63 lines
3.0 KiB
Bash
63 lines
3.0 KiB
Bash
|
#!/bin/bash
|
||
|
|
# Run on the designated Proxmox host. Preparation only; never execute payloads here.
|
||
|
|
set -euo pipefail
|
||
|
|
cd /var/lib/vz/honeypot
|
||
|
|
expected=$(awk '$2 == "debian-12-genericcloud-amd64.qcow2" {print $1}' SHA512SUMS)
|
||
|
|
[[ -n "$expected" ]]
|
||
|
|
printf '%s debian.qcow2\n' "$expected" | sha512sum --check -
|
||
|
|
[[ -s admin.pub ]]
|
||
|
|
command -v nc >/dev/null
|
||
|
|
printf '#!/bin/sh\nexec nc 127.0.0.1 19223\n' > forward-execution-ssh
|
||
|
|
printf '#!/bin/sh\nexec nc 127.0.0.1 19090\n' > forward-collector-telemetry
|
||
|
|
chmod 700 forward-execution-ssh forward-collector-telemetry
|
||
|
|
for vmid in 222 223; do
|
||
|
|
if qm config "$vmid" >/dev/null 2>&1; then
|
||
|
|
echo "VM $vmid exists; refusing replacement" >&2; exit 1
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
for vmid in 222 223; do
|
||
|
|
role=collector; mem=2048; port=19222; mac=52:54:00:22:02:22
|
||
|
|
packages='[python3, openssh-client, openssh-server, iptables, qemu-guest-agent]'
|
||
|
|
args="-netdev user,id=decoy,hostfwd=tcp:127.0.0.1:19443-:8443,hostfwd=tcp:127.0.0.1:19222-:22,hostfwd=tcp:127.0.0.1:19090-:19090,guestfwd=tcp:10.0.2.101:22-cmd:/var/lib/vz/honeypot/forward-execution-ssh -device virtio-net-pci,netdev=decoy,mac=$mac"
|
||
|
|
if [[ $vmid = 223 ]]; then
|
||
|
|
role=execution; mem=4096; port=19223; mac=52:54:00:22:02:23
|
||
|
|
packages='[python3, strace, curl, wget, netcat-openbsd, iptables, openssh-server, qemu-guest-agent]'
|
||
|
|
# Trusted package bootstrap only. restrict=on MUST replace this before payloads.
|
||
|
|
args="-netdev user,id=decoy,hostfwd=tcp:127.0.0.1:19223-:22,guestfwd=tcp:10.0.2.100:19090-cmd:/var/lib/vz/honeypot/forward-collector-telemetry -device virtio-net-pci,netdev=decoy,mac=$mac"
|
||
|
|
fi
|
||
|
|
mkdir -p "seed-$vmid" /var/lib/vz/template/iso
|
||
|
|
cat > "seed-$vmid/user-data" <<CLOUD
|
||
|
|
#cloud-config
|
||
|
|
hostname: decoy-$role
|
||
|
|
manage_etc_hosts: true
|
||
|
|
disable_root: false
|
||
|
|
ssh_pwauth: false
|
||
|
|
users:
|
||
|
|
- name: root
|
||
|
|
lock_passwd: true
|
||
|
|
ssh_authorized_keys:
|
||
|
|
- $(cat admin.pub)
|
||
|
|
package_update: true
|
||
|
|
packages: $packages
|
||
|
|
runcmd:
|
||
|
|
- [mkdir, -p, /opt/decoy, /netscaler/ns_gui, /nsconfig]
|
||
|
|
- [systemctl, enable, --now, qemu-guest-agent]
|
||
|
|
- [touch, /var/lib/decoy-bootstrap-complete]
|
||
|
|
CLOUD
|
||
|
|
if [[ $vmid = 223 ]]; then printf ' - [touch, /etc/decoy-disposable-guest]\n' >> "seed-$vmid/user-data"; fi
|
||
|
|
printf 'instance-id: decoy-%s-20260928\nlocal-hostname: decoy-%s\n' "$vmid" "$role" > "seed-$vmid/meta-data"
|
||
|
|
cat > "seed-$vmid/network-config" <<NET
|
||
|
|
version: 2
|
||
|
|
ethernets:
|
||
|
|
decoy:
|
||
|
|
match:
|
||
|
|
macaddress: "$mac"
|
||
|
|
dhcp4: true
|
||
|
|
NET
|
||
|
|
genisoimage -quiet -output "/var/lib/vz/template/iso/decoy-seed-$vmid.iso" -volid cidata -joliet -rock "seed-$vmid"
|
||
|
|
qm create "$vmid" --name "decoy-$role" --memory "$mem" --cores 2 --cpu host --ostype l26 --scsihw virtio-scsi-pci --agent enabled=1 --onboot 0 --serial0 socket --vga serial0 --args "$args" --description "Dedicated NetScaler honeypot $role; QEMU user networking only. VM223 restrict=on mandatory before attacker execution."
|
||
|
|
qm importdisk "$vmid" debian.qcow2 local-lvm >/dev/null
|
||
|
|
qm set "$vmid" --scsi0 "local-lvm:vm-$vmid-disk-0" --ide2 "local:iso/decoy-seed-$vmid.iso,media=cdrom" --boot order=scsi0
|
||
|
|
qm resize "$vmid" scsi0 12G
|
||
|
|
qm start "$vmid"
|
||
|
|
done
|