Giter Site home page Giter Site logo

binarydefense / artillery Goto Github PK

View Code? Open in Web Editor NEW

This project forked from trustedsec/artillery

990.0 990.0 192.0 2.06 MB

The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.

Python 97.81% Shell 1.57% Batchfile 0.62%

artillery's People

Contributors

captainwasabi avatar cashiuus avatar corelanc0d3r avatar dagonis avatar davidjacobson avatar droberson avatar ericl42 avatar ev0x avatar gled-rs avatar hackingdave avatar inexact avatar jberry avatar jdogherman avatar kas21 avatar katkad avatar prometheaninfosec avatar russhaun avatar shorttie avatar theangrybyrd avatar tomsteele avatar yoshi325 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

artillery's Issues

Artillery isn't actually compatible with Windows

For instance, core.is_already_banned() uses the Linux command 'iptables', this will not work on windows. There are similar things all trough the code. It is clear this program wasn't made for windows.

Consider removing Windows from "Supported platforms" in the readme.

Artillery detecting incoming from 127.0.0.1 filling log space.

I posted this on the wrong artillery git on 26 Feb so it's outdated and the log in question is gone. Posting it here for information only in case it happens again.

When looking at /var/log/user.log I see repititions of

Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 123
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 123
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 8080
Feb 24 06:32:24 server400 Artillery[INFO]: Honeypot detected incoming
connection from 127.0.0.1 to port 808

Filling the log space and making the system unresponsive, Debian Buster with Swizzin installed. It created a 36GB log file.

No firewalld/nftables compatibility

CentOS 8.1 reveals that nftables is the firewalld default backend. Fedora Server 31 does not have this option present, however nftables is still the firewalld backend out-of-the-box.

The following lines deal with iptables:

core.py
336:    subprocess.Popen(
337:          "iptables -I ARTILLERY 1 -s %s -j DROP" % ip, shell=True).wait()

339:    if iptables_logprefix != "":
340:          subprocess.Popen("iptables -I ARTILLERY 1 -s %s -j LOG --log-prefix \"%s\"" % (ip, iptables_logprefix), shell=True).wait() 

642:    execOScmd("iptables -D INPUT -j ARTILLERY", "Deleting ARTILLERY IPTables Chain")

645:    execOScmd("iptables -N ARTILLERY -w 3")
646:    execOScmd("iptables -F ARTILLERY -w 3")
647:    execOScmd("iptables -I INPUT -j ARTILLERY -w 3")

718:    massloadcmd = "iptables -I ARTILLERY -s %s -j DROP -w 3" % ips_to_block

722:    massloadcmd = "iptables -I ARTILLERY -s %s -j LOG --log-prefix \"%s\" -w 3" % (ips_to_block, iptables_logprefix)

746:    proc = subprocess.Popen("iptables -L ARTILLERY -n --line-numbers",
747:                            stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)

1067:  subprocess.Popen("iptables -D INPUT -j ARTILLERY",
1068:          stdout=subprocess.PIP, stderr=subprocess.PIPE, shell=True)
1069:  subprocess.Popen("iptables -X ARTILLERY",
1070:          stdout=subprocess.PIP, stderr=subprocess.PIPE, shell=True)

remove_ban.py
21:        proc = subprocess.Popen("iptables -L ARTILLERY -n -v --line-numbers | grep %s" % (
22:            ipaddress), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)

33:                subprocess.Popen("iptables -D ARTILLERY %s" % (line),
34:                                 stderr=subprocess.PIPE, stdout=subprocess.PIPE, shell=True)


honeypot.py
106:            cmd = "iptables -D ARTILLERY -p %s --dport %s -j ACCEPT -w 3" % (porttype, port)
107:            execOScmd(cmd)
108:            cmd = "iptables -A ARTILLERY -p %s --dport %s -j ACCEPT -w 3" % (porttype, port)
109:            execOScmd(cmd)


anti_dos.py
17:        subprocess.Popen("iptables -A ARTILLERY -p tcp --dport %s -m limit --limit %s/minute --limit-burst %s -j ACCEPT" %
18:                         (ports, anti_dos_throttle, anti_dos_burst), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True).wait()

Recommendation: Look for firewalld as an active service at the beginning of the program (or have it as a sysarg[2] option). Set a variable and use if statements to decide whether to use the iptables version or the nftables version.

Fileopen1 in SSH_Monitor

[] An error in ssh monitor occured. Printing it out here: local variable 'fileopen1' referenced before assignment
[
] An error in ssh monitor occured. Printing it out here: local variable 'fileopen1' referenced before assignment
[*] An error in ssh monitor occured. Printing it out here: local variable 'fileopen1' referenced before assignment

Error message kept popping up when I would run the artillery main script, was able to solve it by putting an empty variable right after the function for ssh_monitor:

def ssh_monitor(monitor_frequency):
counter = 0
fileopen1 = ''
while 1:

email_alerts setting not checked during start

current release does not perform check for email alerts when loading. it just tries to send regardless. When run it fails with stmp related errors. When the honeypot code
is called there are related functions that call this when run
issue#87(email_alerts)

this does not hurt the operation. the default in config after install is "OFF". i will include check in mail function for this. also inform user it is not enabled

IPtables doesn't open ports to allow connectivity to honeypot automatically

Should activating the honeypot automatically add the appropriate IPTables ACCEPT rules for any honeypot ports it successfully launched a listener on?

Maybe add a new config option to AUTO_ACCEPT_HONEYPOT_PORTS or something, that adds them to the ARTILLERY chain. The ban inserts at line 1 always, so the accepts to the honeypot ports would get pushed further down the list so its still banning proper. And stopping artillery will delete that chain and close the ports back off automatically.

Unable to turn off threat intelligence feed

Hello,

Perhaps I'm misunderstanding the settings.

I'm wanting to populate banlist.txt with ONLY the IPs that are hitting this actual box.

I set the following setting to OFF in an attempt to stop artillery from auto-populating the banlist.txt file:

THREAT_INTELLIGENCE_FEED="OFF"

I then cleared the banlist.txt file, but it is still getting populated with the IPs at https://www.binarydefense.com/banlist.txt

Thanks for any help with this.

Alerts not logged

I'm running 2.1.1 (also tried the newest version) on Windows Server 2019. I start artillery, the log file alerts.log confirms this with "Artillery has started successfully", then I do a nmap scan, I get opened ports that were configured, but nothing gets logged. MONITOR & CONSOLE LOGGING are both ON. The server has two network cards, but I don't get any alerts even if one is disabled.

Any ideas?

Banlist circular dependency issue

When the create iptables function is ran, it looks through the ban list to ban any IP's not already banned.

However in the ban function, it looks at the ban list and does not ban anything already in the list, even if it's not already in IP tables

Bulk/Digest email report

Hi,

not really an issue, more of a feature request.
would it be possible to receive once a day a bulk/digest email report, instead of the single Artillery Incident mails?

If not, what are the reasons for it?

Recycle IPs

We would like to ban for 24 hours after hitting the honeypot, so for testing I set
RECYCLE LOGS AFTER A CERTAIN AMOUNT OF TIME - THIS WILL WIPE ALL IP ADDRESSES AND START FROM SCRATCH AFTER A CERTAIN INTERVAL
RECYCLE_IPS="ON"

RECYCLE INTERVAL AFTER A CERTAIN AMOUNT OF MINUTES IT WILL OVERWRITE THE LOG WITH A BLANK ONE AND ELIMINATE THE IPS - DEFAULT IS 7 DAYS
ARTILLERY_REFRESH="600"

I assume that means it should reset the list every 10 minutes? However the ips never delete. Any Ideas?

Syslog facilities

Seems there is a difference between syslog remote, local and to file. REMOTE declares levels and is forced with facilities, LOCAL seems to disregard it all and just dumps it raw like FILE.

Aug  9 09:22:38 Servername Artillery has blocked (blacklisted) the following IP for SSH brute forcing violations: 195.xxx.xxx.102

Aug  9 09:22:38 Servername Artillery has blocked (blacklisted) the following IP for SSH brute forcing violations: 195.xxx.xxx.102

Aug  9 09:22:38 Servername Artillery has blocked (blacklisted) the following IP for SSH brute forcing violations: 195.xxx.xxx.102

...

vs

Aug  9 09:22:38 Servername artillery/brute[4348] Blocked (blacklisted) the following IP for SSH brute forcing violations: 195.xxx.xxx.102

Aug  9 09:22:38 Servername artillery/brute[4348] Blocked (blacklisted) the following IP for SSH brute forcing violations: 195.xxx.xxx.102

Aug  9 09:22:38 Servername artillery/brute[4348] Blocked (blacklisted) the following IP for SSH brute forcing violations: 195.xxx.xxx.102

...

There is also the repetition of messages...

Error, Artillery was unable to log into the mail server

I just setup Artillery on a brand new Ubuntu and then Debian VM.

Install went fine, detection works but, but I just cannot get emails to fire, just get "Error, Artillery was unable to log into the mail server".

All I'm doing is editing config to point to localhost and I can see from the mail logs that when I trigger the honeypot it just isn't connecting.

I don't see anything in the install guide about any pre-reqs but I must be missing something obvious, though I've no clue what.

Can anyone help please?

exact step that a 7y old can do?

what are the exact steps from beginning to end to do this,

run ./setup.py

on win10

what are

what are the exact steps from beginning to end to do this:

edit your /else/init.d/rc.local to start artillery on boot up

on win10

How to change the config for multiple email recipients

Hi,
A quick question and appreciate to clarify if it is possible to add multiple email addresses for the notification. I tried different standard formats and non seems to work here is the patterns I used:
`# THIS IS WHO TO SEND THE ALERTS TO - EMAILS WILL BE SENT FROM ARTILLERY TO THIS ADDRESS
ALERT_USER_EMAIL="mail1,mail2,mail3"

#ALERT_USER_EMAIL="mail1","mail2","mail3"
#`

How complete is Windows support?

From the code there are references to supporting Windows but there are also plenty of references that will not work when using Windows. Compared to the Linux support how comparable is the Windows support?

I can't seem to get this to run on windows, please help!

I can't seem to get this to work on windows, because for some reason no matter if I run in powershell or cmd it wont load the different (Y/N) options.
I have attached a file so you can se a bit better what is happening.
It just loads and then instantly exits instead of asking me (Y/N).
I'm new to python, sorry.
artillery bug

logfiles and saved samples

Hi, i have just installed artillery and i am looking for some documentation. It is not clear to me if there is a local attacks log file and if there is a chance to get malware samples saved somewhere.
Thanks in advance

Email timer not functioning

It would appear the setting:

# THIS WILL SEND EMAILS OUT DURING A CERTAIN FREQUENCY. IF THIS IS SET TO OFF, ALERTS
# WILL BE SENT AUTOMATICALLY AS THEY HAPPEN (CAN LEAD TO A LOT OF SPAM)
EMAIL_TIMER="ON"
#
# HOW OFTEN DO YOU WANT TO SEND EMAIL ALERTS (DEFAULT 10 MINUTES)
EMAIL_FREQUENCY="72301"

doesn't affect the email delivery schedule in any way (immediate).

Or does it somehow relate to:

# SHOULD EMAIL ALERTS BE SENT
EMAIL_ALERTS="ON"

Artillery on Kali Linux: HONEYPOT_BAN not working :(

The function ssh_monitor() checks for existing log files to read, via if statements. For Debian it first checks the presence of auth.log (where sshd logs failures, default config on my Kali), which exists

        if os.path.isfile("/var/log/auth.log"):
            fileopen1 = open("/var/log/auth.log", "r")

shortly after, there is another Debian check for faillog,

        if os.path.isfile("/var/log/faillog"):
            fileopen1 = open("/var/log/faillog", "r")

which also exists, but from what I can tell, nothing logs there, as it is an empty file. This, artillery continues to read an empty file, and never blocks when attacked.

Commenting out the check for the faillog worked in fixing the problem for my situation. Not sure if some extra logic would be useful to solve this for others...

New Setup.py Issue

Now that the Line 10 problem was fixed, now I get the below error when trying to run the setup.py

File "setup.py", line 94
filewrite = file("/Library/LaunchDaemons/com.artillery.plist", "w")
^
TabError: inconsistent use of tabs and spaces in indentation

AttributeError: 'module' object has no attribute 'g_configfile'

Hello, trying new release but getting this error on start:

root@KALI:~/artillery# python setup.py

Welcome to the Artillery installer. Artillery is a honeypot, file monitoring, and overall security tool used to protect your nix systems.

Written by: Dave Kennedy (ReL1K)

Do you want to install Artillery and have it automatically run when you restart [y/n]: y
[] Beginning installation. This should only take a moment.
[
] Adding artillery into startup through init scripts..
[] Triggering update-rc.d on artillery to automatic start...
[
] Do you want to keep Artillery updated? (requires internet) [y/n]: y
[] Checking out Artillery through github to /var/artillery
Clone in '/var/artillery' in corso...
remote: Enumerating objects: 138, done.
remote: Counting objects: 100% (138/138), done.
remote: Compressing objects: 100% (113/113), done.
remote: Total 1914 (delta 94), reused 62 (delta 25), pack-reused 1776
Ricezione degli oggetti: 100% (1914/1914), 1.97 MiB | 3.41 MiB/s, fatto.
Risoluzione dei delta: 100% (959/959), fatto.
[
] Finished. If you want to update Artillery go to /var/artillery and type 'git pull'
[*] Would you like to start Artillery now? [y/n]: y
Traceback (most recent call last):
File "setup.py", line 175, in
check_config()
File "/root/artillery/src/core.py", line 196, in check_config
configpath = get_config_path()
File "/root/artillery/src/core.py", line 237, in get_config_path
path = globals.g_configfile
AttributeError: 'module' object has no attribute 'g_configfile'
root@KALI:~/artillery#

any ideas ?

running Linux KALI 5.3.0-kali3-amd64 #1 SMP Debian 5.3.15-1kali1 (2019-12-09) using VMwareFusion (11.5.1) on OS X (Catalina 10.15.2)

thanks

artillery not seeing udp traffic

udp ports are opened by artillery. udp traffic reaches the artillery server, but the host ip is not added to the ban list or the iptables chain.

Running as unprivileged user (non-root)

Curious how you suggest running this as non-root? While a container should work it seems more work than its worth.

Currently I have been attempting to use something along the lines of:
/usr/bin/sandbox -C -H /var/artillery -t sandbox_net_t /var/artillery/artillery.py

But I am still unable to get privileged ports to be accessible even after trying things like:
setcap 'cap_net_bind_service=+ep' /bin/python2.7

At various levels.

Also I have eliminated SELinux as interfering both by setting to permissive but also disabling silenced avcs.

ie:
Jan 23 10:11:00 hel journal: [!] 2018-01-23 10:11:00: Artillery was unable to bind to port: 21. This could be to an active port in use.
Jan 23 10:11:00 hel journal: [!] 2018-01-23 10:11:00: Artillery was unable to bind to port: 445. This could be to an active port in use.
Jan 23 10:11:00 hel journal: [!] 2018-01-23 10:11:00: Artillery was unable to bind to port: 22. This could be to an active port in use.
Jan 23 10:11:00 hel journal: [!] 2018-01-23 10:11:00: Artillery was unable to bind to port: 53. This could be to an active port in use.
Jan 23 10:11:00 hel journal: [!] 2018-01-23 10:11:00: Artillery was unable to bind to port: 110. This could be to an active port in use.
Jan 23 10:11:00 hel journal: [!] 2018-01-23 10:11:00: Artillery was unable to bind to port: 135. This could be to an active port in use.

Suggestions?

TIA!

More information gathering

How about an option to gather information about what payload was carried with the request, storing that would be very useful for knowing what kind of attacks are in trend right now.

Running with HONEYPOT_BAN="ON" makes starting time very long

Using HONEYPOT_BAN="ON" causes to make subprocess call to iptables for each ip in banlist.txt, which is really bad for performance reasons, it can ran even for 20 or more minutes.
One solution would be to use something like iptables-restore.

setup.py: RHEL support needed for startup service

Lines 119-120 in setup.py read:

                subprocess.Popen(
                    "update-rc.d artillery defaults", shell=True).wait()

On install for RHEL systems, setup.py stdout reads:

/bin/sh: update-rc.d: command not found

Recommendation:
Add a check to see if you're on a RHEL system, if so, then:

                subprocess.Popen(
                    "chkconfig artillery on", shell=True).wait()

Problem:
It appears that some versions of Fedora (i.e. FC-Sever 31) do not have either installed. Maybe instead of the above, create a systemd service?

Windows features wanted?

While not an issue per se. I would like to ask the artillery community on what they would like to see added as far as functionality to the windows side of this awesome project. i currently have a few items in the works. for example i have built a function for OS detection working on win 7/8/10 also insecure service checks ex. wpad/llmnr/smbv1. still in progress is an event dll. basic events exist for start/stop/attacks. I have compiled an exe from pyinstaller for those that don't want to install python enviroment wide and also eventlog monitoring and reporting just to name a few. if there is anything you would like to see added please create an issue on my page and we can make it happen. the above examples are just a small set of what i have in the works. i look forward to your requests have an awesome day. thanks for your time.

Secondary config file

Any thoughts on creating/reading a secondary config file, so config can stay in GIT, but we can have a local config file with OUR values that doesn't keep getting overwritten by pulls/merges/etc?

I'm not quite sure how you'd implement it right now, since the core.py reads the exact config file when it needs a value. Maybe change the read_config to read a hash, thats loaded earlier based on first reading config and then reading something like "user_config"?

Or just have all the possible config parameters in a single file, set default values inside the software, and tell the user to override the defaults in a user_config file or something?

Cant find project artillery logs

I recently downloaded Project Artillery to my Ubuntu server. However, I dont see any syslog file that it is logging activity to. Is artillery logging this activity to a different log file? I have looked in /var/log/messages, but artillery is not logging activity to there. When I look in /var/v
artillery, I dont see any "syslog" file.

artillery.config.docx

ssh issues with artillery

Default installation, artillery is running and bound to port 22. Clients receive "ssh_exchange_identification: read: Connection reset by peer" error when connecting.
Ubuntu 18.04.3 LTS

During installation I did create a symlink for /usr/bin/python mapping to /usr/bin/python3.

Error with running the script in ubuntu 14.04

When I use python 2.7 to run setup.py I get the error :
File "setup.py", line 11, in
from src.core import *
File "/home/ghadeer/artillery/src/core.py", line 40, in
from src.windows.events import HoneyPotEvent #check events.py for reasoning.
ImportError: No module named windows.events

And with python 3.6 I get the error :
File "setup.py", line 11, in
from src.core import *
File "/home/ghadeer/artillery/src/core.py", line 40, in
from src.windows.events import HoneyPotEvent #check events.py for reasoning.
File "/home/ghadeer/artillery/src/windows/events.py", line 12, in
import win32api, win32con, win32evtlog, win32evtlogutil, win32security
ModuleNotFoundError: No module named 'win32api'

I also tried to pip install pypiwin32 but also ends with errors :
Command python setup.py egg_info failed with error code 1 in /tmp/pip_build_root/pypiwin32
Storing debug log for failure in /root/.pip/pip.log

Setup.py Issue

FYI I posted this on the old thread by mistake.

I am trying to install this on a digitalocean droplet and receive the below error when running the setup.py.

Traceback (most recent call last):
File "./setup.py", line 10, in
from src.core import *
File "/root/artillery/src/core.py", line 422
if not os.path.isdir("/var/artillery/logs"): os.makedirs("/var/artillery/logs")
^
TabError: inconsistent use of tabs and spaces in indentation

I am running Python 3.5.2

restart_server.py kills but doesn't restart

The function kill_artillery() in core.py greps for artiller[y], which matches on the path of the called file /var/artillery/restart_server.py, thus executing the kill command on itself before finishing the script.

Changing the string to the following fixes the problem. ps -A x | grep artiller[y].py

harden.py - permissions are not set to root

harden.py sends (on a average small webserver) a ~20MB email, consisting of all /var/www/ files not owned by root, each listed on its own row with the full description repeated thousands of times.

Insecure configuration detected on filesystem: Issue identified: /var/www/* permissions are not set to root. If an attacker compromises the system and is running under the Apache user account, could view these files. Recommendation: Change the permission of /var/www/* to root:root. Command: chown root:root /var/www/*

Would suggest some sort of limiting and grouping.

Artillery crash on Ubuntu 14.04

Hi, I just installed Artillery on Ubuntu 14.04 (Python 2.7 running under Anaconda). It was running and adding a bunch of IPs to iptables, but then suddenly crashed after about 5 minutes with the following error:
artillery.py crashed with IOError in copyfile(): [Errno 2] No such file or directory: '/var/artillery/database/temp.database'

Not sure if I should touch the file or not, figured I'd report it just in case.

Double Time stamp when sending logs to splunk

When sending logs to our splunk instance some messages double post time stamps

Apr 30 15:26:42 xx.xx.xx.xxx [!] 2019-04-30 15:26:42: Killing the old Artillery process...
Apr 30 15:26:44 xx.xx.xx.xxx [!] Insecure configuration detected on filesystem: [!] Issue identified: Password authentication enabled. An attacker may be able to brute force weak passwords.
Apr 30 15:28:58 xx.xx.xx.xxx [!] Insecure configuration detected on filesystem: [!] Issue identified: Password authentication enabled. An attacker may be able to brute force weak passwords.
Apr 30 15:41:15 xx.xx.xx.xxx [!] 2019-04-30 15:41:15: Killing the old Artillery process...
Apr 30 15:41:15 xx.xx.xx.xxx [*] 2019-04-30 15:41:15: Restarting the Artillery Server process...
Apr 30 15:41:18 xx.xx.xx.xxx [!] Insecure configuration detected on filesystem: [!] Issue identified: Password authentication enabled. An attacker may be able to brute force weak passwords.

repeat entries in IPTables

If a src IP makes multiple connections quickly to the same host, Artillery ends up putting multiple drop rules in IPtables for the same IP.

Error, Artillery was unable to log into the mail server

I've installed Artillery on Ubuntu 14.04.3 LTS (GNU/Linux 3.16.0-30-generic x86_64).
The install completed OK and folder was create in /var/artillery.
I've changed the config file to allow for email alerts, but getting this error in syslog:
Error, Artillery was unable to log into the mail server
I can send emails via the relay using Telnet.
Am I missing something, please help

SHOULD EMAIL ALERTS BE SENT

EMAIL_ALERTS="ON"

CURRENT SUPPORT IS FOR SMTP, ENTER YOUR USERNAME AND PASSWORD HERE. LEAVE BLANK FOR OPEN RELAY

SMTP_USERNAME=""

ENTER THE SMTP PASSWORD HERE. LEAVE BLANK FOR OPEN RELAY

SMTP_PASSWORD=""

THIS IS WHO TO SEND THE ALERTS TO - EMAILS WILL BE SENT FROM ARTILLERY TO THIS ADDRESS

ALERT_USER_EMAIL="[email protected]"

FOR SMTP ONLY HERE, THIS IS THE MAILTO

SMTP_FROM="[email protected]"

SMTP ADDRESS FOR SENDING EMAILS, DEFAULT IS GMAIL

SMTP_ADDRESS="192.168.x.x"

SMTP PORT FOR SENDING EMAILS DEFAULT IS GMAIL WITH TTLS

SMTP_PORT="25"

THIS WILL SEND EMAILS OUT DURING A CERTAIN FREQUENCY. IF THIS IS SET TO OFF, ALERTS

WILL BE SENT AUTOMATICALLY AS THEY HAPPEN (CAN LEAD TO A LOT OF SPAM)

EMAIL_TIMER="OFF"

HOW OFTEN DO YOU WANT TO SEND EMAIL ALERTS (DEFAULT 10 MINUTES)

EMAIL_FREQUENCY="600"

harden.py

If the vision for harden.py is to be something completely filled out, what checks would be nice to be implemented? I have my own hardening script that I could easily adapt to this framework but just wanted to see to what depth it was intended to go.

Re: #10

Whitelist network

need to be able to whitelist a network, like 192.168.1.0/24. I have scanners that will get blocked out, and I could run a scan from any computer (especially dhcp ip addresses) on several subnets that are VPN'd together.

There is some code in src/core.py that looks like it is handling this, but I'll take a look when I get a chance.

Line 70

This throws an error, for some reason on linux, and using python2.X, it may have worked for you on your systems but I had to remove the os.mkdirs in order to get it to run. its on line 70.

Other than that its working like a dream, i love it.

mail notification

Hi,
I seem to have problem configuring alert notification to my company SMTP server, can you please advise where I got it wrong?
`

SHOULD EMAIL ALERTS BE SENT

EMAIL_ALERTS="ON"

CURRENT SUPPORT IS FOR SMTP, ENTER YOUR USERNAME AND PASSWORD HERE. LEAVE BLANK FOR OPEN RELAY

SMTP_USERNAME="[email protected]"

ENTER THE SMTP PASSWORD HERE. LEAVE BLANK FOR OPEN RELAY

SMTP_PASSWORD="my password"

THIS IS WHO TO SEND THE ALERTS TO - EMAILS WILL BE SENT FROM ARTILLERY TO THIS ADDRESS

ALERT_USER_EMAIL="my email"

FOR SMTP ONLY HERE, THIS IS THE MAILTO

SMTP_FROM="[email protected]"

SMTP ADDRESS FOR SENDING EMAILS, DEFAULT IS GMAIL

SMTP_ADDRESS="mail.mydomain.com"

SMTP PORT FOR SENDING EMAILS DEFAULT IS GMAIL WITH TTLS

SMTP_PORT="25"

THIS WILL SEND EMAILS OUT DURING A CERTAIN FREQUENCY. IF THIS IS SET TO OFF, ALERTS

WILL BE SENT AUTOMATICALLY AS THEY HAPPEN (CAN LEAD TO A LOT OF SPAM)

EMAIL_TIMER="ON"

HOW OFTEN DO YOU WANT TO SEND EMAIL ALERTS (DEFAULT 10 MINUTES)

EMAIL_FREQUENCY="600"
`

Ubuntu Server 16.04 Artillery failing to install

Hello,

I have just installed Ubuntu Server 16.04 that has been fully updated within a Virtualbox VM.

  1. Line 71 in the artillery.py file of the repository has a typo:

This should be:

os.mkdir("/var/artillery/database/")

Line with the error:
shouldbemkdir

  1. Just like in Issue #39 it fails to install. There is an ImportError when running the setup.py file. So I attempted to run the artillery.py file. It also imposed the same error.
from src.windows.events import HoneyPotEvent

For me this was the fix:

if os.name == 'nt':
    from src.windows.events import HoneyPotEvent
elif os.name == 'posix':
    pass

And it works:

However, this will break things on windows.

poc

  1. I've also noticed that after running the setup file it put out an error for the init script within the /etc/init.d/artillery. The only way I caught the error was when I tried to make a change to the file and it wouldn't let me do it. It was as root. The file was actually being read and wrote as [DOS] as opposed to unix. The fix for me was the following:
The source of the problem lies with src/startup_artillery
:set file=unix

The setup.py file has the same issue here's a screenshot:

issue with setupdotpy as well

Thank you for all your good work guys. Keep it up.

setup fails on Windows 2012

Setup fails with this error:
Welcome to the Artillery installer. Artillery is a honeypot, file monitoring, an
d overall security tool used to protect your nix systems.

Written by: Dave Kennedy (ReL1K)

Do you want to install Artillery and have it automatically run when you restart

Traceback (most recent call last):
File "setup.py", line 68, in
os.makedirs(program_files + "\Artillery\logs")
File "C:\Python27\lib\os.py", line 157, in makedirs
mkdir(name, mode)
WindowsError: [Error 183] Cannot create a file when that file already exists: 'C
:\Program Files (x86)\Artillery\logs'

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.