axitvn
05-11-2008, 00:30
Có bác nào biết về Honeyd không cho em hỏi 1 tí:
Chả là em đang nghịch ngợm thằng honeyd này để làm honeypots, làm theo hướng dẫn trong sách "Honeypots for windows" đến bước test thì nó báo lỗi mà sách ko đề cập tới:
File honeyd.config thế này:
CREATE Exchange Server 2003
ANNOTATE "Microsoft Windows.NET Enterprise Server (build 3615 beta)"
SET Exchange Server 2003 PERSONALITY "Microsoft Windows.NET Enterprise Server (build 3615 beta)"
BIND 10.0.0.1 Exchange Server 2003
SET DEFAULT Exchange Server 2003 TCP ACTION RESET
SET DEFAULT Exchange Server 2003 UDP ACTION RESET
SET DEFAULT Exchange Server 2003 ICMP ACTION RESET
ADD Exchange Server 2003 UDP PORT 135 BLOCK
ADD Exchange Server 2003 UDP PORT 137 BLOCK
ADD Exchange Server 2003 UDP PORT 138 BLOCK
ADD Exchange Server 2003 UDP PORT 389 BLOCK
ADD Exchange Server 2003 UDP PORT 445 BLOCK
ADD Exchange Server 2003 UDP PORT 500 OPEN
ADD Exchange Server 2003 UDP PORT 4500 OPEN
ADD Exchange Server 2003 TCP PORT 25 "sh c:\Honeyd\scripts\smtp.sh"
ADD Exchange Server 2003 TCP PORT 80 OPEN
ADD Exchange Server 2003 TCP PORT 88 OPEN
ADD Exchange Server 2003 TCP PORT 110 "sh c:\Honeyd\scripts\pop3.sh"
ADD Exchange Server 2003 TCP PORT 135 BLOCK
ADD Exchange Server 2003 TCP PORT 137 BLOCK
ADD Exchange Server 2003 TCP PORT 139 BLOCK
ADD Exchange Server 2003 TCP PORT 593 OPEN
ADD Exchange Server 2003 TCP PORT 1063 OPEN
ADD Exchange Server 2003 TCP PORT 1071 OPEN
ADD Exchange Server 2003 TCP PORT 1073 OPEN
ADD Exchange Server 2003 TCP PORT 593 OPEN
ADD Exchange Server 2003 TCP PORT 3389 OPEN
SET Exchange Server 2003 UPTIME 2248020
SET Exchange Server 2003 DROPRATE IN 0.005
SET Exchange Server 2003 UID 20208 GID 13876
Khi em gõ lệnh:
honeyd.exe -d -p nmap.prints -a NMAP.ASSOC -f c:\honeyd\honeyd.config -i 2 -l c:\honeyd\log\honeyd.log 10.0.0.0/8
Thì nó báo lỗi:
honeyd.config:1: parse error
parsing configuration file failed
Ai biết chỉ dùm em cách sửa với.
Chả là em đang nghịch ngợm thằng honeyd này để làm honeypots, làm theo hướng dẫn trong sách "Honeypots for windows" đến bước test thì nó báo lỗi mà sách ko đề cập tới:
File honeyd.config thế này:
CREATE Exchange Server 2003
ANNOTATE "Microsoft Windows.NET Enterprise Server (build 3615 beta)"
SET Exchange Server 2003 PERSONALITY "Microsoft Windows.NET Enterprise Server (build 3615 beta)"
BIND 10.0.0.1 Exchange Server 2003
SET DEFAULT Exchange Server 2003 TCP ACTION RESET
SET DEFAULT Exchange Server 2003 UDP ACTION RESET
SET DEFAULT Exchange Server 2003 ICMP ACTION RESET
ADD Exchange Server 2003 UDP PORT 135 BLOCK
ADD Exchange Server 2003 UDP PORT 137 BLOCK
ADD Exchange Server 2003 UDP PORT 138 BLOCK
ADD Exchange Server 2003 UDP PORT 389 BLOCK
ADD Exchange Server 2003 UDP PORT 445 BLOCK
ADD Exchange Server 2003 UDP PORT 500 OPEN
ADD Exchange Server 2003 UDP PORT 4500 OPEN
ADD Exchange Server 2003 TCP PORT 25 "sh c:\Honeyd\scripts\smtp.sh"
ADD Exchange Server 2003 TCP PORT 80 OPEN
ADD Exchange Server 2003 TCP PORT 88 OPEN
ADD Exchange Server 2003 TCP PORT 110 "sh c:\Honeyd\scripts\pop3.sh"
ADD Exchange Server 2003 TCP PORT 135 BLOCK
ADD Exchange Server 2003 TCP PORT 137 BLOCK
ADD Exchange Server 2003 TCP PORT 139 BLOCK
ADD Exchange Server 2003 TCP PORT 593 OPEN
ADD Exchange Server 2003 TCP PORT 1063 OPEN
ADD Exchange Server 2003 TCP PORT 1071 OPEN
ADD Exchange Server 2003 TCP PORT 1073 OPEN
ADD Exchange Server 2003 TCP PORT 593 OPEN
ADD Exchange Server 2003 TCP PORT 3389 OPEN
SET Exchange Server 2003 UPTIME 2248020
SET Exchange Server 2003 DROPRATE IN 0.005
SET Exchange Server 2003 UID 20208 GID 13876
Khi em gõ lệnh:
honeyd.exe -d -p nmap.prints -a NMAP.ASSOC -f c:\honeyd\honeyd.config -i 2 -l c:\honeyd\log\honeyd.log 10.0.0.0/8
Thì nó báo lỗi:
honeyd.config:1: parse error
parsing configuration file failed
Ai biết chỉ dùm em cách sửa với.