SHARE
TWEET

Heartbleed Honeypot (hb_honeypot.pl)

a guest Apr 14th, 2014 209 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #!/usr/bin/perl
  2.  
  3. # hb_honeypot.pl -- a quick 'n dirty honeypot hack for Heartbleed
  4. #
  5. # This Perl script listens on TCP port 443 and responds with completely bogus
  6. # SSL heartbeat responses, unless it detects the start of a byte pattern
  7. # similar to that used in Jared Stafford's (jspenguin@jspenguin.org) demo for
  8. # CVE-2014-0160 'Heartbleed'.
  9. #
  10. # Run as root for the privileged port. Outputs IPs of suspected heartbleed scan
  11. # to the console. Rickrolls scanner in the hex dump.
  12. #
  13. # 8 April 2014
  14. # http://www.glitchwrks.com/
  15. # shouts to binrev
  16.  
  17. use strict;
  18. use warnings;
  19. use IO::Socket;
  20.  
  21. my $sock = new IO::Socket::INET (
  22.                                   LocalPort => '443',
  23.                                   Proto => 'tcp',
  24.                                   Listen => 1,
  25.                                   Reuse => 1,
  26.                                 );
  27.  
  28. die "Could not create socket!" unless $sock;
  29.  
  30. # The "done" bit of the handshake response
  31. my $done = pack ("H*", '16030100010E');
  32.  
  33. # Your message here
  34. my $taunt = "09809*)(*)(76&^%&(*&^7657332         Hi there!                  Your scan has   been logged!                    Have no fear,   this is for     research only --                                We're never gonna give you up,  never gonna let you down!";
  35. my $troll = pack ("H*", ('180301' . sprintf( "%04x", length($taunt))));
  36.  
  37. # main "barf responses into the socket" loop
  38. while (my $client = $sock->accept()) {
  39.   $client->autoflush(1);
  40.  
  41.   my $found = 0;
  42.  
  43.   # read things that look like lines, puke nonsense heartbeat responses until
  44.   # a line that looks like it's from the PoC shows up
  45.   while (<$client>) {
  46.     my $line = unpack("H*", $_);
  47.  
  48.     if ($line =~ /^0034.*/) {
  49.       print $client $done;
  50.       $found = 1;
  51.     } else {
  52.       print $client $troll;
  53.       print $client $taunt;
  54.     }
  55.  
  56.     if ($found == 1) {
  57.       print $client $troll;
  58.       print $client $taunt;
  59.       print $client->peerhost . "\n";
  60.       $found = 0;
  61.     }
  62.   }  
  63. }
  64.  
  65. close($sock);
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top