I've recently dug into my firewall logs and the most traffic I seem to receive from internet is targeting port 3389.
While I could just blacklist the source IPs and call it a day, I would like to actually listen on this port and "trap" them in a fake RDP connection.
There are tools like endlessh, and I've found that you can do the same for http by sending an endless stream of headers. I would like to do the same for RDP, and before I start digging into the whole spec, I was wondering if there is already something similar for RDP.
Is anyone aware of that ? Is that even a thing ?
10 Comments
Gooey0210@sh.itjust.works · 5 pts · 3y
You're looking for a honeypot Be careful with installing something like that with docker(or anything), docker is very unsafe
kylian0087@lemmy.world · 3 pts · 3y
Docker is not very unsafe at all. Although something like podman would be better.
520@kbin.social · 1 pts · 3y
It's not as safe as people expect it to be either. Container breakouts are very much a thing and not necessarily relegated to those that did something stupid in configurations
wgs@lemmy.sdf.org · 2 pts · 3y
Yeah that was my question. I never mentioned docker though ?
rookbrood@lemmy.world · 3 pts · 3y
Only thing that comes to mind is https://github.com/citronneur/rdpy
wgs@lemmy.sdf.org · 1 pts · 3y
That's more of a framework for RDP right ?
ghostface@lemmy.world · 1 pts · 3y
Is there a linuxserver.io but for infosec?
rookbrood@lemmy.world · 1 pts · 3y
No idea, I like to build/make my own.
pp99@sh.itjust.works · 2 pts · 3y
you can use iptables tarpit target. it works on the transport layer so it should work with any application layer protocol.
wgs@lemmy.sdf.org · 1 pts · 3y
I didn't know there was a tarpit target for iptables, that's neat. Unfortunately I run OpenBSD and pf so I can't use it, but I'll look into how it works to see if I can replicate it in my setup. Thanks !