Install Questions

[n2x4]

Looking to test GreedyBear on my Tpot honeypots and I have a few questions that aren't clear to me from the docs.

• Is there any additional configuration required beyond filling out the env_file?
• For the Elastic Endpoint, does this just point to the honeypot IP:64297/es/ ?
• Is there an elastic API setup requirement or some sort of credential setup I'm not seeing?

Thanks!

[Scarcyon]

hi! I'm having the same issue. Did you end up finding the solution for it?

[n2x4]

Nope, never figured it out. I ended up just using the native scripts in TPOT that (from what I can tell) do basically the same thing. If you haven't found it, in /opt/tpot/bin is a mytopips.sh script. This script queries TPOT's Elasticsearch and pulls the top IPs. you can customize this with your own Elasticsearch query and pull whatever you want out of it. I'm grabbing the top 15k IPs to text file. I then have another script that cleans up the file (gotta remove my TPOT IP and my IP that I interface with TPOT from) and then uploads to a webserver.

[mlodic]

Sorry for the late response. I figured I missed out the first post.

GreedyBear works correctly. I suggest you to check out the documentation here: https://greedybear.readthedocs.io/en/latest/Installation.html

You just need to have a TPOT installed and reachable. Then use <honeypot_ip>:9200 as ELASTIC_ENDPOINT. That's all.

[Scarcyon]

Hi! I tried it just as simple as you said, it didn't work. Then I started tweaking it and now I'm at this point where the connection to the honeypot fails due to untrusted certificates (understandibly so). So I wonder how does it work for you just by using the <honeypot_ip>:9200 and not having to configure any certificates. Have you never come accross this issue?

Another thing that I find weird is that if I want to access the elastic endpoint, I have to authenticate myself. So I'm guessing that I also have to configure the credentials somewhere in order for greedybear to authenticate itself when contacting the honeypot aswell, no?

[mlodic]

thanks for the details.

I think I have take as an assumption that the ElasticSearch API access would be freely accessible from the GB instance, without authentication. So,

Hi! I tried it just as simple as you said, it didn't work. Then I started tweaking it and now I'm at this point where the connection to the honeypot fails due to untrusted certificates (understandibly so). So I wonder how does it work for you just by using the <honeypot_ip>:9200 and not having to configure any certificates. Have you never come accross this issue?

there is no support right now for HTTPS based connections to the Elastic APIs. It is an issue that can be solved fast though. But by default, in TPOTs, Elastic APIs are not protected by HTTPS

Another thing that I find weird is that if I want to access the elastic endpoint, I have to authenticate myself. So I'm guessing that I also have to configure the credentials somewhere in order for greedybear to authenticate itself when contacting the honeypot aswell, no?

When you mean "access the elastic endpoint" what are you accessing exactly? the GUI? cause one thing is the GUI (Kibana) and another is the ElasticSearch API endpoint that should be accessible from localhost to the port 64298 freely.

So I guess right now, you have 2 options:

• install GB inside the same TPOT instance and have ELASTIC_ENDPOINT parameter pointed to either localhost:64298 or whichever port your TPOT instance uses for Elastic APIs.
• install GB in a separated host. Modify docker-compose to open the Elastic API port externally and exclusively for the GB host. Have GB use <tpot_ip>:64298 to connect to it.

[Scarcyon]

Thank you in advance for the help mlodic.

I'm sorry but I'm getting a bit confused here. I'm gonna try to break it down.

So let's assume I want to install GB in a separated host. Let's also assume I don't care about HTTPS protection for now. Should I configure ELASTIC_ENDPOINT with <tpot_ip>:64298 or <tpot_ip>:9200? Also, should I add the HTTP prefix like, http://<tpot_ip>:9200?

Unfortunately I don't have access to my T-POT and GB instances right now so I'm speaking from memory in this next sentence. I analyzed the traffic with wireshark between T-POT and GB when I configured ELASTIC_ENDPOINT in all the possibilities I asked above (<tpot_ip>:64298, <tpot_ip>:9200 and http://<tpot_ip>:9200) and whenever GB contacted T-POT, there was never a proper query being done. GB would just send a GET request without anything else. That's why it's been so hard for me to know what to configure as ELASTIC_ENDPOINT, because no matter what I configure, GB just doesn't do any kind of elasticsearch query. I might be configuring the ELASTIC_ENDPOINT correctly but I wouldn't know because I never see a proper query being done or a reply with the IPs of the T-POT attackers.

[mlodic]

About the port: it depends on which port is used by the Elastic Container to expose the ElasticSearch APIs. I noticed that while normally ElasticSearch is exposed to the port 9200 by default, in the TPOT it's not the default case. The default should be 64298 but that could change based on your installation. The prefix (protocol) is required, yes.

Before trying to see if GB is working or not, you should understand where your ElasticSearch APIs are.

Just use curl : curl <elasticsearch_ip>:<elastic_port> until you get the default response from ElasticSearch APIs. You need to get a JSON as an answer with "tagline" : "You Know, for Search" inside it. Once you get it, that is the URL you need to insert in the ELASTIC_ENDPOINT variable

[Scarcyon]

I didn't use curl but I just used the browser and that's the reply I got. Also when I analyzed the communication between GB and T-POT with Wireshark, that's also what I saw as a reply ("tagline" : "You Know, for Search"). So now I know what to insert in the ELASTIC_ENDPOINT variable but the GB instance does nothing else other than making that empty request every 10 minutes.

Edit: btw, for the sake of this thread, I'm running t-pot and GB with all the default configurations I can.