dvash 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. data/LICENSE +674 -0
  2. data/bin/dvash +0 -2
  3. data/dvash.gemspec +12 -23
  4. data/lib/dvash.rb +12 -21
  5. data/lib/dvash/application.rb +32 -49
  6. data/lib/dvash/core.rb +96 -116
  7. data/lib/dvash/honeyports/ipv4/http.rb +26 -37
  8. data/lib/dvash/honeyports/ipv4/rdp.rb +26 -37
  9. data/lib/dvash/honeyports/ipv4/ssh.rb +26 -37
  10. data/lib/dvash/honeyports/ipv4/telnet.rb +26 -37
  11. data/lib/dvash/honeyports/ipv6/http.rb +26 -37
  12. data/lib/dvash/honeyports/ipv6/rdp.rb +26 -37
  13. data/lib/dvash/honeyports/ipv6/ssh.rb +26 -37
  14. data/lib/dvash/os/linux.rb +42 -64
  15. data/lib/dvash/os/mac.rb +24 -28
  16. data/lib/dvash/os/windows.rb +23 -24
  17. metadata +5 -21
  18. data/etc/dvash-baseline.conf +0 -48
data/lib/dvash/honeyports/ipv4/rdp.rb CHANGED
@@ -9,43 +9,32 @@
9
9
  #
10
10
  ###############################################################################
11
11
  module Dvash
12
+ #
13
+ # Main Honeyport class to simulate daemons
14
+ #
15
+ class Honeyport < Core
12
16
 
13
- class Honeyport < Core
17
+ def ipv4_rdp
18
+ # IPv4 TCPServer object
19
+ # @return [TCPServer] tcp/3389 RDPd
20
+ server = TCPServer.new(3389)
21
+ # Infinite listening loop
22
+ loop do
23
+ # Fork a new instance of [TCPServer] when a client connects
24
+ Thread.fork(server.accept) do |client|
25
+ # Make sure the client has a valid IP address
26
+ # @return [Boolean] true|false
27
+ if valid_ip?(client_ip(client)) then
28
+ # Send the connected client junk data
29
+ client.puts(random_data)
30
+ # Block the IP address
31
+ @@os.block_ip(client_ip(client))
32
+ end
33
+ # Close the connection to the client and kill the forked process
34
+ client.close
35
+ end
36
+ end
37
+ end
14
38
 
15
- def ipv4_rdp
16
- #
17
- # Create a new IPv4 TCPServer object
18
- #
19
- server = TCPServer.new(3389)
20
- #
21
- # Infinite loop listens on port 3389 pretending to be an RDP server
22
- #
23
- loop do
24
- #
25
- # Fork a new instance of the TCPServer object when a client connects
26
- # TODO: Maybe we should not send junk data until after the client IP has been validated
27
- #
28
- Thread.fork(server.accept) do |client|
29
- #
30
- # Send the connected client junk data
31
- #
32
- client.puts(random_data)
33
- #
34
- # Make sure the client has a valid IP address
35
- #
36
- if valid_ip?(client_ip(client)) then
37
- #
38
- # Block the IP address
39
- #
40
- @@os.block_ip(client_ip(client))
41
- end
42
- #
43
- # Close the connection to the client and kill the forked process
44
- #
45
- client.close
46
- end
47
- end
48
- end
49
-
50
- end
39
+ end
51
40
  end
data/lib/dvash/honeyports/ipv4/ssh.rb CHANGED
@@ -9,43 +9,32 @@
9
9
  #
10
10
  ###############################################################################
11
11
  module Dvash
12
+ #
13
+ # Main Honeyport class to simulate daemons
14
+ #
15
+ class Honeyport < Core
12
16
 
13
- class Honeyport < Core
17
+ def ipv4_ssh
18
+ # IPv4 TCPServer object
19
+ # @return [TCPServer] tcp/22 SSHd
20
+ server = TCPServer.new(22)
21
+ # Infinite listening loop
22
+ loop do
23
+ # Fork a new instance of [TCPServer] when a client connects
24
+ Thread.fork(server.accept) do |client|
25
+ # Make sure the client has a valid IP address
26
+ # @return [Boolean] true|false
27
+ if valid_ip?(client_ip(client)) then
28
+ # Send the connected client junk data
29
+ client.puts(random_data)
30
+ # Block the IP address
31
+ @@os.block_ip(client_ip(client))
32
+ end
33
+ # Close the connection to the client and kill the forked process
34
+ client.close
35
+ end
36
+ end
37
+ end
14
38
 
15
- def ipv4_ssh
16
- #
17
- # Create a new IPv4 TCPServer object
18
- #
19
- server = TCPServer.new(22)
20
- #
21
- # Infinite loop listens on port 22 pretending to be an SSH server
22
- #
23
- loop do
24
- #
25
- # Fork a new instance of the TCPServer object when a client connects
26
- # TODO: Maybe we should not send junk data until after the client IP has been validated
27
- #
28
- Thread.fork(server.accept) do |client|
29
- #
30
- # Send the connected client junk data
31
- #
32
- client.puts(random_data)
33
- #
34
- # Make sure the client has a valid IP address
35
- #
36
- if valid_ip?(client_ip(client)) then
37
- #
38
- # Block the IP address
39
- #
40
- @@os.block_ip(client_ip(client))
41
- end
42
- #
43
- # Close the connection to the client and kill the forked process
44
- #
45
- client.close
46
- end
47
- end
48
- end
49
-
50
- end
39
+ end
51
40
  end
data/lib/dvash/honeyports/ipv4/telnet.rb CHANGED
@@ -9,43 +9,32 @@
9
9
  #
10
10
  ###############################################################################
11
11
  module Dvash
12
+ #
13
+ # Main Honeyport class to simulate daemons
14
+ #
15
+ class Honeyport < Core
12
16
 
13
- class Honeyport < Core
17
+ def ipv4_telnet
18
+ # IPv4 TCPServer object
19
+ # @return [TCPServer] tcp/23 Telnetd
20
+ server = TCPServer.new(23)
21
+ # Infinite listening loop
22
+ loop do
23
+ # Fork a new instance of [TCPServer] when a client connects
24
+ Thread.fork(server.accept) do |client|
25
+ # Make sure the client has a valid IP address
26
+ # @return [Boolean] true|false
27
+ if valid_ip?(client_ip(client)) then
28
+ # Send the connected client junk data
29
+ client.puts(random_data)
30
+ # Block the IP address
31
+ @@os.block_ip(client_ip(client))
32
+ end
33
+ # Close the connection to the client and kill the forked process
34
+ client.close
35
+ end
36
+ end
37
+ end
14
38
 
15
- def ipv4_telnet
16
- #
17
- # Create a new IPv4 TCPServer object
18
- #
19
- server = TCPServer.new(23)
20
- #
21
- # Infinite loop listens on port 23 pretending to be an Telnet server
22
- #
23
- loop do
24
- #
25
- # Fork a new instance of the TCPServer object when a client connects
26
- # TODO: Maybe we should not send junk data until after the client IP has been validated
27
- #
28
- Thread.fork(server.accept) do |client|
29
- #
30
- # Send the connected client junk data
31
- #
32
- client.puts(random_data)
33
- #
34
- # Make sure the client has a valid IP address
35
- #
36
- if valid_ip?(client_ip(client)) then
37
- #
38
- # Block the IP address
39
- #
40
- @@os.block_ip(client_ip(client))
41
- end
42
- #
43
- # Close the connection to the client and kill the forked process
44
- #
45
- client.close
46
- end
47
- end
48
- end
49
-
50
- end
39
+ end
51
40
  end
data/lib/dvash/honeyports/ipv6/http.rb CHANGED
@@ -9,43 +9,32 @@
9
9
  #
10
10
  ###############################################################################
11
11
  module Dvash
12
+ #
13
+ # Main Honeyport class to simulate daemons
14
+ #
15
+ class Honeyport < Core
12
16
 
13
- class Honeyport < Core
17
+ def ipv6_http
18
+ # IPv6 TCPServer object
19
+ # @return [TCPServer] tcp/80 HTTPd
20
+ server = TCPServer.new('::', 80)
21
+ # Infinite listening loop
22
+ loop do
23
+ # Fork a new instance of [TCPServer] when a client connects
24
+ Thread.fork(server.accept) do |client|
25
+ # Make sure the client has a valid IP address
26
+ # @return [Boolean] true|false
27
+ if valid_ip?(client_ip(client)) then
28
+ # Send the connected client junk data
29
+ client.puts(random_data)
30
+ # Block the IP address
31
+ @@os.block_ip(client_ip(client))
32
+ end
33
+ # Close the connection to the client and kill the forked process
34
+ client.close
35
+ end
36
+ end
37
+ end
14
38
 
15
- def ipv6_http
16
- #
17
- # Create a new IPv6 TCPServer object
18
- #
19
- server = TCPServer.new('::', 80)
20
- #
21
- # Infinite loop listens on port 80 pretending to be an HTTP server
22
- #
23
- loop do
24
- #
25
- # Fork a new instance of the TCPServer object when a client connects
26
- # TODO: Maybe we should not send junk data until after the client IP has been validated
27
- #
28
- Thread.fork(server.accept) do |client|
29
- #
30
- # Send the connected client junk data
31
- #
32
- client.puts(random_data)
33
- #
34
- # Make sure the client has a valid IP address
35
- #
36
- if valid_ip?(client_ip(client)) then
37
- #
38
- # Block the IP address
39
- #
40
- @@os.block_ip(client_ip(client))
41
- end
42
- #
43
- # Close the connection to the client and kill the forked process
44
- #
45
- client.close
46
- end
47
- end
48
- end
49
-
50
- end
39
+ end
51
40
  end
data/lib/dvash/honeyports/ipv6/rdp.rb CHANGED
@@ -9,43 +9,32 @@
9
9
  #
10
10
  ###############################################################################
11
11
  module Dvash
12
+ #
13
+ # Main Honeyport class to simulate daemons
14
+ #
15
+ class Honeyport < Core
12
16
 
13
- class Honeyport < Core
17
+ def ipv6_rdp
18
+ # IPv6 TCPServer object
19
+ # @return [TCPServer] tcp/3389 RDPd
20
+ server = TCPServer.new('::', 3389)
21
+ # Infinite listening loop
22
+ loop do
23
+ # Fork a new instance of [TCPServer] when a client connects
24
+ Thread.fork(server.accept) do |client|
25
+ # Make sure the client has a valid IP address
26
+ # @return [Boolean] true|false
27
+ if valid_ip?(client_ip(client)) then
28
+ # Send the connected client junk data
29
+ client.puts(random_data)
30
+ # Block the IP address
31
+ @@os.block_ip(client_ip(client))
32
+ end
33
+ # Close the connection to the client and kill the forked process
34
+ client.close
35
+ end
36
+ end
37
+ end
14
38
 
15
- def ipv6_rdp
16
- #
17
- # Create a new IPv6 TCPServer object
18
- #
19
- server = TCPServer.new('::', 3389)
20
- #
21
- # Infinite loop listens on port 3389 pretending to be an RDP server
22
- #
23
- loop do
24
- #
25
- # Fork a new instance of the TCPServer object when a client connects
26
- # TODO: Maybe we should not send junk data until after the client IP has been validated
27
- #
28
- Thread.fork(server.accept) do |client|
29
- #
30
- # Send the connected client junk data
31
- #
32
- client.puts(random_data)
33
- #
34
- # Make sure the client has a valid IP address
35
- #
36
- if valid_ip?(client_ip(client)) then
37
- #
38
- # Block the IP address
39
- #
40
- @@os.block_ip(client_ip(client))
41
- end
42
- #
43
- # Close the connection to the client and kill the forked process
44
- #
45
- client.close
46
- end
47
- end
48
- end
49
-
50
- end
39
+ end
51
40
  end
data/lib/dvash/honeyports/ipv6/ssh.rb CHANGED
@@ -9,43 +9,32 @@
9
9
  #
10
10
  ###############################################################################
11
11
  module Dvash
12
+ #
13
+ # Main Honeyport class to simulate daemons
14
+ #
15
+ class Honeyport < Core
12
16
 
13
- class Honeyport < Core
17
+ def ipv6_ssh
18
+ # IPv6 TCPServer object
19
+ # @return [TCPServer] tcp/22 SSHd
20
+ server = TCPServer.new('::', 22)
21
+ # Infinite listening loop
22
+ loop do
23
+ # Fork a new instance of [TCPServer] when a client connects
24
+ Thread.fork(server.accept) do |client|
25
+ # Make sure the client has a valid IP address
26
+ # @return [Boolean] true|false
27
+ if valid_ip?(client_ip(client)) then
28
+ # Send the connected client junk data
29
+ client.puts(random_data)
30
+ # Block the IP address
31
+ @@os.block_ip(client_ip(client))
32
+ end
33
+ # Close the connection to the client and kill the forked process
34
+ client.close
35
+ end
36
+ end
37
+ end
14
38
 
15
- def ipv6_ssh
16
- #
17
- # Create a new IPv6 TCPServer object
18
- #
19
- server = TCPServer.new('::', 22)
20
- #
21
- # Infinite loop listens on port 22 pretending to be an SSH server
22
- #
23
- loop do
24
- #
25
- # Fork a new instance of the TCPServer object when a client connects
26
- # TODO: Maybe we should not send junk data until after the client IP has been validated
27
- #
28
- Thread.fork(server.accept) do |client|
29
- #
30
- # Send the connected client junk data
31
- #
32
- client.puts(random_data)
33
- #
34
- # Make sure the client has a valid IP address
35
- #
36
- if valid_ip?(client_ip(client)) then
37
- #
38
- # Block the IP address
39
- #
40
- @@os.block_ip(client_ip(client))
41
- end
42
- #
43
- # Close the connection to the client and kill the forked process
44
- #
45
- client.close
46
- end
47
- end
48
- end
49
-
50
- end
39
+ end
51
40
  end
data/lib/dvash/os/linux.rb CHANGED
@@ -1,70 +1,48 @@
1
1
  module Dvash
2
+ #
3
+ # Used by Linux systems to leverage IPTables for blocking all of the peoples
4
+ #
5
+ class Linux < Core
2
6
 
3
- class Linux < Core
7
+ def initialize
8
+ # Make sure we have binaries for iptables using the paths
9
+ # set in the configuration file
10
+ unless File.exist?(@@cfgfile['iptables']['ipv4'])
11
+ # TODO: Use [logger] gem to output debug information
12
+ puts "can't find iptables"
13
+ exit
14
+ end
15
+ # Do not create a new iptables chain if one already exists
16
+ unless `"#{@@cfgfile['iptables']['ipv4']}" -L INPUT`.include?('DVASH')
17
+ # Create a new DVASH chain
18
+ system("#{@@cfgfile['iptables']['ipv4']} -N DVASH")
19
+ # Flush the DVASH chain
20
+ system("#{@@cfgfile['iptables']['ipv4']} -F DVASH")
21
+ # Associate the DVASH chain to INPUT chain
22
+ system("#{@@cfgfile['iptables']['ipv4']} -I INPUT -j DVASH")
23
+ end
24
+ # Do not create a new ip6tables chain if one already exists
25
+ unless `"#{@@cfgfile['iptables']['ipv6']}" -L INPUT`.include?('DVASH')
26
+ # Create a new DVASH chain
27
+ system("#{@@cfgfile['iptables']['ipv6']} -N DVASH")
28
+ # Flush the DVASH chain
29
+ system("#{@@cfgfile['iptables']['ipv6']} -F DVASH")
30
+ # Associate the DVASH chain to INPUT chain
31
+ system("#{@@cfgfile['iptables']['ipv6']} -I INPUT -j DVASH")
32
+ end
33
+ end
4
34
 
5
- def initialize
6
- #
7
- # Check to make sure we have binaries for iptables using the paths
8
- # set in the configuration file
9
- #
10
- unless File.exist?(@@cfgfile['iptables']['ipv4'])
11
- # TODO: Use 'logger' gem to output debug information
12
- puts "can't find iptables"
13
- exit
14
- end
35
+ def block_ip(address)
36
+ # Block the client IP address using iptables binaries set in the conf file
37
+ if IPAddr.new("#{address}").ipv4? then
38
+ system("#{@@cfgfile['iptables']['ipv4']} -I DVASH -s #{address} -j DROP")
39
+ end
15
40
 
16
- #
17
- # Do not create a new iptables chain if one already exists
18
- #
19
- unless `"#{@@cfgfile['iptables']['ipv4']}" -L INPUT`.include?('DVASH')
20
- #
21
- # Create a new DVASH chain
22
- #
23
- system("#{@@cfgfile['iptables']['ipv4']} -N DVASH")
24
- #
25
- # Flush the DVASH chain
26
- #
27
- system("#{@@cfgfile['iptables']['ipv4']} -F DVASH")
28
- #
29
- # Associate the DVASH chain to INPUT chain
30
- #
31
- system("#{@@cfgfile['iptables']['ipv4']} -I INPUT -j DVASH")
32
- end
41
+ # Block the client IP address using ip6tables binaries set in the conf file
42
+ if IPAddr.new("#{address}").ipv6? then
43
+ system("#{@@cfgfile['iptables']['ipv6']} -I DVASH -s #{address} -j DROP")
44
+ end
45
+ end
33
46
 
34
- #
35
- # Do not create a new ip6tables chain if one already exists
36
- #
37
- unless `"#{@@cfgfile['iptables']['ipv6']}" -L INPUT`.include?('DVASH')
38
- #
39
- # Create a new DVASH chain
40
- #
41
- system("#{@@cfgfile['iptables']['ipv6']} -N DVASH")
42
- #
43
- # Flush the DVASH chain
44
- #
45
- system("#{@@cfgfile['iptables']['ipv6']} -F DVASH")
46
- #
47
- # Associate the DVASH chain to INPUT chain
48
- #
49
- system("#{@@cfgfile['iptables']['ipv6']} -I INPUT -j DVASH")
50
- end
51
- end
52
-
53
- def block_ip(address)
54
- #
55
- # Block the client IP address using iptables binaries set in the configuration file
56
- #
57
- if IPAddr.new("#{address}").ipv4? then
58
- system("#{@@cfgfile['iptables']['ipv4']} -I DVASH -s #{address} -j DROP")
59
- end
60
-
61
- #
62
- # Block the client IP address using ip6tables binaries set in the configuration file
63
- #
64
- if IPAddr.new("#{address}").ipv6? then
65
- system("#{@@cfgfile['iptables']['ipv6']} -I DVASH -s #{address} -j DROP")
66
- end
67
- end
68
-
69
- end
47
+ end
70
48
  end