Assignment set up a honeypot virtual machine: Download the T-Pot ISO file called tpot_amd64.iso (reference link below). Then, create a new VM with at least 20GB of storage in your local Virtual Box...

Assignment set up a honeypot virtual machine:

Installation:



https://github.security.telekom.com/2015/03/honeypot-tpot-concept.html#installation

1. 
   

   
   
   
   Use a NAT adapter during the installation. When finished, change it
   
   to Internal. Configure the Virtual Box adapter and the network
   
   interface in T-Pot so that you can communicate from your Kali Linux
   
   VM. Show that a ping works both ways.

   
   
   
   

2. 
   

   
   
   
   Open the browser in Kali and access the web administration dashboard
   
   in https://IP_T-POT:64294. Once you login with
   tsec,
   
   capture a screenshot of the overview.

   
   
   
   

3. 
   

   
   
   
   Access by SSH is restricted to only exchanged keys. Hence, the next
   
   step is to copy your Kali’s public key into the file
   
   ~/.ssh/authorized_keys
   (in
   
   tsec’s home), which does not
   
   exist by default. To do it, you can use the “Terminal” option in
   
   the administration dashboard or allow copying and pasting through
   
   VMs in Virtual Box. Capture a screenshot of the command “cat
   
   ~/.ssh/authorized_keys”.

   
   
   
   

4. 
   

   
   
   
   In Kali, execute the command below (adapted to your settings) to
   
   create a tunnel, because the T-Pot dashboard is only listening
   
   locally.

   
   
   
   

ssh -p 64295 -l USER -N
-L8080:127.0.0.1:64297 IP_T-POT

Then, access the dashboard from Kali with https://localhost:8080 and
capture a screenshot.

Note: the ssh tunnel might drop eventually, so just create it again
if needed.

5. 
   

   
   
   
   Check that the attack map is empty and capture a screenshot.

   
   
   
   

6. 
   

   
   
   
   Perform a brute-force attack with nmap against the port 22, where
   
   the SSH honeypot is. You will need to use the scripting engine
   
   (NSE). What command did you use?

   
   
   
   

Note: there are wordlists you can use in

/usr/share/wordlists/metasploit.

7. 
   

   
   
   
   Check the SecurityMeter. Explain what information is shown.

   
   
   
   

8. 
   

   
   
   
   If you intended to use T-Pot for research purposes capturing
   
   information about new trends, what your advice would be regarding
   
   where to install the machine, what IP address to use and whether a
   
   firewall should be placed before the honeypots?

   
   
   
   

My email: [email protected]