Telnet Honeypot For IoT Malware Capture Using Python — Complete Documentation & Simulation

Overview & System Context

Telnet Honeypot For Iot Malware Capture Using Python: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~6097 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background This project neither supported or in development anymore. It is based on python2 which has reached its EOL in 2020 and uses dependencies which are getting harder to install over time. Use at your own risk! This project implements a python telnet server trying to act as a honeypot for IoT Malware which spreads over horribly insecure default passwords on telnet servers on the internet.

The honeypot works by emulating a shell enviroment, just like cowrie ( https://github.com/micheloosterhof/cowrie ). The aim of this project is primarily to automatically analyse Botnet connections and "map" Botnets by linking diffrent connections and even Networks together. The application has a client/server architecture, with a client (the actual honeypot) accepting telnet connections and a server which receives information about connections and does the analysis.

Figure 1: GitHub - Phype/telnet-iot-honeypot: Python telnet honeypot for catching ... The backend server exposes a HTTP interface which is used to access to frontend as well as by the clients to push new Connection information to the backend. Networks are discovered Botnets. A network is the set of all linked connections, urls and samples. Urls and samples are linked when they are used in a connection. Two connections are linked when both connections are recieved by the same honeypot client (mutliple clients are supported!) and use the same credentials in a short period of time (defautl 2 minutes) or come from the same IP address.

Multiple networks are identified to use the same type of malware if the text entered during sessions of the networks aro mostly the same. This comparison is done using sort of "hash"-function which basically translates a session (or connection) into a sequence of words and then maps each word to a single byte so this resulting sequence of bytes can be easily searched. The application has a config file named config.py. Samples are included for local and client/server deployments.

Figure 2: Telnethoney: IoT Credential Honeypot [Leanpub PDF/iPad/Kindle] The backend requires a SQL-database (default sqlite) which is initialized at first run. Before the first run you should generate a admin account which is used to generate more users. The admin account can also directly used by a client to post connections. When more than one honeypots shall be connected, creating multiple users is recommended.

Both client and backend will read the files config.yaml and config.dist.yaml to read configuration parameters. The config.dist.yaml file includes default values for all but admin user credentials and these parameters are overwirtten by entries in the config.yaml file. This project contains an own honeypot, however because of the client-server architecture, other honeypot can be used as well.

The client cannot be started without the server running. To use a diffrent configuration for the client you can use the -c switch like this: Figure 3: GitHub - krypt0k1/honeypot_demo: Showcases a honeypot designed to ... If you only want to check the honeypot functionality, you can start the client in interactive mode: I wrote an output plugin for cowrie, which has much more features than the built in honeypot. If you want to use cowrie instead, checkout my fork which includes the output module here: https://github.com/Phype/cowrie .

A virtualised medium-interaction honeypot for capturing and analysing IoT-targeted brute-force activity This project deploys a Cowrie medium-interaction honeypot, configured to impersonate a vulnerable Internet-of-Things (IoT) device, inside an isolated VirtualBox network. The honeypot exposes SSH and Telnet — the two services most aggressively targeted by IoT botnets such as Mirai and its derivatives — and records every connection, authentication attempt, and post-login command in structured JSON.

Captured telemetry was then processed with a custom Python analysis pipeline to quantify attacker behaviour, profile the credential dictionaries in use, reconstruct attack timelines, and produce the threat-intelligence findings documented in this repository. Across the capture window the honeypot logged 552 authentication attempts against the emulated device, of which 98.4% failed — a clear signature of automated dictionary-based brute forcing rather than targeted human access.

Why it matters: IoT devices ship with weak, well-known default credentials and are rarely patched. Honeypots let defenders observe exactly which credentials, tools, and behaviours adversaries use against these devices — intelligence that feeds detection rules, blocklists, and hardening guidance. The Host-Only adapter guarantees the honeypot cannot reach the public internet , so captured activity is contained and the lab carries no risk to third parties.

All captured traffic originated from a single isolated lab source ( 192.168.56.10 ); this is a controlled, contained study rather than an internet-facing capture, so geographic attribution is treated as a method for live deployment rather than a finding. Follow docs/deployment_guide.md to stand up the isolated VirtualBox network, install Cowrie on the Ubuntu sensor, and apply the configuration in config/ .

The script ingests Cowrie JSON, prints summary statistics, and writes the visualisations to results/ . Six-panel SSH dashboard (Run 1, 184 attempts): top usernames, top passwords, the 98.4% / 1.6% success split, attack timeline, source-IP distribution, and per-session attempt distribution. The near-uniform username counts and the concentration on IoT default passwords are the fingerprint of automated, dictionary-driven brute forcing.

Six-panel web dashboard (Run 1): top requested paths, HTTP status-code distribution (99.1% errors), Nikto/Dirb tool attribution, request timeline, HTTP methods, and error rate. Run 1 vs Run 2 scale proportionally (184 → 368 attempts) at a constant 1.6% success rate — evidence the honeypot logs deterministically under increasing load.

Additional charts ( credential_analysis_run_2.png , web_analysis_run_2.png , run_comparison_web.png , analyzer console output) are in results/ . Evidence screenshots (Nmap, Hydra, tcpdump) and architecture diagrams are in docs/screenshots/ and docs/diagrams/ . See docs/threat-intelligence-report.md for the interpreted findings and defensive recommendations.

This honeypot was operated in a fully isolated Host-Only network with no route to the public internet. No third-party systems were accessed and no real user data was collected. Configuration files in this repository are sanitised — secrets, keys, and any host-identifying addresses have been removed. The credential dictionaries are published default lists already in the public domain (e.g. the Mirai source release) and are provided strictly for defensive research and education.

Harry Klair — BSc Cyber Security (Hons), Nottingham Trent University Portfolio: harryklrr.github.io · GitHub: @HarryKlrr 2. System Architecture & Core Working Principles Virtualised IoT honeypot using Cowrie, SSH/Telnet telemetry, Python analysis and threat intelligence reporting. A Python telnet honeypot that emulates a shell environment to catch IoT botnet binaries and analyze malware networks.

Telnet IoT honeypot is a Python telnet server that acts as a honeypot to catch IoT malware binaries spreading through insecure default telnet passwords. It emulates a shell environment to interact with botnet connections and automatically analyzes them to map and link different botnet networks. The project helps researchers track and understand IoT malware campaigns by collecting and correlating connection data.

Security researchers, malware analysts, and network administrators interested in studying IoT botnets, capturing malware samples, and analyzing botnet infrastructure. It provides an automated, client-server based honeypot specifically designed for IoT malware, with built-in analysis to link connections and identify malware families, offering insights into botnet behaviors without complex setup.

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub. Links connections into networks based on shared credentials or IP addresses within minutes, automatically correlating IoT malware campaigns as described in the automatic analysis section.

Supports multiple honeypot clients reporting to a central backend, enabling distributed data collection and centralized analysis per the architecture overview. Uses a custom hashing function to compare session texts across networks, helping identify similar malware strains based on command patterns without manual inspection.

Provides an HTTP frontend for accessing analysis results and managing the system, making it easier to visualize and interact with collected data as shown in the screenshots. Built on Python2, which reached end-of-life in 2020, leading to dependency installation challenges and lack of security updates, as explicitly warned in the disclaimer.

No longer supported or in development, meaning bugs won't be fixed and features won't be updated, posing a risk for long-term research or deployment. Specifically designed for telnet-only honeypotting, so it cannot capture attacks over other common IoT protocols like SSH without using external tools like Cowrie with a plugin.

Requires configuration of SQL databases, user accounts, and multiple YAML files, which can be cumbersome compared to simpler, plug-and-play honeypot solutions. Opening the frontend After the server is started, open html/index.html in your favorite browser. For this to work, the url in html/apiurl.js should point to your running backend, which it should do automatically for local deployments.

Every 40 seconds, an IoT device is hacked. While your firewall silently blocks these attacks, sophisticated botnets like Mirai and Gafgyt evolve their tactics in real-time. What if you could transform this constant barrage of malicious traffic into actionable threat intelligence? Enter SENTINEL-IOT , a revolutionary open-source platform that doesn't just defend—it learns, adapts, and turns attackers into unwitting informants.

This isn't another academic honeypot that crashes under production load. SENTINEL-IoT is a battle-tested intelligence engine designed to run on a $5 VPS or Raspberry Pi, capturing live botnet campaigns through elegant deception. In this deep dive, you'll discover how to deploy your own sensor network, extract real malware samples, and visualize emerging threats through a stunning Glassmorphism dashboard that belongs in a modern SOC.

From architecture breakdowns to actual code snippets, installation walkthroughs to legal compliance frameworks, this guide transforms you from passive defender to active threat intelligence operator. Ready to weaponize vulnerability? SENTINEL-IOT is a next-generation IoT Intelligence Platform & Honeypot Network developed by security researcher Anand Binu Arjun . Unlike traditional intrusion detection systems that simply block malicious traffic, SENTINEL-IoT emulates vulnerable IoT devices —think CCTV cameras, routers, and DVRs—to actively invite, capture, and analyze botnet attacks in a controlled environment.

At its core, SENTINEL-IoT operates on a brilliant inversion principle: "If you want to stop the botnet, you must become the vulnerability." The platform creates high-fidelity decoys that convince automated malware scanners they've found a legitimate target. When attackers attempt to brute-force credentials or deliver malicious payloads, every interaction is silently logged, fingerprinted, and transformed into structured threat intelligence.

What makes this project genuinely disruptive is its production-ready design philosophy . While most honeypots are either research toys that collapse under real-world load or enterprise behemoths requiring complex infrastructure, SENTINEL-IoT strikes a perfect balance. It runs efficiently on minimal hardware, uses a decoupled microservices architecture, and provides a premium visualization experience that security operations centers actually want to display on their wall monitors.

The platform specifically targets the most destructive IoT malware families— Mirai, Gafgyt, Mozi, and Tsunami —by emulating the exact services these botnets exploit: Telnet on port 23/2323 and SSH on port 22/2222. This precision targeting ensures you capture relevant, actionable intelligence rather than drowning in noise. SENTINEL-IoT's core innovation is its dual-service emulation architecture . The platform simultaneously runs both Telnet and SSH honeypots using pure Python I Bright Coding Blog implementations—no system binaries required. The Telnet sensor operates on port 2323 (configurable to 23) and mimics BusyBox/Linux router interfaces, while the SSH sensor runs on port 2222 (configurable to 22) impersonating Ubuntu Server or OpenWRT devices.

This approach consumes less than 50MB RAM and minimal CPU, making it ideal for deployment on Raspberry Pi Zero devices or budget VPS instances. The emulators use Python's built-in socket library for Telnet and the robust paramiko library for SSH, ensuring stability without sacrificing performance. The platform's Integrated Malware Downloader represents a breakthrough in passive threat intelligence gathering. When an attacker issues a wget or curl command, SENTINEL-IoT's command parser instantly identifies the URL, strips dangerous arguments, and safely downloads the malicious binary to a sandboxed directory ( sample_binaries/ ).

Crucially, the malware is never executed . Each sample is immediately hashed using SHA-256, tagged with metadata, and stored for static analysis. This creates a continuously updated malware corpus that researchers can analyze to track botnet evolution, identify new C2 infrastructure, and develop signatures before attacks reach production networks. Forget clunky, text-based honeypot interfaces. SENTINEL-IoT ships with a premium Glassmorphism UI built on Flask and vanilla CSS that delivers SOC-grade visualizations. The dashboard displays live attack streams, geographic IP distribution, credential dictionaries, and malware family classifications in real-time.

The interface is specifically designed for large monitor deployments in security operations centers, featuring high-contrast metrics, animated threat indicators, and a dark theme that reduces eye strain during extended monitoring sessions. This aesthetic excellence transforms threat intelligence from a chore into an engaging, actionable experience. Reliability under attack is paramount. SENTINEL-IoT employs a dual-logging architecture that ensures no intelligence is lost.

All interactions are simultaneously written to a SQLite database (in WAL mode for concurrent access) and flat text files for cold storage redundancy. The SQLite database enables real-time API queries and dashboard updates, while the text logs provide a tamper-proof audit trail that survives database corruption or system compromise. This belt-and-suspenders approach is critical when dealing with adversaries who may attempt to disrupt logging mechanisms.

3. Software Implementation, Frameworks & Protocols The architecture follows modern 12-Factor App principles with three independent services communicating via a local SQLite bridge. The Telnet and SSH emulators write attack data to the shared database, a FastAPI backend serves JSON feeds, and a Flask frontend renders the dashboard.

This decoupling allows individual components to be scaled, updated, or restarted without affecting the entire system. You can deploy multiple sensor nodes across different geographic regions, each feeding into a centralized database, creating a global IoT botnet early-warning network . Internet Service Providers face a unique challenge: their networks host thousands of compromised IoT devices participating in DDoS attacks, but they lack visibility into infection patterns. By deploying SENTINEL-IoT sensors at network edges, ISPs can identify infected customer devices before they cause collateral damage .

When a compromised home router attempts to scan the ISP's honeypot, the platform captures the source IP, attack signature, and payload. This intelligence allows the ISP to proactively notify customers, quarantine infected devices, and prevent their network from being blacklisted—transforming reactive abuse complaints into proactive security outreach. Large organizations struggle to obtain fresh, relevant IoT threat data. Commercial feeds are expensive and often stale. By running a SENTINEL-IoT node in a DMZ, security teams generate customized threat intelligence specific to their industry and geographic region.

The platform's API endpoints ( /dashboard/stats and /feed/ips ) integrate seamlessly with SIEM platforms like Splunk or ELK Stack. Analysts can create correlation rules that automatically block IPs attacking the honeypot, effectively vaccinating the production network against emerging botnet campaigns within minutes of first detection. Cybersecurity researchers require live malware samples to study botnet evolution, but setting up traditional honeypots is time-intensive. SENTINEL-IoT's automated collection and hashing system creates a reproducible research corpus.

Students can analyze the sample_binaries/ directory to compare Mirai variants, extract C2 domains, and study propagation mechanisms. The platform's detailed logging of command sequences provides context for each sample, answering critical questions: What credentials were used? What architecture was targeted? What post-exploitation commands were issued? MSSPs can deploy SENTINEL-IoT sensors across their client base to offer "Botnet Early Warning" as a premium service. The Glassmorphism dashboard becomes a client-facing report, demonstrating real-time threat detection and the provider's proactive security stance.

Each client's sensor feeds into a centralized threat database, allowing the MSSP to identify campaign patterns across their entire customer base. When a new Mirai variant emerges, they can instantly determine which clients are being targeted and preemptively harden their defenses. The requirements.txt includes: paramiko , fastapi , flask , uvicorn , sqlite3 , and other security-focused libraries.

Step 6: Configure Port Forwarding (Optional but Recommended) To attract real botnet scanners, map standard ports to SENTINEL-IoT's high ports: Access the dashboard at http://YOUR_SERVER_IP:8080 and API at http://YOUR_SERVER_IP:8000/dashboard/stats . The Telnet sensor is the frontline deception engine. Here's how it captures brute-force attempts: How It Works: The sensor binds to a non-privileged port and sends authentic BusyBox banners. When a botnet scanner connects, it captures the username/password attempt, logs it to both SQLite (for real-time queries) and flat files (for redundancy), then simulates a failed login to maintain the deception without allowing actual access.

Security Note: The check_auth_password method deliberately returns AUTH_FAILED while logging credentials. This ensures attackers cannot gain access while providing maximum intelligence value. Critical Safety Feature: The function validates URLs, downloads to a non-executable sandbox, hashes the sample, and signals the sensor to terminate the connection before the attacker can execute the malware.

Integration Ready: These endpoints return JSON that feeds directly into Splunk, ELK, or custom SOAR playbooks, enabling automated blocking responses. Key Differentiator: SENTINEL-IoT's hybrid deception (simultaneous Telnet + SSH) and automated malware pipeline eliminate manual analysis overhead, making it the only solution truly optimized for high-fidelity production deployment at scale.

A: Yes, when configured correctly. SENTINEL-IoT follows a passive interaction model—you're only logging traffic sent to your systems. The platform never scans external networks or "hacks back," ensuring compliance with CFAA and EU cyber laws. Always consult local regulations and your ISP's terms of service. A: No. The system intervenes at the Exploitation stage of the Kill Chain. Malware is downloaded but never executed .

Connections terminate before the Installation phase, preventing your sensor from participating in DDoS attacks or C2 communication. A: SENTINEL-IoT is designed for low-noise outbound traffic . It never initiates scans or attacks. To stay compliant, configure your firewall to block all outbound connections except for malware sample downloads (which you can restrict to specific times). The README includes a complete iptables hardening script.

A: Absolutely. The pure Python implementation avoids heavy dependencies. A Pi Zero W can handle 50+ concurrent connections while using <100MB RAM. For internet-facing deployment, use iptables to redirect ports 22/23 to the high ports SENTINEL-IoT binds to. A: Real-time. The SQLite database updates instantly upon attack detection. The API serves data with sub-second latency. In testing, SENTINEL-IoT nodes capture new botnet campaigns within 15 minutes of their first internet scan, often before commercial feeds register them.

A: Seamlessly. The FastAPI endpoints provide JSON feeds compatible with Splunk HTTP Event Collector, ELK Logstash, and Python scripts. The SQLite database schema is documented, allowing direct SQL queries from BI tools like Grafana or Tableau. A: Minimal. SENTINEL-IoT's emulated device personas (BusyBox routers, Ubuntu servers) match the exact profiles IoT botnets target. Legitimate scanners like Shodan won't attempt credential brute-forcing or malware delivery. The platform includes IP whitelisting for known research scanners.

SENTINEL-IoT represents a paradigm shift from passive defense to active intelligence gathering . For the cost of a coffee per month, you can deploy a sensor that provides early warning of emerging botnet campaigns, captures live malware samples for analysis, and generates actionable IoCs that protect your entire network. The platform's elegance lies in its simplicity: pure Python code, minimal dependencies, and a focus on doing one thing exceptionally well —turning botnet noise into security signal. Whether you're a researcher studying Mirai evolution, an ISP protecting customers, or an enterprise hardening your perimeter, SENTINEL-IoT delivers production-grade capabilities without enterprise complexity.

The threat landscape won't wait. Every minute you delay is another minute botnets evolve undetected. Clone the repository, spin up a node, and join the global network of defenders who've learned that the best way to beat attackers is to listen to them—very, very carefully. Passionate web developer and tech writer who turns complex ideas into practical, real-world guides. I write about Laravel, JavaScript, and modern software architecture — helping you build faster, cleaner, and smarter applications.

4. Practical Deployment, Analysis & Case Studies Discover Awesome-OSINT-For-Everything: a curated collection of 1000+ OSINT tools for penetration testing, red team operations, bug bounty hunting, and digital i... hagezi/dns-blocklists provides 5 tiered DNS blocklists (Light to Ultimate) and 20+ specialized lists for ads, malware, tracking, bypass prevention, and threat i...

OpenBAS-Platform/openbas is an open-source adversary exposure validation platform for planning, scheduling, and conducting cyber simulation campaigns. Built in... This website is free thanks to advertising. Disabling your ad blocker helps us keep publishing tutorials. A low-interaction honeypot designed to emulate vulnerable IoT devices (Telnet), capture attacker traffic, and analyze threats using Machine Learning. This system goes beyond simple logging by automatically classifying attack intent (e.g., Malware Download , Reconnaissance , Destruction ) using a Naive Bayes classifier .

Intelligent Logging Captures IP addresses, timestamps, credentials, and raw shell commands. ML-Powered Analysis Uses Scikit-Learn (Naive Bayes) to classify attacks based on command patterns. Interactive Dashboard A Flask-based web interface with real-time charts (Chart.js) and forensic details. Simulation Suite Includes a script to simulate a 20-node botnet attack for demonstration purposes.

A Windows Batch script ( run_project.bat ) automatically launches all components in separate terminal windows with correct timing. If you are on Linux/Mac or want full visibility, run the following in separate terminals. Run the simulation in a new terminal. Connection logs will appear in the honeypot window.

The system uses a Multinomial Naive Bayes classifier trained on a dictionary of common IoT attack commands. The ml_engine.py vectorizes these commands using Bag of Words to predict the intent of new, unseen commands during an attack. Department of Computer Science & Engineering (AIML) KIT's College of Engineering, Kolhapur A low-interaction honeypot designed to emulate vulnerable IoT devices (Telnet), capture attacker traffic, and analyze threats using Machine Learning. This system goes beyond simple logging by automatically classifying attack intent using a Naive Bayes classifier.

An open-source telnet honeypot designed to detect and fingerprint IoT botnets like Mirai by simulating vulnerable devices. MTPot is an open-source telnet honeypot that simulates vulnerable IoT devices to detect and fingerprint malicious botnet scanners. It helps security researchers identify attacks like Mirai by logging command sequences and attacker IPs, providing insights into IoT threat landscapes.

Security researchers, network defenders, and IoT administrators looking to monitor telnet-based attack attempts and gather threat intelligence on IoT botnets. Developers choose MTPot for its simplicity, configurable command-response system, and focused approach to telnet-based IoT botnet detection, offering a lightweight alternative to complex honeypot frameworks.

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub. MTPot is designed for minimal setup with configurable JSON files, making it easy to deploy for focused telnet emulation without complex dependencies.

Specifically targets telnet-based IoT malware like Mirai by emulating vulnerable services, providing precise fingerprinting and threat intelligence from attacker IPs. Uses JSON configuration to define expected commands and custom responses, allowing adaptation to different malware families as shown in the sample Mirai configs.

Optional forwarding of fingerprinted IPs to syslog servers enables centralized monitoring, enhancing its utility in network security setups. Requires Python 2.7, which is deprecated and unsupported, leading to security risks and compatibility issues with modern systems.

Known issues with the telnetsrv library cause AttributeErrors, requiring manual code modifications as described in the README, adding setup complexity. Admits that some malware scanners may crash upon receiving responses, reducing effectiveness for complete attack simulation, as noted in the known issues section.

Only emulates telnet services, making it ineffective for detecting attacks on other common IoT protocols like HTTP or SSH, limiting its scope. Honeypots are essential tools for threat hunting They are primarily decoys for attackers designed to mimic real systems, applications, or services. By luring malicious actors to interact with these decoy systems, researchers can observe and analyze their tactics, techniques, and procedures (TTPs). This way, researchers can understand the methods used by attackers to build efficient tools and strategies for early detection of malicious behavior.

5. Performance Evaluation & Extended Technical Observations A one-size-fits-all approach for a honeypot may attract low-level automated attacks, but it might fail to lure sophisticated threat actors. By tailoring the honeypot to match our interests, we can increase the likelihood of attracting advanced adversaries. Moreover, understanding the target’s motivations and objectives allows the creation of more realistic scenarios, leading attackers to interact with the honeypot in ways that reflect their actual intentions.

Honeypots are typically isolated from production environments and have no legitimate use. Therefore, any activity on a honeypot will be likely associated with an attack. When an attacker engages with a honeypot, it provides an early warning that an intrusion attempt is underway. With this information, threat hunters can discover new attack vectors, malware variants, and emerging threat trends, enhancing their understanding of the evolving threat landscape.

In this blog post, we detail the steps for setting up and utilizing an IoT honeypot in the real world. We’ll also walk through an example setup, taking the Winbox protocol as a case study, as it is commonly misused by attackers. Start by identifying a specific protocol and/or device of interest, for example, something that has previously been exploited, and gathering sources of available information. If the protocol specification is closed, it could be that someone has already implemented the targeted protocol in some programming language. It is possible that a Wireshark dissector exists for the proprietary protocol.

Next, check the reported public exploits to understand how the device/protocol is being targeted or manipulated. This should give you enough information to pinpoint what is valuable to capture in a honeypot, and what technical activities you want to look for. Once you are in the position to be able to reproduce the exploit example, it is now the time to set up a testing environment to see it in the wild.

One possible way to set up a test environment is to acquire the affected device and set it up in a vulnerable configuration. The exploit can then be used to ensure the device is vulnerable and later to gather artifacts such as a PCAP and logs of the active exploitation attempts and activities. The simplest way to attract threat actors to the device is to put the affected device in a vulnerable configuration on the public internet. This can be a relatively cheap and effective approach, however, there are multiple drawbacks. For example, restoring the device to the initial clean state may be more difficult. Another approach is to set up a virtualized version of the vulnerable device, leveraging technology like OpenWRT or even a Windows virtual machine. This kind of system will be easy to revert to previous states. However, it also makes it easier for the attackers to realize that this is a research environment.

Unfortunately, these two options also have a common disadvantage. Logging the attacker’s actions in a unified way may be more difficult to achieve in some scenarios. For example, some exploits can potentially leverage unexpected and unmonitored system functionalities. In addition, if improperly configured, attackers may be able to cause real damage to third parties by misusing this system, so particular attention should be paid to its vulnerable state and connectivity.

Lastly, the more complex approach is to emulate the system’s intended operation as much as possible. This is typically what honeypots such as Cowrie do. They provide a fake Linux shell via SSH that looks real, with a fake filesystem and supported set of commands. This option is arguably among the best as it gives the operators advanced control over the honeypot, though this option also takes the most time to implement.

Once you decide how to set up the test environment, the next phase often consists of building some detection rules for the alerting when the system is misused, or exploitation occurs. There are many ways to achieve this, from using Snort rules to more complex alerting based on the system logs. It is best to enable all relevant system logs to register all potentially interesting actions an attacker takes. Unfortunately, not all systems allow you to log some important events, nor do they allow you to easily understand their protocols. In general, try to get as much visibility as possible. This will enable you to figure out what the adversary did and attempted to do with the system, which is extremely valuable and actionable information. Analysis of threat actor activities and tools often leads to the creation of new rules and signatures, and helps the cybersecurity community to better understand the motives and objectives of adversaries. Are they looking to set up a VPN network they can use to anonymize their traffic? Maybe. Or, maybe they are using the compromised device to launch DDoS attacks. These questions can only be answered if detection and monitoring are in place.

This step is crucial, as there might be some legal obligation you may have to follow. How can you minimize the risk of the adversary leveraging the honeypot to perform other malicious activity, especially if the honeypot is highly interactive? Sandboxing and robust firewall rules are crucial at this stage. The goal here is to prevent attackers from making any external requests from the honeypot instance or changing the system settings to become able to do so.

Once an attacker successfully accesses and exploits the target device, a lot of useful information can be retrieved from the attacked machine. Manually retrieving the different sources of information is not an option, as there are likely different honeypots running in at the same time and malware is able to instantly remove its traces. Also, we need our honeypot to be ready for the next attacker as soon as possible. All the information needs to be put together to analyze it and have a global picture of it. For example, automating event logging by using SSH / WINRM or some message queue to access logs, you can begin to sort and review the actions and activities taken by the threat actor within the system.

Sometimes, attackers close the door they used to enter to make sure nobody enters after them. The next step will be to recover useful artifacts and logs from the honeypot. Once all of the artifacts have been recovered, think about how to reset the honeypot to a clean and exploitable state while minimizing human interaction required. There are several ways to place the honeypot in a specific geographic location, or hide its true location. One way would be to host multiple honeypot instances with public IPs associated with different countries of interest since most hosting providers allow customers to choose the location of their instances. Another approach could be to set up proxy forwarding requests to the actual honeypot instance. This allows you to host the actual honeypot in one location and make it visible on the internet with multiple public IP addresses associated with different countries.

In the end, you should have a publicly accessible honeypot capable of rule detection and log monitoring. As a result, you will be able to collect all of the relevant pieces of information needed to analyze and understand the threat. You can also analyze ways in which an attacker might automate the exploitation of your honeypot and/or similar vulnerable devices. Take some time to test your setup, have other people test it, and make sure everything behaves as expected. Be sure that the adversary cannot pivot to any other system within the honeypot range. Then you should be ready to go live. Remember to keep monitoring the honeypot as long as the instance is running, and take time to regularly review the logs and connection flows to ensure the honeypot continues operating as expected.

Let’s apply this approach to build a honeypot for the Winbox protocol, commonly misused by attackers. Probably the most famous example of this attack would be the Meris botnet that used it for propagation and abused devices at scale to launch some of the biggest DDoS attacks in history. Winbox is a graphical user interface ( GUI ) application used to manage and configure MikroTik RouterOS devices. Some exploits make use of its protocol (basically a TLV-based protocol) to take advantage of unpatched devices that have different vulnerabilities. Below, we describe two vulnerabilities that allow reading and writing important system files without authentication or to escape the sandbox ( CVE-2019-3943 ). We are going to analyze step by step, from Winbox’s point of view, how attackers leverage CVE-2018-14847 .

The first step requires reading the content of the user.dat file. The Winbox protocol requires to first send the open-file request. The message for this opening request is conformed by 3 main values: SYS_TO, which tells the MikroTik device which system executable to use, the SYS_CMD which will select the specific action to perform, and the variable string.1 (set to user.dat ) with the target file to operate with.

The device answers with the size of the file in the variable u32.2 to allow the client to allocate the required memory. Now, setting SYS_CMD to 4 instructs the device to actually read u32.2 bytes from the file specified before. The file user.dat contains credentials of the system’s users. The weak “encryption scheme” allows attackers to instantly obtain the password set for any user: for the affected versions, the password is xored with a key, which is the result of applying MD5 hashing to the username and the 283i4jfkai3389 string. This MD5 hash can be instantly generated and the XOR operation can be instantly reverted this way.

When the administrator’s credentials are recovered, another vulnerability allows the attackers to access the system via SSH with the “devel” username. This traffic capture shows the creation of the devel-login file: As the dissector is not able to tell us which command was executed, we can deduce that SYS_CMD=1 plus SYS_TO=[2,2] with a string variable and with a file-like path may indicate the creation of a file. In this case, the file was created to enable SSH access.

After the attackers have root shell access to the MikroTik system, they are able to perform any action they need for their purposes. For example, Meris/Glupteba, after exploiting CVE-2018-14847 to get root access, is used to enable a VPN server of the device and/or SOCKS proxy and configure scheduled tasks to keep its persistence. Because most of the interaction will then happen over SSH, this is where Cowrie comes into play. Cowrie can be configured to act as an SSH proxy, forwarding the traffic to the actual honeypot. That is why we set up the Mikrotik honeypot behind Cowrie.

Cowrie can manage a pool of Mikrotik VMs and spin them up according to the config. With this setup, we’ll also need to monitor interactions between the attacker and the victim performed via the Winbox protocol. If we capture the traffic, the dissector may be helpful, but not always. Sometimes some packets are not detected as a Winboxm protocol. Also, the dissector doesn't explain what the purpose of each command is.

For this purpose, we started working on pywinbox ( https://github.com/NozomiNetworks/pywinbox ) to help us understand what the attackers use the Winbox protocol for. The work of the security community in analyzing and understanding the Winbox protocol (particularly on Mikrotik’s ECSRP5 authentication protocol , the namespaces and Winbox innner workings ) has been extremely important to better understand the vulnerabilities and improve the detection of these kinds of attacks.

pywinbox manages plaintext protocol and ECSRP5 authentication decrypting the Winbox packets (if the attackers are not using a plaintext connection), it decodes the Winbox protocol to be able to log all commands sent by the attackers and explain what is happening into the wire. Figure 6 shows that pywinbox has logged the CVE-2018-14847 exploitation to read the user.dat file. First, the log shows the variables of the Winbox message so we can precisely see what was sent to the server. This is very useful when some unknown operation is performed in the system. Then, pywinbox interprets the meaning of the message and shows two different messages. The cyan-colored log entry explains what the purpose of the message is (opening a file in this case). The red-colored message is the alert that detected the exploitation of CVE-2018-14847 to read the user.dat file.

Since pywinbox logs all of the attacker’s commands, this allows the system to (1) act as a medium interaction honeypot answering to the commands it has been instructed to reply to and (2) forward the traffic to a real/virtualized Mikrotik server to work as a high interaction honeypot. Harvested Online Documentation & Reference Sources • https://github.com/Phype/telnet-iot-honeypot • https://github.com/HarryKlrr/iot-honeypot • https://open-awesome.com/projects/telnet-iot-honeypot • https://pentesttools.net/telnet-iot-honeypot-python-telnet-honeypot-for-catching-botnet-binaries/ • https://www.blog.brightcoding.dev/2026/02/23/sentinel-iot-the-essential-honeypot-turning-botnets-into-intelligence-gold • https://github.com/bhosaleatharv89/Hons_Intelligent_Honeypot • https://open-awesome.com/projects/mtpot • https://www.nozominetworks.com/blog/how-to-build-an-iot-honeypot