sjhilt/gaspot

GasPot Released at Blackhat 2015

GasPot

GasPot is a honeypot that has been designed to simulate a Veeder Root Gaurdian AST. These Tank Gauges are common in the oil and gas industry for Gas Station tanks to help with Inventory of fuels. GasPot was designed to randomize as much as possible so no two instances look identical.

Install

git clone https://github.com/sjhilt/GasPot.git

Configure

GasPot will run as downloaded above with no modifications. Configuration is based on a config.ini file. To make sure that GasPot looks like no other GasPot system on the internet and to collect the best information you can change the products and stations in the configuration file.

1. Change the station names to match gas stations in the region of deployment of GasPot.

2. Change the product names to match the type of product that would be utlized in the region of deployment.

Run GasPot

python3 GasPot.py

Review Logs

All connections will be logged locally to the all_attempts.log file created in the directory that GasPot is ran from.

Docker Install

Download the Docker image from the registry.

docker pull rosesecurity/gaspot:v0.1.0

Create the container.

docker run --name gaspot -p 10001:10001 rosesecurity/gaspot:v0.1.0

Write up

http://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-gaspot-experiment

Stargazers over time

gaspot's Issues

on which protocol does it works

^A issue

No success with typing ^AI20100 , every time I get this error : "Non ^A Command Attempt from:

Thanks

When running GasPot return and OS error using Python 3.7

Traceback (most recent call last):
  File "GasPot.py", line 288, in <module>
    addr = conn.getpeername()
OSError: [Errno 107] Transport endpoint is not connectet

In addition, I was using default config only adding addresses with the gas names.

Error in telnet session

Hello,

When I run ^AI20100 in the session of telnet , close the connection with error "Connection closed by foreign host"

What can is wrong ?

Thanks a greeting

problem to open GasPot

problem to open

\GasPot-master\GasPot.py", line 36
print 'Please specify a configuration file or rename config.ini.dist to config.ini!'
^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print('Please specify a configuration file or rename config.ini.dist to config.ini!')?

I already renamed config.ini.dist to config.ini

Message "Non ^A Command Attempt"

I have deployed Gaspot, but I always get this message "Non ^A Command Attempt from: x.x.x.x" when I try to connect to it using the script atg-info.nse (nmap --script atg-info -p 10001 ) or telnet/ncat (telnet ip port). However, if I use the same methods against a real Guardian AST, everything works as expected so there is something strange when decoding the request.

Analyzing the source code of GasPot and the source code of Conpot related to guardian_ast, I found some issues so I have modified some lines. If anyone has the same problem, here is the commit with the changes: TheMalwareGuardian@7ec35c4

As you can see it works well when the code its updated:

TypeError: a bytes-like object is required, not 'str

i get this error when trying to insert ^AI20100 command

Unknown Error: a bytes-like object is required, not 'str'
Traceback (most recent call last):
File "GasPot1.py", line 302, in
while not ('\n' in response or '00' in response):
TypeError: a bytes-like object is required, not 'str'