Provided commands

• /usr/bin/env - current environment variables

• /usr/bin/gcc - fake compiler with file output

• /sbin/iptables - fake firewall management, supports flush and list for different tables/chains

• /bin/which - path of binary

• /bin/netstat - work in progress

• /bin/sleep - sleep command

• /bin/uname - kernel and OS identification

The commands are based on the x64 build of Debian 5.

Installation

Please read the full installation part.

Python 2.7 or later is required (Python 3.x isn’t). Install kippo-extra via one of the methods below.

• pip install kippo-extra

• pip install git+git://github.com/basilfx/kippo-extra.git.

To check if everything works, you can run python -c 'import kippo_extra' which should not produce any errors.

Kippo doesn’t come with a plugin system. Therefore, the kippo source should be modified. Open the file KIPPO_ROOT/kippo/__init__.py. By default, it is an empty file. Insert the line from kippo_extra import loader and save the file.

Known issues

Probably a lot. Of course, not all commands are complete and are functional. I have implemented the basic options to make an honeypot session more realistic.

Feel free to fork or submit issues!

License

See the LICENSE file (MIT license).

This work uses of some code of Merge-in-Memory by Daniel Moniz.