Журнал лабораторных работ

65100   0     0 allow tcp from any to me dst-port 22 keep-state
65200   0     0 allow tcp from any to me dst-port 23
65300   8   480 allow ip from any to 192.168.15.110
65400   0     0 allow tcp from any to 192.168.15.110
65500 129 17080 allow tcp from me to any out keep-state
65500   6   448 reset log logamount 10 tcp from any to any
65500  13  1139 allow ip from any to any
65535  64  6845 deny ip from any to any

Honeyd V1.0 Copyright (c) 2002-2004 Niels Provos
honeyd[73301]: started with -d -i rl0 -f /usr/local/etc/honeyd.conf 192.168.15.110
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
honeyd[73301]: listening promiscuously on rl0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip and (host 192.168.15.110))) and not ether src 00:13:8f:2f:ac:5e
honeyd[73301]: Demoting process privileges to uid 32767, gid 32767
honeyd[73301]: Sending ICMP Echo Reply: 192.168.15.110 -> 192.168.15.24
honeyd[73301]: Sending ICMP Echo Reply: 192.168.15.110 -> 192.168.15.24
honeyd[73301]: Sending ICMP Echo Reply: 192.168.15.110 -> 192.168.15.24
honeyd[73301]: Connection request: tcp (192.168.15.24:56432 - 192.168.15.110:80)
honeyd[73301]: couldn't send packet: Permission denied
honeyd[73301]: couldn't send packet: Permission denied
honeyd[73301]: couldn't send packet: Permission denied
honeyd[73301]: couldn't send packet: Permission denied
honeyd[73301]: couldn't send packet: Permission denied
honeyd[73301]: couldn't send packet: Permission denied
honeyd[73301]: couldn't send packet: Permission denied
honeyd[73301]: couldn't send packet: Permission denied
^Choneyd[73301]: exiting on signal 2

65100   0     0 allow tcp from any to me dst-port 22 keep-state
65200   0     0 allow tcp from any to me dst-port 23
65300  25  1740 allow ip from any to 192.168.15.110
65400   0     0 allow tcp from any to 192.168.15.110
65500 417 44814 allow tcp from me to any out keep-state
65500  14   928 reset log logamount 10 tcp from any to any
65500  18  1584 allow ip from any to any
65535  64  6845 deny ip from any to any

65100  13  3688 allow tcp from any to me dst-port 22 keep-state
65200   0     0 allow tcp from any to me dst-port 23
65300  28  1884 allow ip from any to 192.168.15.110
65400   0     0 allow tcp from any to 192.168.15.110
65500 420 45210 allow tcp from me to any out keep-state
65500  14   928 reset log logamount 10 tcp from any to any
65500  19  1813 allow ip from any to any
65535  64  6845 deny ip from any to any

65400 allow ip from 192.168.15.110 to any

65100  13  3688 allow tcp from any to me dst-port 22 keep-state
65200   0     0 allow tcp from any to me dst-port 23
65300  28  1884 allow ip from any to 192.168.15.110
65400   0     0 allow ip from 192.168.15.110 to any
65500 420 45210 allow tcp from me to any out keep-state
65500  14   928 reset log logamount 10 tcp from any to any
65500  25  2281 allow ip from any to any
65535  64  6845 deny ip from any to any

Honeyd V1.0 Copyright (c) 2002-2004 Niels Provos
honeyd[73547]: started with -d -i rl0 -f /usr/local/etc/honeyd.conf 192.168.15.110
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
honeyd[73547]: listening promiscuously on rl0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip and (host 192.168.15.110))) and not ether src 00:13:8f:2f:ac:5e
honeyd[73547]: Demoting process privileges to uid 32767, gid 32767
honeyd[73547]: Connection request: tcp (192.168.15.24:55179 - 192.168.15.110:80)
honeyd[73547]: Connection established: tcp (192.168.15.24:55179 - 192.168.15.110:80) <-> /usr/local/share/honeyd/scripts/web.sh
honeyd[73547]: Expiring TCP (192.168.15.24:55179 - 192.168.15.110:80) (0x81d8c00) in state 7
^Choneyd[73547]: exiting on signal 2

Honeyd V1.0 Copyright (c) 2002-2004 Niels Provos
honeyd[73632]: started with -d -i rl0 -f /usr/local/etc/honeyd.conf --webserver-port 8080 192.168.15.110
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
honeyd[73632]: listening promiscuously on rl0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip and (host 192.168.15.110))) and not ether src 00:13:8f:2f:ac:5e
honeyd[73632]: Demoting process privileges to uid 32767, gid 32767
^Choneyd[73632]: exiting on signal 2

Honeyd V1.0 Copyright (c) 2002-2004 Niels Provos
honeyd[73674]: started with -d -i rl0 -f /usr/local/etc/honeyd.conf 192.168.15.110
Warning: Impossible SI range in Class fingerprint "IBM OS/400 V4R2M0"
Warning: Impossible SI range in Class fingerprint "Microsoft Windows NT 4.0 SP3"
honeyd[73674]: listening promiscuously on rl0: (arp or ip proto 47 or (udp and src port 67 and dst port 68) or (ip and (host 192.168.15.110))) and not ether src 00:13:8f:2f:ac:5e
honeyd[73674]: Demoting process privileges to uid 32767, gid 32767
^Choneyd[73674]: exiting on signal 2

 _________
< fortune >
 ---------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 ________________________________________
/ In Dr. Johnson's famous dictionary     \
| patriotism is defined as the last      |
| resort of the scoundrel. With all due  |
| respect to an enlightened but inferior |
| lexicographer I beg to submit that it  |
| is the first.                          |
|                                        |
| -- Ambrose Bierce, "The Devil's        |
\ Dictionary"                            /
 ----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 _______________________________________
/ Newpaper editors are men who separate \
| the wheat from the chaff, and then    |
| print the chaff.                      |
|                                       |
\ -- Adlai Stevenson                    /
 ---------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 ________________________________________
/ The world really isn't any worse. It's \
| just that the news coverage is so much |
\ better.                                /
 ----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 ________________________________________
/ The way to make a small fortune in the \
| commodities market is to start with a  |
\ large fortune.                         /
 ----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 _________________________________________
/ For my son, Robert, this is proving to  \
| be the high-point of his entire life to |
| date. He has had his pajamas on for     |
| two, maybe three days now. He has the   |
| sense of joyful independence a          |
| 5-year-old child gets when he suddenly  |
| realizes that he could be operating an  |
| acetylene torch in the coat closet and  |
| neither parent [because of the flu]     |
...
| Lumps o' Froot ("part of this complete  |
| breakfast").                            |
|                                         |
\ -- Dave Barry, "Molecular Homicide"     /
 -----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

 ________________________________________
/ I was playing poker the other night... \
| with Tarot cards. I got a full house   |
| and four people died.                  |
|                                        |
\ -- Steven Wright                       /
 ----------------------------------------
        \   ^__^
         \  (oo)\_______
            (__)\       )\/\
                ||----w |
                ||     ||

beavis.zen.cow          dragon.cow              kitty.cow               ren.cow                 telebears.cow
bong.cow                elephant-in-snake.cow   koala.cow               satanic.cow             three-eyes.cow
box.cow                 elephant.cow            kosh.cow                sheep.cow               turkey.cow
bud-frogs.cow           eyes.cow                luke-koala.cow          skeleton.cow            turtle.cow
bunny.cow               flaming-sheep.cow       mech-and-cow            small.cow               tux-stab.cow
cheese.cow              ghostbusters.cow        meow.cow                sodomized.cow           tux.cow
cower.cow               head-in.cow             milk.cow                stegosaurus.cow         udder.cow
daemon.cow              hellokitty.cow          moofasa.cow             stimpy.cow              vader-koala.cow
default.cow             jkh.cow                 moose.cow               supermilker.cow         vader.cow
dragon-and-cow.cow      kiss.cow                mutilated.cow           surgery.cow             www.cow

# Created by Brian Feldman <green@FreeBSD.org>
# Updated for content by Robert Watson <rwatson@FreeBSD.org>
#
$the_cow = "";
$the_cow .= "        $thoughts\n";
$the_cow .= "         $thoughts\n";
$the_cow .= "     .----------------------.\n";
$the_cow .= "    / \\                     |\\\n";
$the_cow .= "     \\ \\____________________|_\\\n";
$the_cow .= "     \\\\/\\______________________\\\n";
$the_cow .= "      \\| BOX O' STUPID PEOPLE |\n";
$the_cow .= "       `----------------------'\n";

##
## A cow wadvertising the World Wide Web, from lim@csua.berkeley.edu
##
$the_cow = <<EOC;
        $thoughts   ^__^
         $thoughts  ($eyes)\\_______
            (__)\\       )\\/\\
             $tongue ||--WWW |
                ||     ||
EOC

##
## An elephant out and about
##
$the_cow = <<EOC;
 $thoughts     /\\  ___  /\\
  $thoughts   // \\/   \\/ \\\\
     ((    O O    ))
      \\\\ /     \\ //
       \\/  | |  \\/
        |  | |  |
        |  | |  |
        |   o   |
        | |   | |
        |m|   |m|
EOC

##
## 4.4 >> 5.4
##
$the_cow = <<EOC;
   $thoughts         ,        ,
    $thoughts       /(        )`
     $thoughts      \\ \\___   / |
            /- _  `-/  '
           (/\\/ \\ \\   /\\
           / /   | `    \\
...
             `-----' /
<----.     __ / __   \\
<----|====O)))==) \\) /====
<----'    `--' `.__,' \\
             |        |
              \\       /
        ______( (_  / \\______
      ,'  ,-----'   |        \\
      `--{__________)        \\/
EOC

       the path specified in the COWPATH environment variable.   To  list  all
NAME
       cowsay/cowthink - configurable speaking/thinking cow (and a bit more)
SYNOPSIS
       cowsay  [-e  eye_string] [-f cowfile] [-h] [-l] [-n] [-T tongue_string]
       [-W column] [-bdgpstwy]
DESCRIPTION
       Cowsay generates an ASCII picture of a cow saying something provided by
       the  user.   If run with no arguments, it accepts standard input, word-
       wraps the message given at about 40 columns, and prints the cow  saying
...
       The  user  may  specify  the  -e option to select the appearance of the
       cow's eyes, in which case the first  two  characters  of  the  argument
       string eye_string will be used.  The default eyes are 'oo'.  The tongue
       is similarly configurable through -T and tongue_string; it must be  two
       characters  and does not appear by default.  However, it does appear in
       the 'dead' and 'stoned' modes.  Any configuration done  by  -e  and  -T
       will be lost if one of the provided modes is used.
       The  -f option specifies a particular cow picture file (``cowfile'') to
       use.  If the cowfile spec contains '/' then it will be interpreted as a
       path  relative to the current directory.  Otherwise, cowsay will search

 _______
< domoy >
 -------
   \         ,        ,
    \       /(        )`
     \      \ \___   / |
            /- _  `-/  '
           (/\/ \ \   /\
           / /   | `    \
           O O   ) /    |
...
           `.___/`    /
             `-----' /
<----.     __ / __   \
<----|====O)))==) \) /====
<----'    `--' `.__,' \
             |        |
              \       /
        ______( (_  / \______
      ,'  ,-----'   |        \
      `--{__________)        \/

beavis.zen.cow          dragon.cow              kitty.cow               ren.cow                 telebears.cow
bong.cow                elephant-in-snake.cow   koala.cow               satanic.cow             three-eyes.cow
box.cow                 elephant.cow            kosh.cow                sheep.cow               turkey.cow
bud-frogs.cow           eyes.cow                luke-koala.cow          skeleton.cow            turtle.cow
bunny.cow               flaming-sheep.cow       mech-and-cow            small.cow               tux-stab.cow
cheese.cow              ghostbusters.cow        meow.cow                sodomized.cow           tux.cow
cower.cow               head-in.cow             milk.cow                stegosaurus.cow         udder.cow
daemon.cow              hellokitty.cow          moofasa.cow             stimpy.cow              vader-koala.cow
default.cow             jkh.cow                 moose.cow               supermilker.cow         vader.cow
dragon-and-cow.cow      kiss.cow                mutilated.cow           surgery.cow             www.cow

: /usr/src/bin/
name=webserver:

: /usr/src/bin/
-name:
webserver:

config.py       graphs          images          index.py        styles          templates

cgi-bin         cgi-bin-dist    data            data-dist       icons           proxy

EXAMPLE_DIRECTORY-DONT_ADD_OR_TOUCH_ANYTHING    index.html.lb.utf8
apache_pb.gif                                   index.html.nl
index.html.ca                                   index.html.nn
index.html.cz                                   index.html.no
index.html.de                                   index.html.po.iso-pl
index.html.dk                                   index.html.pt
index.html.ee                                   index.html.pt-br
index.html.el                                   index.html.ru.cp-1251
index.html.en                                   index.html.ru.cp866
index.html.es                                   index.html.ru.iso-ru
index.html.fr                                   index.html.ru.koi8-r
index.html.he.iso8859-8                         index.html.ru.ucs2
index.html.hu                                   index.html.ru.ucs4
index.html.it                                   index.html.ru.utf8
index.html.ja.jis                               index.html.se
index.html.kr.iso-kr                            index.html.zh-tw.big5

config.py       graphs          images          index.py        styles          templates

total 16
drwxr-xr-x  6 root  wheel   512 Dec 23 14:19 .
drwxr-xr-x  3 root  wheel   512 Dec 23 14:19 ..
-rw-r--r--  1 root  wheel   833 Sep 14  2004 config.py
drwxr-xr-x  2 root  wheel   512 Dec 23 14:19 graphs
drwxr-xr-x  2 root  wheel   512 Dec 23 14:19 images
-rw-r--r--  1 root  wheel  1445 Dec  6  2004 index.py
drwxr-xr-x  2 root  wheel   512 Dec 23 14:19 styles
drwxr-xr-x  3 root  wheel   512 Dec 23 14:19 templates

import time
import support
from htmltmpl import TemplateManager, TemplateProcessor
self.send_response(200)
self.send_header("Content-Type", "text/html")
self.send_nocache()
self.end_headers()
# Process commands given to us
message = support.parse_query(self.query)
# Compile or load already precompiled template.
...
content = "Welcome to the Honeyd Configuration Interface.<p>"
content += support.config_table()
content += "<p>"
content += support.config_ips(self.root)
if message:
    tproc.set("message", message)
tproc.set("content", content)
tproc.set("uptime", support.uptime())
# Print the processed template.
self.wfile.write(tproc.process(template))

#scp /tmp/

.ICE-unix/              .xf86config7238/        ad1                     lm-saved-51667          screens/
.X0-lock                .xf86config7247/        arp.log                 lm-saved-8516           scrollkeeper-user/
.X11-unix/              .xf86config7256/        ipfwshow                log                     vi.psnSHG4Ux6
.XIM-unix/              Term-VT102-0.82/        kde-root/               mcop-root/
.font-unix/             Term-VT102-0.82.tar.gz  kde-user/               mcop-user/
.snap/                  Text-Iconv-1.4/         ksocket-root/           mysql.sock
.vi                     Text-Iconv-1.4.tar.gz   ksocket-user/           pipe

#cat /tmp/a

ad1      arp.log

get /

Password:
log                                                                                                     100%    6     0.0KB/s   00:00

Password:
Last login: Fri Dec 23 17:09:17 2005 from linux.nt
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
        The Regents of the University of California.  All rights reserved.
FreeBSD 6.0-RELEASE (GENERIC) #0: Thu Nov  3 09:36:13 UTC 2005
Welcome to FreeBSD!
Before seeking technical support, please use the following resources:
o  Security advisories and updated errata information for all releases are
   at http://www.FreeBSD.org/releases/ - always consult the ERRATA section
   for your release first as it's updated frequently.
o  The Handbook and FAQ documents are at http://www.FreeBSD.org/ and,
   along with the mailing lists, can be searched by going to
   http://www.FreeBSD.org/search/.  If the doc distribution has
   been installed, they're also available formatted in /usr/share/doc.
If you still have a question or problem, please take the output of
`uname -a', along with any relevant error messages, and email it
as a question to the questions@FreeBSD.org mailing list.  If you are
unfamiliar with FreeBSD's directory layout, please refer to the hier(7)
manual page.  If you are not familiar with manual pages, type `man man'.
You may also use sysinstall(8) to re-enter the installation and
configuration utility.  Edit /etc/motd to change this login announcement.

#cat /tmp/

.ICE-unix/              Term-VT102-0.82/        kde-user/               mcop-root/              scrollkeeper-user/
.X0-lock                Term-VT102-0.82.tar.gz  ksocket-root/           mcop-user/              swatch.log
.X11-unix/              Text-Iconv-1.4/         ksocket-user/           mysql.sock
.XIM-unix/              Text-Iconv-1.4.tar.gz   log                     nessus-0gaHq6
.font-unix/             arp.log                 mc-root/                nessus-mkcert.19557/
.snap/                  kde-root/               mc-user/                pthread.dump.14351.0

get /

exit
Connection to fbsd4.linux.nt closed.

exit

65535 36 2307 deny ip from any to any

Are you sure? [yn] y
Flushed all rules.

65535 117 7516 deny ip from any to any

65000 allow ip from any to any

PING ya.ru (213.180.204.8): 56 data bytes
64 bytes from 213.180.204.8: icmp_seq=0 ttl=50 time=142.007 ms
64 bytes from 213.180.204.8: icmp_seq=1 ttl=50 time=139.387 ms
^C
--- ya.ru ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 139.387/140.697/142.007/1.310 ms

You have new mail in /var/mail/user