Detecting SSH Honeypots with non-persistent filesystems.

A lot has been written on the topic of detecting SSH honeypots in the past, usually using their canned responses against them, SSH protocol quirks, them accepting every password, etc. While experimenting with honeypots based on Docker and suchlike, which spin up a new container for each attacker that logs in, which can be a …

AliumTerm: Reverse Shells over Tor, Part 2. The PTY.

In this post, we will upgrade our listener to give us a PTY, and write a simple enough python implant to send us back our shells. We will also discuss the problem of adding dependencies to our script, and I’ll show the absolutely hideous solution I came up with. A reasonably short entry, as spawning …

Basic Programming: File Uploads using Python-Requests

So uploading files is something I figured I should cover first, before discussing the “streaming files” stuff later. In the requests library, there is a pretty simple way to manage uploading files. I’ll cover some examples here, which are probably the ways I end up doing it most often. In all of these examples, we …

AliumTerm: Reverse Shells over Tor, Part 1. Basics.

Before I begin, this project (which will unfold over a few blog posts) probably has no real application to “authorized intrusion activities” (red teaming, penetration testing, etc), and its release has largely been motivated by a desire to show how various problems were identified and overcome along the way. Kind of a “showing the work”. …