honeynet/conpot

Conpot

![Build Status]([] ![Code Health]([] ![Python Version]([] ![PyPI version]([] ![Docs]([] ![Coverage Status]([]

镜像概述

Conpot是一款ICS（工业控制系统）/SCADA（监控与数据采集系统）蜜罐，旨在收集针对工业控制系统的***者的动机与方法情报。

核心功能

• 模拟多种工业控制协议服务（如Modbus、S7Comm、HTTP、SNMP等）
• 收集者的行为数据与模式
• 支持自定义模板配置，灵活模拟不同工业场景
• 提供详细的日志输出，便于分析***行为

使用场景

• 工业控制系统安全研究与威胁情报收集
• 企业内部工业网络的安全测试与防护能力验证
• 安全团队对工业控制领域***手法的学习与分析

配置说明

Conpot支持通过模板进行配置，默认模板可模拟常见的工业控制服务。用户可根据需求修改模板文件，调整服务端口、模拟设备参数等。

Docker部署示例

通过预构建镜像部署

1. 安装Docker
2. 拉取镜像：docker pull honeynet/conpot
3. 运行容器：docker run -it -p 80:80 -p 102:102 -p 502:502 -p 161:161/udp --network=bridge honeynet/conpot:latest /bin/sh
4. 启动Conpot：conpot -f --template default
5. 访问http://你的IP地址确认部署成功

从源码构建镜像部署

1. 安装Docker
2. 克隆仓库：git clone https://github.com/mushorg/conpot.git && cd conpot/docker
3. 构建镜像：docker build -t conpot .
4. 运行容器：docker run -it -p 80:8800 -p 102:10201 -p 502:5020 -p 161:16100/udp -p 47808:47808/udp -p 623:6230/udp -p 21:2121 -p 69:6969/udp -p 44818:44818 --network=bridge conpot
5. 访问http://你的IP地址确认部署成功

使用docker-compose部署

1. 安装docker-compose
2. 克隆仓库：git clone https://github.com/mushorg/conpot.git && cd conpot/docker
3. 构建镜像：docker-compose build
4. 测试运行：docker-compose up
5. 后台运行：docker-compose up -d

示例输出

# conpot --template default  
                         _                                                                                                    
     ___ ___ ___ ___ ___| |_                                                                                                
    |  _| . |   | . | . |  _|                                                                                               
    |___|___|_|_|  _|___|_|                                                                                                 
                |_|                                                                                                         
                                                                                                                          
    Version 0.6.0                                                                                                           
    MushMush Foundation                                                                                                     

    2018-08-09 19:13:15,085 Initializing Virtual File System at ConpotTempFS/__conpot__ootc_k3j. Source specified : tar://conpot-0.6.0-py3.6/conpot/data.tar
    2018-08-09 19:13:15,100 Please wait while the system copies all specified files
    2018-08-09 19:13:15,172 Fetched x.x.x.x as external ip.
    2018-08-09 19:13:15,175 Found and enabled ('modbus', <conpot.protocols.modbus.modbus_server.ModbusServer object at 0x7f1af52231d0>) protocol.
    2018-08-09 19:13:15,177 Found and enabled ('s7comm', <conpot.protocols.s7comm.s7_server.S7Server object at 0x7f1af5ad1f60>) protocol.
    2018-08-09 19:13:15,178 Found and enabled ('http', <conpot.protocols.http.web_server.HTTPServer object at 0x7f1af4fc2630>) protocol.
    2018-08-09 19:13:15,179 Found and enabled ('snmp', <conpot.protocols.snmp.snmp_server.SNMPServer object at 0x7f1af4fc2710>) protocol.
    2018-08-09 19:13:15,181 Found and enabled ('bacnet', <conpot.protocols.bacnet.bacnet_server.BacnetServer object at 0x7f1af4fc22e8>) protocol.
    2018-08-09 19:13:15,182 Found and enabled ('ipmi', <conpot.protocols.ipmi.ipmi_server.IpmiServer object at 0x7f1af5aaa1d0>) protocol.
    2018-08-09 19:13:15,185 Found and enabled ('enip', <conpot.protocols.enip.enip_server.EnipServer object at 0x7f1af5aaa0f0>) protocol.
    2018-08-09 19:13:15,199 Found and enabled ('ftp', <conpot.protocols.ftp.ftp_server.FTPServer object at 0x7f1af4fcec18>) protocol.
    2018-08-09 19:13:15,206 Found and enabled ('tftp', <conpot.protocols.tftp.tftp_server.TftpServer object at 0x7f1af4fcef28>) protocol.
    2018-08-09 19:13:15,206 No proxy template found. Service will remain unconfigured/stopped.                                
    2018-08-09 19:13:15,206 Modbus server started on: ('0.0.0.0', 5020)                                                       
    2018-08-09 19:13:15,206 S7Comm server started on: ('0.0.0.0', ***)                                                      
    2018-08-09 19:13:15,207 HTTP server started on: ('0.0.0.0', 8800)                                                         
    2018-08-09 19:13:15,402 SNMP server started on: ('0.0.0.0', ***)                                                        
    2018-08-09 19:13:15,403 Bacnet server started on: ('0.0.0.0', 47808)                                                      
    2018-08-09 19:13:15,403 IPMI server started on: ('0.0.0.0', 6230)                                                         
    2018-08-09 19:13:15,403 handle server PID [23183] running on ('0.0.0.0', 44818)                                           
    2018-08-09 19:13:15,404 handle server PID [23183] responding to external done/disable signal in object 139753672309064
    2018-08-09 19:13:15,404 FTP server started on: ('0.0.0.0', 2121)                                                          
    2018-08-09 19:13:15,404 Starting TFTP server at ('0.0.0.0', 6969)