Commit Graph

46 Commits

Author SHA1 Message Date
7be73a7dff Make peername and sockname calls more robust across platforms
For whatever reason, MacOS returns 4 values from conn.get_extra_info('peername') and conn.get_extra_info('sockname'), but Linux systems only return 2.  On the Mac, it's only the first two that we need anyway. Now we retrieve them all, no matter how many there are, and just use the first two so it will work on both platforms.
2025-01-28 10:39:12 -05:00
788bd26845 Now print exceptions to console when SSH connection is lost 2025-01-28 10:21:27 -05:00
cea5dc28a2 New command line options for prompts and config files.
* --prompt-file to specify a file from which to read the prompt.
* --prompt to specify a prompt string on the command line
* --config to specify an alternate config file
2025-01-27 13:20:41 -05:00
545d50f294 Added DECEIVE image to README 2025-01-23 11:16:53 -05:00
32441dc4c0 Merge pull request #1 from splunk/user-system-prompt
Streamline the prompting
2025-01-17 19:37:52 +00:00
cda3c5496b Streamline the prompting
The config file now contains a new "system_prompt" value in the [llm] section. This would be the same for all DECEIVE instances, and configures how the emulation itself will act. The honeypot administrator should mostly keep this intact. The prompt.txt file now focuses more on what type of system to emulate, and optional details such as valid users, contents to stage on the system, etc.
2025-01-17 14:37:07 -05:00
767104fa72 Fixed improper acronym for DECEIVE 2025-01-17 11:48:35 -05:00
f1d010593e Ignore *_host_key 2025-01-13 10:36:54 -05:00
b4918788d7 Added PoC warning 2025-01-13 10:09:00 -05:00
4967d44df9 User input (commands) now base64 encoded in the log file 2025-01-10 15:47:16 -05:00
46a958aea8 Changed project name and expanded docs
* Project is now called DECEIVE, so the README.md has been updated to reflect this
* Added more details about installation, configuration, host platform support, and logging to the README.md
2025-01-10 15:46:42 -05:00
52541ab1ed Session summaries now include a "judgement" field to make it easier to search/filter. 2025-01-10 14:12:59 -05:00
e9044ba2ad JSON, summary, and exit fixes
* All logging is now in JSON lines format!
* Fixed a bug where the session summary was generated twice for the same session
* Fixed a reversion in the exit handling when the user logged out gracefully.
2025-01-10 13:38:04 -05:00
7185c7f5c7 Fix session summary and ascii errors
* Session summaries now occur both at normal session termination (e.g., the user gracefully logs out) or abnormal termination, such as if the client disconnects suddenly.
* Now encode the AI results as UTF-8 instead of ASCII, because it would ocassionally send back non-ASCII characters which caused the server to throw errors
2025-01-10 12:33:36 -05:00
3b546126b6 New AI-powered session summary and judgement. Removed extra exit() statement. 2024-12-20 13:37:40 -05:00
b16c76c26a Updated README.md and reformatted SSH system prompt. 2024-11-12 14:12:29 -05:00
d1c3704924 Added SSH config file template 2024-11-07 15:27:34 -05:00
a04e0d0eed Added asyncssh dependency 2024-11-07 14:14:56 -05:00
cf2ee082b1 Merge branch 'main' of https://github.com/splunk/AIHoneypot 2024-11-07 13:42:02 -05:00
ff848b44ac Create LICENSE
Added MIT license
2024-11-07 13:37:02 -05:00
e643ac344d Updated TODO 2024-08-26 14:36:32 -04:00
a73fefa9c4 Moved SSH honeypot to subdirectory 2024-08-26 14:31:52 -04:00
2461b42e40 Improved end-of-session handling
Rather than explicitly checking to see if the user
was typing a shell exit command, the LLM is now
instructed to provide a specific token starting
("XXX-END-OF-SESSION-XXX") to indicate that the
session should be closed. This allows the user to
exit the shell in any way they see fit, and the
LLM will still know when to end the session. It
also means that typing 'exit' or similar commands
to subshells or command interpreters (e.g. Python)
are less likely to cause the session to end.
2024-08-23 15:28:42 -04:00
ed95eda824 Improved honeypot logging
Logs now include the protocol (SSH) and the src/dest IPs and ports on each log line.
2024-08-23 13:52:36 -04:00
e2854e960c Now log passwords for any login attempt (failures and successes). 2024-08-23 12:41:51 -04:00
4029df5cdd Removed a redundant import 2024-08-23 11:48:08 -04:00
b49e743e7c Cleaned up and organized imports 2024-08-23 11:43:15 -04:00
a180bb58a2 Minor code formatting changes 2024-08-23 11:18:14 -04:00
e385b8a4bb Removed extraneous debug prints 2024-08-22 15:39:49 -04:00
7e38c43dee Experimental support for changing LLM providers and models in the config file. 2024-08-22 14:39:47 -04:00
df203a7a55 Log both successful and failed login attempts 2024-08-20 14:44:30 -04:00
c57cb0a240 Cleaned up sample prompt files. 2024-08-20 11:52:37 -04:00
8bb4cb3393 New file: TODO.txt 2024-08-20 09:43:54 -04:00
656872ab2c Initial SSH emulation prompt. 2024-08-20 09:17:19 -04:00
b72acb81be Changed name to HADES 2024-08-20 09:15:08 -04:00
ba5713d94c Now uses config.ini for all configuration parameters. 2024-08-16 17:11:41 -04:00
f84d0b2d37 Converted start_server() to more modern idiom granting better control of server parameters. 2024-08-16 15:09:07 -04:00
0f5c4d1f69 Implement chat message history trimming to avoid overflowing the LLM context window. 2024-08-16 11:34:29 -04:00
c40444a6cc Command output now logged as base64 string to avoid multiline issues. 2024-08-16 09:13:41 -04:00
eb4a67f094 Added a couple of conveniences:
* Moved the system prompt to its own file
* Added 'exit/logout/quit' support to realistically end the SSH session.
2024-08-15 16:50:42 -04:00
092ac94b05 Now a function prototype with an LLM backend.
* Added langchain support (OpenAI's gpt-4o model)
* Created a system prompt that gives functional results
* Initial integration of logging for LLM responses (needs improvement)
2024-08-15 15:44:54 -04:00
759814f8c9 Added requirements.txt 2024-08-15 13:33:08 -04:00
62178679c6 Each SSH session now gets a uniq ID in the log 2024-08-15 13:08:45 -04:00
f95ad39f32 Added centralized logging 2024-08-15 12:17:48 -04:00
12af949915 Initial commit of barebones SSH server. 2024-08-15 11:16:37 -04:00
e7d9a8ede6 Initial commit 2024-08-15 10:55:00 -04:00