Honeypot Inteligente que Devuelve Ataques al Atacante

				
					import socket
import threading
import time
import subprocess
import logging
import uuid
import sys
from logging.handlers import RotatingFileHandler
import gzip
import os

HONEYPOT_PORTS = [21, 23, 80, 443, 2222, 3306, 3389, 4000, 8080, 8443, 10000]
BANNER = "Welcome \nUnauthorized access is prohibited\n"
CHAR_DELAY = 0.3  # Seconds per character for banner delay

class CompressedRotatingFileHandler(RotatingFileHandler):
    def doRollover(self):
        super().doRollover()
        if self.backupCount > 0:
            old_log = f"{self.baseFilename}.1"
            if os.path.exists(old_log):
                with open(old_log, 'rb') as f_in, gzip.open(old_log + '.gz', 'wb') as f_out:
                    f_out.writelines(f_in)
                os.remove(old_log)

logger = logging.getLogger()
logger.setLevel(logging.INFO)

formatter = logging.Formatter('%(asctime)s [%(levelname)s] %(message)s')

file_handler = CompressedRotatingFileHandler(
    '/var/log/honeypot.log', maxBytes=1_000_000_000, backupCount=5)
file_handler.setFormatter(formatter)
logger.addHandler(file_handler)

console_handler = logging.StreamHandler(sys.stdout)
console_handler.setFormatter(formatter)
logger.addHandler(console_handler)


def create_firewall_rules(attacker_ip, local_port):
    dnat_cmd = [
        "iptables", "-t", "nat", "-A", "PREROUTING",
        "-s", attacker_ip, "-p", "tcp", "--dport", str(local_port),
        "-j", "DNAT", "--to-destination", f"{attacker_ip}:{local_port}"
    ]

    masq_cmd = [
        "iptables", "-t", "nat", "-A", "POSTROUTING",
        "-p", "tcp", "-d", attacker_ip, "--dport", str(local_port),
        "-j", "MASQUERADE"
    ]

    logger.info(f"Applying DNAT rule: {attacker_ip}:{local_port} -> {attacker_ip}:{local_port}")
    subprocess.call(dnat_cmd)

    logger.info(f"Applying MASQUERADE rule for {attacker_ip}:{local_port}")
    subprocess.call(masq_cmd)


def send_slow_banner(conn):
    try:
        for char in BANNER:
            conn.send(char.encode())
            time.sleep(CHAR_DELAY)
    except Exception as e:
        logger.error(f"Error sending banner: {e}")


def handle_connection(conn, addr, port):
    ip, src_port = addr
    session_id = uuid.uuid4()
    logger.info(f"Session {session_id} started from {ip}:{src_port} on port {port}")

    send_slow_banner(conn)
    create_firewall_rules(ip, port)

    try:
        while True:
            data = conn.recv(1024)
            if not data:
                break
            data_str = data.decode(errors='ignore').strip()
            logger.info(f"Session {session_id} received data: {data_str}")
            conn.send(b"Access denied\n")
    except Exception as e:
        logger.error(f"Session {session_id} error with {ip}:{src_port} - {e}")
    finally:
        conn.close()
        logger.info(f"Session {session_id} closed with {ip}:{src_port}")


def listener(port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(('0.0.0.0', port))
    sock.listen(5)
    logger.info(f"Honeypot listening on port {port}")

    while True:
        conn, addr = sock.accept()
        thread = threading.Thread(target=handle_connection, args=(conn, addr, port))
        thread.daemon = True
        thread.start()


def enable_ip_forwarding():
    try:
        subprocess.call(["sysctl", "-w", "net.ipv4.ip_forward=1"])

        with open("/etc/sysctl.conf", "r") as sysctl_file:
            lines = sysctl_file.readlines()

        forwarding_line = "net.ipv4.ip_forward = 1\n"
        if forwarding_line not in lines:
            with open("/etc/sysctl.conf", "a") as sysctl_file:
                sysctl_file.write("\n" + forwarding_line)

        subprocess.call(["sysctl", "-p"])
        logger.info("IP forwarding enabled")
    except Exception as e:
        logger.error(f"Error enabling IP forwarding: {e}")


def main():
    logger.info("Infinite honeypot starting...")
    enable_ip_forwarding()

    for port in HONEYPOT_PORTS:
        thread = threading.Thread(target=listener, args=(port,))
        thread.daemon = True
        thread.start()

    try:
        while True:
            time.sleep(10)
    except KeyboardInterrupt:
        logger.info("Honeypot terminated")


if __name__ == '__main__':
    main()