beehivesec/mailoney repository overview

⁠About

Mailoney is a SMTP Honeypot I wrote just to have fun learning Python. There are various modules or types (see below) that provide custom modes to fit your needs. Happily accepting advise, feature or pull requests.

⁠Installation

At this time, everything should be included in a Linux python environment. Simply follow the usage instructions.

NOTE: To get all of the features out of the schizo module, users may wish to install the python-libemu module, but Mailoney will run with out it.

⁠Usage

usage: mailoney.py [-h] [-i <ip address>] [-p <port>] -s mailserver -t
                   {open_relay,postfix_creds,schizo_open_relay}

Command line arguments

optional arguments:
  -h, --help            show this help message and exit
  -i <ip address>       The IP address to listen on
  -p <port>             The port to listen on
  -s mailserver         A Name that'll show up as the mail server name
  -t {open_relay,	Type of Honeypot 
  	postfix_creds,
  	schizo_open_relay}

⁠Types

Right now there are three types of Modules for Mailoney.

• open_relay - Just a generic open relay, will attempt to log full text emails attempted to be sent.
• postfix_creds - This module simply logs credentials from logon attempts.
• schizo_open_relay - This module logs everything, developed by @botnet_hunter⁠

⁠Running

SMTP ports 25, 465, 587 are privileged ports and therefore require elevated permissions (i.e. Sudo). It is probaby not a good idea to run your honeypot with elevated permissions. As such, I strongly encourage you to use port forwarding.

Setting this up is easy, lets say we want to run Mailoney on port 2525 (a nice non-priveleged port).

⁠IPTables example

We can redirect port 25 to port 2525 with IPtables: $ sudo iptables -t nat -A PREROUTING -p tcp --dport 25 -j REDIRECT --to-port 2525

⁠UFW example

If you are using UFW, you can edit before.rules (/etc/ufw/before.rules) by adding the following to the beginning:

*nat
-F
:PREROUTING ACCEPT [0:0]
-A PREROUTING -p tcp --dport 25 -j REDIRECT --to-port 2525
COMMIT

Then run ufw reload and you are all set.

⁠ToDo

• Add modules for EXIM, Microsoft, others
• Build in Error Handling
• Add a Daemon flag to background process.
• Secure this by not requiring elevated perms, port forward from port 25.
• Database logging
• Possible relay for test emails.
• Make honeypot detection more difficult (e.g. fuzz mailoney with SMTP commands, catch exceptions, patch and profit)