I Cannot Find My Honeyd Logs In Kali Linux

hi there once again
Now I am getting this problem which running the cmd "honeyd -d -f honeyd.conf"
root@kali:/etc/honeypot# honeyd -d -f honeyd.conf
Honeyd V1.5c Copyright (c) 2002-2007 Niels Provos
honeyd[4726]: started with -d -f honeyd.conf
honeyd[4726]: listening promiscuously on eth0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip )) and not ether src 98:4b:e1:94:62:46
honeyd[4726]: [eth0] trying DHCP
honeyd[4726]: Demoting process privileges to uid 65534, gid 65534
honeyd[4726]: [eth0] got DHCP offer: 192.168.23.2
honeyd[4726]: Updating ARP binding: 00:00:24:26:26:1d -> 192.168.23.2
honeyd[4726]: arp reply 192.168.23.2 is-at 00:00:24:26:26:1d
honeyd[4726]: TTL exceeded for dst 224.0.0.22 at gw 10.0.0.1
honeyd[4726]: No reverse routing map for 10.0.0.1
honeyd[4726]: TTL exceeded for dst 224.0.0.22 at gw 10.0.0.1
honeyd[4726]: No reverse routing map for 10.0.0.1
honeyd[4726]: TTL exceeded for dst 224.0.0.22 at gw 10.0.0.1
honeyd[4726]: No reverse routing map for 10.0.0.1
honeyd[4726]: TTL exceeded for dst 224.0.0.22 at gw 10.0.0.1
honeyd[4726]: No reverse routing map for 10.0.0.1

what does it mean? because it starts to spam the terminal with such errors. or it is not??

I think, I have to edit the "honeyd.conf" file, but no clue.
the following is my honeyd configuration.

route entry 10.0.0.1
route 10.0.0.1 link 10.2.0.0/24
route 10.0.0.1 add net 10.3.0.0/16 10.3.0.1 latency 8ms bandwidth 10Mbps
route 10.3.0.1 link 10.3.0.0/24
route 10.3.0.1 add net 10.3.1.0/24 10.3.1.1 latency 7ms loss 0.5
route 10.3.1.1 link 10.3.1.0/24

# Example of a simple host template and its binding
create template
set template personality "Microsoft Windows XP Professional SP1"
set template uptime 1728650
set template maxfds 35
# For a complex IIS server
add template tcp port 80 "sh /usr/share/honeyd/scripts/win32/web.sh"
add template tcp port 22 "/usr/share/honeyd/scripts/test.sh $ipsrc $dport"
add template tcp port 23 proxy $ipsrc:23
add template udp port 53 proxy 141.211.92.141:53
set template default tcp action reset
# Use this if you are not running honeyd as 'honeyd' user:
# Debian-specific (use nobody = 65534 instead of 32767)
# set template uid 65534 gid 65534

create default
set default default tcp action block
set default default udp action block
set default default icmp action block

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action reset
add windows tcp port 135 open
add windows tcp port 139 open
add windows tcp port 445 open

set windows ethernet "00:00:24:ab:8c:12"
dhcp windows on eth0


urgent help needed please. thanks in advance

Hello there,
First of all thank you for making me a part of this forum.
Secondly, here is the problem..
I am facing this problem in honeyd installation during "make"

root@kali:~/Desktop/Narayan/honeyd-1.5c# sudo make
make all-recursive
make[1]: Entering directory `/root/Desktop/Narayan/honeyd-1.5c'
Making all in .
make[2]: Entering directory `/root/Desktop/Narayan/honeyd-1.5c'
gcc -DHAVE_CONFIG_H -I. -I. -I. -I./ -I./compat -I/usr/local/include -I/usr/local/include -I/usr/local/include -O2 -Wall -g -DPATH_HONEYDINCLUDE="\"/usr/local/include/honeyd\"" -DPATH_HONEYDDATA="\"/usr/local/share/honeyd\"" -DPATH_HONEYDLIB="\"/usr/local/lib/honeyd\"" -DHONEYD_PLUGINS_DECLARE="" -DHONEYD_PLUGINS="" -DPATH_RRDTOOL="\"\"" -c honeyd.c
In file included from honeyd.c:97:0:
tagging.h:89:6: error: expected declaration specifiers or ‘...’ before ‘(’ token
tagging.h:89:6: error: expected declaration specifiers or ‘...’ before ‘(’ token
In file included from stats.h:36:0,
from honeyd.c:98:
./compat/sha1.h:23:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
./compat/sha1.h:23:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
./compat/sha1.h:26:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
./compat/sha1.h:28:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
./compat/sha1.h:30:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
./compat/sha1.h:32:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
./compat/sha1.h:35:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
./compat/sha1.h:35:3: warning: ‘__bounded__’ attribute directive ignored [-Wattributes]
make[2]: *** [honeyd.o] Error 1
make[2]: Leaving directory `/root/Desktop/Narayan/honeyd-1.5c'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/root/Desktop/Narayan/honeyd-1.5c'
make: *** [all] Error 2

I found a similar thread in this forum as well to solve the above problem by using "apt-get install honeyd" but didnt quite worked for me.

root@kali:~/Desktop/Narayan/honeyd-1.5c# apt-get install honeyd
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Unable to locate package honeyd


I tried researching but couldnt find any solutions. Moreover, I am really a newbie at Kali Linux and other debians as well.
I would appreciate if somone could help me.
Thank you.

Hi all

I am trying out this dhcp server setup on opensuse 12.1 but it does not seem to be working.

I have eth0 configured to be 192.168.10.1 in a /24 network.

I want to hand out the rest of the address in the same subnet as dhcp addresses. (So everything from 10.2 to 10.255). The default gw is defined as 192.168.10.1, and routing table looks correct. and I only have eth0.


When I start the dhcp, and connect it to the client machine, I see nothing on the wireshark trace. no DHCP discovery or ack messages. And the client machine just keeps trying boot from the network via the network interface. I know I got the right interface (there were blinky options in the bios that lets you identify the correct interface) and the cable is not a problem. (If the cable were a problem the client boot message would say "media fault ... please check media...") instead.

Here is my dhcpd.conf file. I went through man dhcpd already, and cleaned out everything that I apparently don't need. (The original file was copied from a more complicated setup that had multiple subnets and dhcp relays.)

Code:

###################simplfied 
linux-kzy1:/var/lib/dhcp/db # cat /etc/dhcpd.conf
authoritative;

ddns-update-style none;
ddns-updates off;

#Information about the host
subnet 192.168.10.0 netmask 255.255.255.0 {
  max-lease-time 600;
  default-lease-time 600;
  range 192.168.10.2 192.168.10.255;
}

group esx_gep{
  filename "pxelinux.0";
  next-server 192.168.10.1; 
  host testserver1 {hardware ethernet a0:d3:c1:f7:f2:64;}
}

this is what /var/log/message and /var/log/rc.dhcpd.log says:
Code:

**************var log message
Mar 19 18:42:17 linux-kzy1 dhcpd: For info, please visit https://www.isc.org/software/dhcp/
Mar 19 18:42:17 linux-kzy1 dhcpd: Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 group decls to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 deleted host decls to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 new dynamic host decls to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 leases to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Listening on LPF/eth0/84:8f:69:cf:7c:41/192.168.10.0/24
Mar 19 18:42:17 linux-kzy1 dhcpd: Sending on   LPF/eth0/84:8f:69:cf:7c:41/192.168.10.0/24
Mar 19 18:42:17 linux-kzy1 dhcpd: Sending on   Socket/fallback/fallback-net
Mar 19 18:42:17 linux-kzy1 dhcpd[12233]: Starting ISC DHCPv4 4.x Server [chroot]..done
linux-kzy1:/home/test/Documents #


*****************var log rc.dhcpd.log
Mar 19 18:42:17 linux-kzy1 dhcpd: Internet Systems Consortium DHCP Server 4.2.2
Mar 19 18:42:17 linux-kzy1 dhcpd: Copyright 2004-2011 Internet Systems Consortium.
Mar 19 18:42:17 linux-kzy1 dhcpd: All rights reserved.
Mar 19 18:42:17 linux-kzy1 dhcpd: For info, please visit https://www.isc.org/software/dhcp/
Mar 19 18:42:17 linux-kzy1 dhcpd: Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 group decls to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 deleted host decls to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 new dynamic host decls to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Wrote 0 leases to leases file.
Mar 19 18:42:17 linux-kzy1 dhcpd: Listening on LPF/eth0/84:8f:69:cf:7c:41/192.168.10.0/24
Mar 19 18:42:17 linux-kzy1 dhcpd: Sending on   LPF/eth0/84:8f:69:cf:7c:41/192.168.10.0/24
Mar 19 18:42:17 linux-kzy1 dhcpd: Sending on   Socket/fallback/fallback-net
Mar 19 18:42:17 linux-kzy1 dhcpd[12233]: Starting ISC DHCPv4 4.x Server [chroot]..done
linux-kzy1:/home/test/Documents #

not very interesting stuff or useful, but I found some other messages that is very interesting:

Code:

**********
#no free lease

linux-kzy1:/home/test/Documents # cat /var/log/messages | grep "free lease"
Mar 19 15:53:59 linux-kzy1 dhcpd: DHCPDISCOVER from a0:d3:c1:f7:f2:64 via eth0: network 192.168.10.0/24: no free leases
Mar 19 15:54:03 linux-kzy1 dhcpd: DHCPDISCOVER from a0:d3:c1:f7:f2:64 via eth0: network 192.168.10.0/24: no free leases
Mar 19 15:54:11 linux-kzy1 dhcpd: DHCPDISCOVER from a0:d3:c1:f7:f2:64 via eth0: network 192.168.10.0/24: no free leases
......
Mar 19 17:01:06 linux-kzy1 dhcpd: DHCPDISCOVER from a0:d3:c1:f7:f2:64 via eth0: network 192.168.10.0/24: no free leases
Mar 19 17:01:38 linux-kzy1 dhcpd: DHCPDISCOVER from a0:d3:c1:f7:f2:64 via eth0: network 192.168.10.0/24: no free leases
linux-kzy1:/home/test/Documents #

Which ties into my first question: dhcp no free lease: I googled a bit, I found a post from a guy on ubuntu who has the same error message and the suggested course of action is to change ownership of the lease file to dhcpd and give it 777 for permission. Which I thought is weird, because the lease file is automatically created by the dhcpd itself, so it really shouldn't be a permission issue shouldn't it? (Anyway, tried that didn't do a thing.) right now it is owned by root/root and has this permission: -rw-r--r--.

2nd question: once the client gets a reply from my dhcp server saying no free lease, does it remember this dhcp server as no free lease and does it persist throughout reboots? Because I tried rebooting the client a number of times and I don't see anything on the wireshark at all. You will notice the time stamp on the last "no free lease" message is not as late as the other messages from the var/log/messages or rc.dhcpd.log and I rebooted the client and the dhcp plenty of times since 17:01:38.



Thanks for all your help in advance everyone.

Hi,

I'm on WMware workstation with debian Wheezy.
I have a problem when a restart the Dchp.
It said Bad subnet number/mask combination.

This is logs:

root@debian-main:/# /etc/init.d/isc-dhcp-server restart
dhcpd self-test failed. Please fix /etc/dhcp/dhcpd.conf.
The error was:
Internet Systems Consortium DHCP Server 4.3.1
Copyright 2004-2014 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
Config file: /etc/dhcp/dhcpd.conf
Database file: /var/lib/dhcp/dhcpd.leases
PID file: /var/run/dhcpd.pid
/etc/dhcp/dhcpd.conf line 50: subnet 192.168.10.1 netmask 255.255.255.0: bad subnet number/mask combination.
subnet 192.168.10.1 netmask 255.255.255.0{
^
Configuration file errors encountered -- exiting

If you think you have received this message due to a bug rather
than a configuration issue please read the section on submitting
bugs on either our web page at www.isc.org or in the README file
before submitting a bug. These pages explain the proper
process and the information we find helpful for debugging..

exiting.

And this my file dhcpd.conf:

# A slightly different configuration for an internal subnet.
subnet 192.168.10.1 netmask 255.255.255.0{
range 192.168.10.1 192.168.10.15;
# option domain-name-servers ns1.internal.example.org;
# option domain-name "internal.example.org";
option routers 192.168.10.254;
option broadcast-address 192.168.10.255;
default-lease-time 600;
max-lease-time 7200;
}

For me it's the good subnet number/mask combination.

Can you help me please?

Thanks you,

Pierrick

Hi,

I tried to configure my ethernet interface on a Debian Wheezy VM, but I've a problem. When I try to restart /etc/init.d/networking, I've no error message.
But my eth1 interface isn't up and when I try to up it with : ifup eth1, it return me :

Code:

root@debian-main:/# ifup eth1
RTNETLINK answers: File exists
Failed to bring up eth1

My /etc/network/interface file is :

Code:

auto eth0
allow-hotplug eth0
iface eth0 inet dhcp


iface eth1 inet static
        address 192.168.10.1
        netmask 255.255.255.0
        gateway 192.168.10.254

Eth0 is my internet interface and eth1 is a local interface. I want to install a DNS and a DHCP server on eth1 to be able to connect client with this VM and give them an ip adress.

Thanks guys

Hello,

They gave me this:
Code:

#!/bin/bash

# Write error message on stderr and die
function die() {
  echo "$@" >&2
  exit 1
}

# Load var from properties files
function load() {
  for propertie in "$@" ; do
    [[ -f "${propertie}" ]] || die "load() : \"${propertie}\" don't exist !"
    while read ; do
echo "${REPLY%=*}"
echo "${REPLY#*=}"
      [[ -n "${REPLY%%=*}" && -z "${REPLY#*=}" ]] || die "load() : Variable \"${REPLY%%=*}\" is empty!"
      eval "${REPLY%%=*}"=\'"${REPLY#*=}"\'
    done < "${propertie}"
  done
}

load "manage_srcds.conf"
echo "SRCDS_TICKRATE=$SRCDS_TICKRATE"
echo "SRCDS_SCREEN=$SRCDS_SCREEN"
echo "SRCDS_SRCDS_GAME_NAME=$SRCDS_GAME_NAME"
echo "SRCDS_MAXPLAYERS=$SRCDS_MAXPLAYERS"

but, return:
Quote:
###################################################
###################################################
load() : Variable "###################################################" is empty!

cat manage_srcds.conf

I just wish that there was no empty variable excluding those who do not have integer.

Best regards,

Hi,

i am trying the run a ftp daemon on my board (sbc6000x) but it seems that the ftpd service is never started by inetd.conf.

My inetd.conf is :

Code:

#<service_name>	<sock_type>	<proto>	<flags> <user> 	<server_path> 	<args> 

ftp			stream		tcp		nowait	root	/usr/bin/ftpd ftpd -w
telnet			stream		tcp		nowait	root    /usr/sbin/telnetd

Telnet don't run too but this is because i am missing some folders and i can launch it manually after creating the folders without issue, but maybe the fact that it can't run telnet because of the missing folders make it stop trying the ftp daemon ?

I check with the command "ps", the processus is not running hidden anywhere.

Hello,

I try to use a ftp daemon and a Telnet daemon with inetd and the BusyBox v1.19.0 on a linux 2.6.24.

When running inetd and then checking what is listening with "netstat -an |grep LISTEN" i have :
Code:

netstat: /proc/net/tcp6: No such file or directory
netstat: /proc/net/udp6: No such file or directory
netstat: /proc/net/raw6: No such file or directory
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN

ftp port 21 and Telnet port 23 seems to be listening.

My inetd.conf file is :

Code:

#<service_name>    <sock_type>    <proto>    <flags> <user>     <server_path>     <args> 

21 stream tcp nowait root ftpd ftpd /etc
telnet            stream        tcp        nowait    root    /usr/sbin/telnetd

I have no rule in my hosts.deny so nothing should be stopped and i have no iptables firewall in place too.

When typing "ftp://ipofthetarget" in a web browser i have a error :

Code:

504 Gateway Timeout
Gateway timeout expired while waiting for server response.

And when trying to Telnet from another computer or "Telnet localhost" from the board i have :
Code:

# telnet 10.2.29.201
Trying 10.2.29.201...
connected to 10.2.29.201.
Escape character is '^]'

Connection closed by foreign host.

This would mean that the connection for Telnet exist but why is it closing ?

Thank you for your future answers !

UPDATE 1 :
If i try to run telnetd like this :
/usb/sbin/telnet -l /bin/sh
i can connect anonymously from another computer, not perfect because i would like a user/password but still of use.
The problem with the ftp daemon still exist.

UPDATE 2 :
Trying from Windows cmd or linux terminal : ftp ipofthetarget seems to work
Not perfect because i would like a user/password too but still of use.

I am still open for suggestion for the user/password thing. I am not deleting the thread in case someone interested about this exist.

I have a Kubuntu install that works fine but for some reason, it grows the logs into hundreds of GBs.

Is there a method to prevent those logs from growing so large? I researched "log rotate" but I couldn't understand it.

I would like something established such that after a certain size, the logs are automatically deleted so I don't have to do it manually each time.

How would I do so?

Here are the logs:

#1: /var/log/syslog
#2: /var/log/kern.log

I already determined I don't need them, so I would like to auto-delete them once they reach a certain size.

Thank you.

Hi,
i'm new in kali linux.
i have an issue with the wifi connections.
installing the newwst version of kali from the official website on virtual box.
plug the USB wireless adapter (TP-LINK).
also, i noticed wlan0 on #ifconfig command.
on the network setting configure NAT (also tried with NAT bridged)

my problem is that - i cannot see any wireless networks.
i followed few guides from youtube and here but with no luck.
it show me that i'm wired connected.
i attached screenshot bellow.
please kindly assist me.


additional information:
#airmon-ng start wlan0
when i type #ifconfig, i saw that wlan0 changed to wlan0mon
and with#airodump-ng command on wlan0mon i didn't see any wireless network as well


iwconfig
Quote:
root@kali:~# iwconfig
eth0 no wireless extensions.

wlan0 IEEE 802.11bgn ESSIDff/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry short limit:7 RTS thrff Fragment thrff
Encryption keyff
Power Managementff

lo no wireless extensions.
lsmod
Quote:
root@kali:~# lsmod | grep rt
rt2800usb 26222 0
rt2x00usb 17642 1 rt2800usb
rt2800lib 81543 1 rt2800usb
rt2x00lib 46315 3 rt2x00usb,rt2800lib,rt2800usb
mac80211 511777 3 rt2x00lib,rt2x00usb,rt2800lib
cfg80211 425751 2 mac80211,rt2x00lib
crc_ccitt 12347 1 rt2800lib
parport_pc 26287 0
parport 35699 1 parport_pc
usbcore 199549 7 rt2x00usb,ohci_hcd,ohci_pci,rt2800usb,ehci_hcd,ehci_pci,usbhid
lsusb
Quote:
root@kali:~# lsusb
Bus 001 Device 003: ID 148f:3070 Ralink Technology, Corp. RT2870/RT3070 Wireless Adapter
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 003: ID 80ee:0021 VirtualBox USB Tablet
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
ifconfig

Quote:
root@kali:~# ifconfig
eth0 Link encap:Ethernet HWaddr 08:00:27:dc:d0:01
inet addr:192.168.1.22 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::a00:27ff:fedc:d001/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:68 errors:0 dropped:0 overruns:0 frame:0
TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:7485 (7.3 KiB) TX bytes:4163 (4.0 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:20 errors:0 dropped:0 overruns:0 frame:0
TX packets:20 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1200 (1.1 KiB) TX bytes:1200 (1.1 KiB)

wlan0 Link encap:Ethernet HWaddr 90:f6:52:10:0f:d2
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
iw wlan0 info
Quote:
root@kali:~# iw wlan0 info
Interface wlan0
ifindex 4
type managed
wiphy 1
iwlist scan
Quote:
root@kali:~# iwlist scan
eth0 Interface doesn't support scanning.

wlan0 No scan results

lo Interface doesn't support scanning.
uname -a
Quote:
root@kali:~# uname -a
Linux kali 3.18.0-kali3-amd64 #1 SMP Debian 3.18.6-1~kali2 (2015-03-02) x86_64 GNU/Linux
cat /etc/network/interfaces
Quote:
root@kali:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet dhcp
thanks