本文共 1615 字，大约阅读时间需要 5 分钟。
Honeyd服务（23端口防御）
环境准备
1、Honeyd系统RHEL6.4 IP 10.10.10.135
2、攻击系统windows 2008R2 IP 10.10.10.134
步骤
1、23端口防御脚本
[root@MIGUANG scripts]# cat hello.sh
#!/bin/sh
echo "hello you!"
while read data
do
echo "$data"
Done
2、honeyd 23端口配置文件
[root@MIGUANG scripts]# cat /etc/test.config
create default
set default default tcp action block
set default default udp action block
set default default icmp action block
create linux
set linux ethernet "dell"
set linux default tcp action reset
add linux tcp port 23 "/usr/local/share/honeyd/scripts/hello.sh"
dhcp linux on eth0
3、运行honeyd服务，分配虚拟DHCP IP地址为10.10.10.139
[root@MIGUANG ~]# honeyd -d -f /etc/test.config
Honeyd V1.5c Copyright (c) 2002-2007 Niels Provos
honeyd[2611]: started with -d -f /etc/test.config
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
honeyd[2611]: listening promiscuously on eth0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip )) and not ether src 00:0c:29:0b:cf:2a
honeyd[2611]: [eth0] trying DHCP
honeyd[2611]: Demoting process privileges to uid 99, gid 99
honeyd[2611]: [eth0] got DHCP offer: 10.10.10.139
honeyd[2611]: Updating ARP binding: 00:c0:4f:e6:40:30 -> 10.10.10.139
honeyd[2611]: arp reply 10.10.10.139 is-at 00:c0:4f:e6:40:30
honeyd[2611]: Sending ICMP Echo Reply: 10.10.10.139 -> 10.10.10.254
honeyd[2611]: arp_send: who-has 10.10.10.254 tell 10.10.10.139
honeyd[2611]: arp_recv_cb: 10.10.10.254 at 00:50:56:e3:b7:b0
4、使用windows2008R2攻击系统远程链接防御系统服务器
使用telnet链接10.10.10.139
这时链接后进入防御措施执行了服务器上的脚本如下图
5、攻击系统执行的命令全部被反弹回去
