CitrixPot: NetScaler / Citrix ADC Gateway honeypot (initial public release)

2026-09-28 19:44:37 +02:00
commit 4491b42714
@@ -0,0 +1,63 @@
+#!/bin/bash
+# Run on the designated Proxmox host. Preparation only; never execute payloads here.
+set -euo pipefail
+cd /var/lib/vz/honeypot
+expected=$(awk '$2 == "debian-12-genericcloud-amd64.qcow2" {print $1}' SHA512SUMS)
+[[ -n "$expected" ]]
+printf '%s  debian.qcow2\n' "$expected" | sha512sum --check -
+[[ -s admin.pub ]]
+command -v nc >/dev/null
+printf '#!/bin/sh\nexec nc 127.0.0.1 19223\n' > forward-execution-ssh
+printf '#!/bin/sh\nexec nc 127.0.0.1 19090\n' > forward-collector-telemetry
+chmod 700 forward-execution-ssh forward-collector-telemetry
+for vmid in 222 223; do
+  if qm config "$vmid" >/dev/null 2>&1; then
+    echo "VM $vmid exists; refusing replacement" >&2; exit 1
+  fi
+done
+for vmid in 222 223; do
+  role=collector; mem=2048; port=19222; mac=52:54:00:22:02:22
+  packages='[python3, openssh-client, openssh-server, iptables, qemu-guest-agent]'
+  args="-netdev user,id=decoy,hostfwd=tcp:127.0.0.1:19443-:8443,hostfwd=tcp:127.0.0.1:19222-:22,hostfwd=tcp:127.0.0.1:19090-:19090,guestfwd=tcp:10.0.2.101:22-cmd:/var/lib/vz/honeypot/forward-execution-ssh -device virtio-net-pci,netdev=decoy,mac=$mac"
+  if [[ $vmid = 223 ]]; then
+    role=execution; mem=4096; port=19223; mac=52:54:00:22:02:23
+    packages='[python3, strace, curl, wget, netcat-openbsd, iptables, openssh-server, qemu-guest-agent]'
+    # Trusted package bootstrap only. restrict=on MUST replace this before payloads.
+    args="-netdev user,id=decoy,hostfwd=tcp:127.0.0.1:19223-:22,guestfwd=tcp:10.0.2.100:19090-cmd:/var/lib/vz/honeypot/forward-collector-telemetry -device virtio-net-pci,netdev=decoy,mac=$mac"
+  fi
+  mkdir -p "seed-$vmid" /var/lib/vz/template/iso
+  cat > "seed-$vmid/user-data" <<CLOUD
+#cloud-config
+hostname: decoy-$role
+manage_etc_hosts: true
+disable_root: false
+ssh_pwauth: false
+users:
+  - name: root
+    lock_passwd: true
+    ssh_authorized_keys:
+      - $(cat admin.pub)
+package_update: true
+packages: $packages
+runcmd:
+  - [mkdir, -p, /opt/decoy, /netscaler/ns_gui, /nsconfig]
+  - [systemctl, enable, --now, qemu-guest-agent]
+  - [touch, /var/lib/decoy-bootstrap-complete]
+CLOUD
+  if [[ $vmid = 223 ]]; then printf '  - [touch, /etc/decoy-disposable-guest]\n' >> "seed-$vmid/user-data"; fi
+  printf 'instance-id: decoy-%s-20260928\nlocal-hostname: decoy-%s\n' "$vmid" "$role" > "seed-$vmid/meta-data"
+  cat > "seed-$vmid/network-config" <<NET
+version: 2
+ethernets:
+  decoy:
+    match:
+      macaddress: "$mac"
+    dhcp4: true
+NET
+  genisoimage -quiet -output "/var/lib/vz/template/iso/decoy-seed-$vmid.iso" -volid cidata -joliet -rock "seed-$vmid"
+  qm create "$vmid" --name "decoy-$role" --memory "$mem" --cores 2 --cpu host --ostype l26 --scsihw virtio-scsi-pci --agent enabled=1 --onboot 0 --serial0 socket --vga serial0 --args "$args" --description "Dedicated NetScaler honeypot $role; QEMU user networking only. VM223 restrict=on mandatory before attacker execution."
+  qm importdisk "$vmid" debian.qcow2 local-lvm >/dev/null
+  qm set "$vmid" --scsi0 "local-lvm:vm-$vmid-disk-0" --ide2 "local:iso/decoy-seed-$vmid.iso,media=cdrom" --boot order=scsi0
+  qm resize "$vmid" scsi0 12G
+  qm start "$vmid"
+done