Dionaea binary in Kibana

[V0lundr]

Hi, When a certain binary gets dropped under /data/dionaea/binaries, is there a way to trace it in the Kibana logs to understand it's origin and the context around it, like with Cowrie binary/hash/logs for example?

[t3chn0m4g3]

No, there is no info available in Kibana since Dionaea does not log this information.

[vertebarbe]

Hello, I had the same problem, so I forked dionaea's 0.11.0 version here: https://github.com/vertebarbe/dionaea
I added logging of md5 and sha256 hashes when a file is uploaded.

@V0lundr, if you want to add it to T-Pot you can:

1. checkout the relevant commit here: vertebarbe/dionaea@dae4676
2. copy the files log_json.py and store.py on your T-Pot instance
3. Add the following lines to your /opt/tpot/etc/tpot.yml in the "volumes" section of the dionaea service
   - /path/to/store.py:/opt/dionaea/lib/dionaea/python/dionaea/store.py
   - /path/to/log_json.py:/opt/dionaea/lib/dionaea/python/dionaea/log_json.py

If you are interested, I also added some support for basic smb and ftp uploads in the next commits.

[Rocco-Hash1]

@vertebarbe thanks for showing me that so cool, but i cant get the binaries out

[Rocco-Hash1]

@vertebarbe you got any ideas, is this a known issue with tpot? should i file an issue?

[vertebarbe]

I don't have any idea of why this would be happening, sorry, you can try creating an issue about this.

[t3chn0m4g3]

This is not a T-Pot issue and usually this does the trick ...

On T-Pot add the user you want to scp with to the tpot-group: sudo usermod -aG tpot <scp user>.

If this does not work, it is a typical Linux permission issue, nothing we can fix.

[Rocco-Hash1]

all good @vertebarbe thank you so much if it wasnt for you I wouldnt have gotten this far, thank you!! I'm going to take tpot offline until i can get an answer going to file an issue thanks again

[Rocco-Hash1]

This is not a T-Pot issue and usually this does the trick ...

On T-Pot add the user you want to scp with to the tpot-group: sudo usermod -aG tpot <scp user>.

If this does not work, it is a typical Linux permission issue, nothing we can fix.

so what would you suggest the screenshots show its not working what would you suggest

[Rocco-Hash1]

@t3chn0m4g3 you was right i go it was a permission issue thank you and @vertebarbe for your help

[Rocco-Hash1]

thanks @vertebarbe they took out the tpot again so i got to spin up another once it is all done I will reply back i hope it works thank you so much for your assistance so far