Integration of Log4j Honeypot: Log4Pot

[t3chn0m4g3]

I am happy to announce the integration of @thomaspatzke's Log4Pot into T-Pot and I hope it will help you on your Log4j hunting endeavors.

If you setup a new instance of T-Pot there is not much to do. Simply choose the LOG4J flavor.
If you are already using a T-Pot 20.06 you have to run the /opt/tpot/update.sh script, import the new objects into Kibana and run the /opt/tpot/bin/tped.sh script and choose log4j.

[certrik]

Hi. Great stuff @t3chn0m4g3
Is there a proposed path to upgrade the log4pot while it evolves?
Is ...

--download-payloads: Download http(s) and ldap payloads and log indicators
--download-class: Implement downloading Java Class file referenced by the payload
--download-dir: Set a download directory. If given, payloads are stored persistently and are not deleted after analysis

... also integrated wit log4pot@TPOTCE?

Thank you very much.

[t3chn0m4g3]

Yes.

[t3chn0m4g3]

New version of Log4Pot (based on latest master) has been pushed.
You need to run /opt/tpot/update.sh for some changes to take effect (automatic payload download etc.).
This adds automatic payload downloads to /data/log4pot/payloads and deobfuscation.

[rahulpawar1209]

Hi @t3chn0m4g3 ,
I installed updated honeypot version 20.06.2 having Log4Pot but not getting any hits on it. On other honeypots getting lots of hits.

[archangelneo18]

same here, updated but not getting any hits for log4pot.

[t3chn0m4g3]

It seems there is a problem with a field type preventing the ingestion. Will look into it and provide a fix.

[t3chn0m4g3]

Just redeployed Logstash, the error should not occur any longer.
You need to import the attached object for the dashboard to show all values (see Wiki on how to import the objects).
Log4Pot Request.ndjson.zip

[zarandija]

Hi.

I have already installed version 20.06 in standard mode (all). If I perform the steps
"If you are already using a T-Pot 20.06 you have to run the script /opt/tpot/update.sh, import the new objects in Kibana and run the script /opt/tpot/bin/tped.sh and choose log4j", I only see the script log4j and I lose all the other monitors in kibana.

How can I add log4f to the standard script?

Thanks.

[t3chn0m4g3]

You can of course create your own edition by modifying /opt/tpot/etc/tpot.yml to your specific use case. You find all available editions in /opt/tpot/etc/compose/.

[zarandija]

I will give it a try. Thanks for the reply.

[eschultze]

Hello, I tried to merge nextgen.yml and log4j.yml by running docker-compose -f nextgen.yml -f log4j.yml config into a new.yml but it didn't work. Also manually adding the log4j_local network and the whole segment of log4j into a new file went very badly as seen below.

Let me know if you pull it off @zarandija

[zarandija]

Hi
After 60 days of use, when I go to see the statistics with Kibana,https://1.2.3.4:64297/kibana/app/home#/
It shows me the "Welcome Home" page and in the T-Pot Dashboard, all without data and only indicates.
"1 of 48 shards failed
The data you are seeing might be incomplete or wrong."
can it be solved?

Thnks

[t3chn0m4g3]

That usually means that at some point there was an unclean shutdown of the machine and at least one of the daily indices broke at that point. You can open the KIbana => Stack Management => Index Management and look for the ones which are red. The quickest solution is usually to delete them.

[zarandija]

Hi t3chn0m4g3

It is working again. Really it was that the hard disk was full, sorry, 200GB is valid for 40 days in my case.

Regards.

[t3chn0m4g3]

Awesome! With the next major release I will be introducing the Index Lifecycle Management and as such, the retention policy is directly attached to the daily index with possible changes right from within Kibana.

This should make it a lot easier in the future to adjust for personal needs.

[thomaspatzke]

Log4Pot got a lot of updates in the last weeks. I've also renamed log4pot.py to log4pot-server.py to resolve a naming collision issue with the Python module.

[t3chn0m4g3]

Great, wasn't able to build it and will update it.

[t3chn0m4g3]

Just deployed Log4Pot based on the latest master. Changes are looking very good!
Thank you @thomaspatzke and community 😃