohs(paquet->ether_type)); this is the last information in the Ethernet layer
packet ++;

}



*************************************function to read data into the IP headers***********

void print_ip_header(struct ip_header *paquetip)
{
IP header in case of 0800 (display as 0008 because it is not display as hexa as it should be)
IP packet start here (RFC 894)
source adress start after bit 96 (RFC 791) it is 2*12 hexa value 2(12*byte) = 2(12*4) = 48 bit

printf ("\n\n:::::::::::::::::::::IP HEADER:::::::::::::::::\n"); printf("%d", sizeof(struct ip_header));


printf ("\n ::::::::from the structure::::::::: : ");


printf ("\n IP IHL------->");
printf("%d",paquetip->ip_hl);

printf ("\n IP Version--->"); 4bit
printf("%d",paquetip->ip_v);

printf ("\n  Protocol----->"); 4bit
printf("%.4x",paquetip->ip_p);

printf ("\n  IP Length----->"); 4bit
printf("%d",paquetip->ip_len);

printf ("\n\n IP source adress----->"); 32 bit
printf(inet_ntoa (paquetip->ip_src));

printf ("\n IP destination adress----->");
printf(inet_ntoa(paquetip->ip_dest));



printf ("\n\n");

}

*************************Print TCP headers info*************
void print_ether_header(struct ether_header *paquet)
void print_tcp_header(struct tcp_header *paquettcp)
{
printf ( "\n\n---------------Packet intercepted , bytes %d\n" , header.len);
printf ("::::::::::::::::::::TCP HEADER:::::::::::::::::\n");
printf("%d ",sizeof (struct tcp_header));
printf ("\n-----TCP source port: \n");
printf("%d",htons(paquettcp->th_sport)); print the value contain in the ether_shost (source host), two by two
packet ++;
printf("%.4x ",paquettcp->th_sport);

printf ("\n-----TCP destination port: \n");
printf("%d",htons(paquettcp->th_dport)); print the value contain in the ether_shost (source host), two by two
packet ++; ip_src.s_addr

printf ("\n\n");
}

int sort_by_prot(struct ether_header *paquet)
{
if (ntohs (paquet->ether_type) == ETHERTYPE_IP)
{
display_flag = 1;
}

return (display_flag);
}

int sort_by_ip(struct ip_header *paquetip)
{
if (strcmp (inet_ntoa(paquetip->ip_src), "192.168.1.1") == 0)
{
display_flag = 0 ;
}
if (strcmp (inet_ntoa(paquetip->ip_dest), "192.168.1.1") == 0)
{
display_flag = 0 ;
}
return (display_flag);
}

int sort_by_port(struct tcp_header *paquettcp)
{
display_flag = 0 ; reinitialize the flag
for (p=0;p<17;p++)
{
if (htons(paquettcp->th_dport) == port[p])
{
display_flag = 1 ;

}
printf("%d",port[p]);
}
return (display_flag);
}



********************************Main of the prog=NIC initialization**********************************

int main(int argc ,char *argv[]) argc = nb of arguments argv = dev
{
interface to listen

if (argc < 2 )
{
printf ("Please insert the name of the interface use to listen (eth0)");
}

// find propertie of the interface
dev = argv[1];
ret = pcap_lookupnet (dev , &neti , &maski , errbuf);

if (ret == -1)
{
printf ("%s\n", errbuf);
exit(-1);
}

display the adresse
addr.s_addr = neti; convert from computer name to human
net = inet_ntoa(addr);


display error
if (net == NULL)
{
perror ("inet_ntoa");
exit(-1);
}

printf("NET: %s\n",net);

display the mask
addr.s_addr = maski; convert from computer name to human
mask = inet_ntoa(addr);


display error
if (net == NULL)
{
perror ("inet_ntoa");
exit(1);
}

printf("MASK: %s\n",mask);
printf("Sniffing in progress \n");


if (!(handle = pcap_open_live (dev , BUFSIZ , 0 , 1000 , errbuf))) read on dev , bufsiz value , no promiscuous , error string
{
perror("can t open device\n");
exit(1);
}

datalink = pcap_datalink (handle); the datalink (physical layer type) of the handling packet


###################################################READING THE PACKET##################################

int size_ethernet = sizeof(struct ether_header);
int size_ip = sizeof(struct ip_header);

grap 10 packets (one by one)
counter = 0;
while (counter!=100000)
{
counter++;
printf (" ca marche jusque la");
if ((packet = (u_char *) pcap_next (handle , &header)) != NULL ) if a packet exist
{

paquetip=(struct ip_header*)(packet + size_ethernet); declaration of the ip packet (ip layer)
paquettcp=(struct tcp_header*)(packet + size_ip + size_ethernet);

display_flag = 0 ; initialize the flag

sort_by_prot((struct ether_header*)packet);

if (display_flag == 1)
{
sort_by_port((struct tcp_header*)paquettcp); selection packet to display due to port
}

if (display_flag == 1)
{
sort_by_ip((struct ip_header*)paquetip); selection packet to display due to port
}

/*if (display_flag != 1)
{
printf("non non non\n");
}

else
{
sort_by_ip((struct ip_header*)paquetip);
if (display_flag != 1)
{
printf("j ai dit non \n");
}
else
{
sort_by_port((struct tcp_header*)paquettcp); selection packet to display due to port
if (display_flag != 1)
{
printf("relou \n");
}
}

}
*/

if (display_flag == 1)
{
print_ether_header((struct ether_header*)packet); call the function and formate the packet with the ether_header structure (packet = rawpacket paquet=formated packet)

print_ip_header((struct ip_header*)paquetip); call the function and formate the packet with the ether_header structure (packet = rawpacket paquet=formated packet)
tcp = (struct sniff_tcp*)(packet + size_ethernet + size_ip);

print_tcp_header((struct tcp_header*)paquettcp);
}
else
{
printf("********************DROPPED**********************\n");
packetcounter++;
}
}

}
printf ("\n Number of packets Ignored : ");
printf ("%d",packetcounter);
printf ("\n");
 return 0;
}
//////////////////////


Other Software Required:
------------------------
  #include <stdio.h>
#include <stdlib.h>
#include <pcap.h> 
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/types.h>

program used , libpcap
i will certainly use also mysql and php


Other Comments:
---------------
  Sorry about my english, i am french (but it is not my fault !! (This is a bad french joke...)) but as a student in uk i will do use english language as main language for the project

#########################################

Johann Cornet <cast>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #3552:  BigBear.tar added by cast (80KiB - application/x-tar - Source Code of a Beta release of BigBear )

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

Follow 6 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-03-17 Beuc StatusNone Cancelled
    Open/ClosedOpen Closed
2005-02-24 cast Attached File- Added BigBear.tar, #100
2005-02-24 Beuc Should Start On- 2005-02-24
    Should be Finished on- 2005-02-24
    Assigned toNone Beuc

Back to the top

Powered by Savane 3.13-4448.
Corresponding source code