Nepenthes Installation

I've been interested in trying Nepenthes since I saw it added to the FreeBSD ports collection as net/nepenthes. According to the Nepenthes Web site, "Nepenthes is a versatile tool to collect malware. It acts passively by emulating known vulnerabilities and downloading malware trying to exploit these vulnerabilities."

I tried to install Nepenthes using the precompiled package for FreeBSD, like this:

janney:/root# setenv PACKAGESITE  ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6-stable/Latest/

janney:/root# pkg_add -vr nepenthes

I ran into two problems. First, I had to install the ftp/curl port manually since the package seemed unavailable.

cd /usr/ports/ftp/curl
make
make install

Second, and more problematic, I found that the package which offered Nepenthes 0.1.5 did not work properly. Using the package, I could not get my Nepenthes client to connect to a specific IRC channel protected by a key.

I decided to install Nepenthes using the FreeBSD port. I made these changes to make the ports tree install version 0.1.6 instead of the older 0.1.5:

janney:/usr/ports/net/nepenthes# diff Makefile.orig Makefile
9c9
< PORTVERSION=  0.1.5
---
> PORTVERSION=  0.1.6
janney:/usr/ports/net/nepenthes# diff distinfo.orig distinfo
1,3c1,3
< MD5 (nepenthes-0.1.5.tar.gz) = d7eae244a5adef66ca504a233f1c51e1
< SHA256 (nepenthes-0.1.5.tar.gz) = 7c74614cb3027f0c9a409f68ed81baed4793673509e09138bd6296d72b04b08a
< SIZE (nepenthes-0.1.5.tar.gz) = 780788
---
> MD5 (nepenthes-0.1.6.tar.gz) = 317afd3dc86d57a22570632bdf839ef2
> SHA256 (nepenthes-0.1.6.tar.gz) = f9bae290d49df9658b7f27a2f4c304fd671cc1f2f344a3b960a181c12416d94b
> SIZE (nepenthes-0.1.6.tar.gz) = 794938

Once Nepenthes was installed, I began editing configuration files in /usr/local/etc/nepenthes.

First I edited log-irc.conf to log to my IRC channel of choice.

janney:/usr/local/etc/nepenthes# diff log-irc.conf.orig log-irc.conf
21,23c21,23
<             nick        "nep-noname";
<             ident       "nepenthes";
<             userinfo    "http://nepenthes.sf.net";
---
>             nick        "mynep";
>             ident       "mynep";
>             userinfo    "mynep";
29,30c29,30
<             name    "#nepenthesirc";
<             pass    "foo";
---
>              name    "#myfakeircchannel";
>              pass    "myfakepw";

Note that the default log-irc.conf wants to use Tor. I show how I set that up in a future post. To disable using Tor, change

    use-tor     "1";

to

    use-tor     "0";

Next I made changes to nepenthes.conf to reflect using /var/log instead of var/log.

janney:/usr/local/etc/nepenthes# diff nepenthes.conf.dist nepenthes.conf
91,92c91,92
<       ring_logging_file               "var/log/nepenthes/nepenthes.%d.log";
<       file_logging_file               "var/log/nepenthes/nepenthes.log";
---
>       ring_logging_file               "/var/log/nepenthes/nepenthes.%d.log";
>       file_logging_file               "/var/log/nepenthes/nepenthes.log";
104c104
<         filesdir                    "var/nepenthes/binaries/"; 
---
>         filesdir                    "/var/nepenthes/binaries/"; 
120c120
<       hexdump_path                "var/nepenthes/hexdumps/";
---
>       hexdump_path                "/var/nepenthes/hexdumps/";
125c125
<       cache_path                   "var/cache/nepenthes/geolocation/";
---
>       cache_path                   "/var/cache/nepenthes/geolocation/";

I made similar changes to log-download.conf.

janney:/usr/local/etc/nepenthes# diff log-download.conf.orig log-download.conf
3,4c3,4
<     downloadfile    "var/log/logged_downloads"; // log download attempts
<     submitfile    "var/log/logged_submissions"; // log successfull downloads
---
>     downloadfile    "/var/log/logged_downloads"; // log download attempts
>     submitfile    "/var/log/logged_submissions"; // log successfull downloads

And submit-file.conf:

janney:/usr/local/etc/nepenthes# diff submit-file.conf.orig submit-file.conf
3c3
<     path "var/binaries/";
---
>     path "/var/nepenthes/binaries/";

And submit-norman.conf:

janney:/usr/local/etc/nepenthes# diff submit-norman.conf.orig submit-norman.conf 
4c4
<       email   "malware@mac.com";
---
>       email   "myemail@gmail.com";

download-nepenthes.conf needed a more radical change because I don't have /share/hda3/opt/ on FreeBSD.

janney:/usr/local/etc/nepenthes# diff download-nepenthes.conf.orig download-nepenthes.conf
5c5
<     filespath       "/share/hda3/opt/nepenthes";
---
>     filespath       "/var/nepenthes/";

Next I create directories needed by Nepenthes.

janney:/root# mkdir -p /var/nepenthes/binaries
janney:/root# mkdir /var/log/nepenthes
janney:/root# touch /var/log/nepenthes/nepenthes.log

When done I was able to start Nepenthes with the simple command 'nepenthes'. I recommend running it in the foreground within script(1). By default Nepenthes generates a ton of debug info.

As configured, Nepenthes is listening on a slew of ports:

janney:/usr/local/etc/rc.d# sockstat -4 | grep nep
root     nepenthes  7669  3  udp4   *:50838               *:*
root     nepenthes  7669  6  tcp4   *:21                  *:*
root     nepenthes  7669  7  tcp4   *:25                  *:*
root     nepenthes  7669  8  tcp4   *:110                 *:*
root     nepenthes  7669  9  tcp4   *:143                 *:*
root     nepenthes  7669  10 tcp4   *:220                 *:*
root     nepenthes  7669  11 tcp4   *:465                 *:*
root     nepenthes  7669  12 tcp4   *:993                 *:*
root     nepenthes  7669  13 tcp4   *:995                 *:*
root     nepenthes  7669  14 tcp4   *:2745                *:*
root     nepenthes  7669  15 tcp4   *:6129                *:*
root     nepenthes  7669  16 tcp4   *:135                 *:*
root     nepenthes  7669  17 tcp4   *:445                 *:*
root     nepenthes  7669  18 tcp4   *:1025                *:*
root     nepenthes  7669  19 tcp4   *:443                 *:*
root     nepenthes  7669  20 tcp4   *:17300               *:*
root     nepenthes  7669  21 tcp4   *:2103                *:*
root     nepenthes  7669  22 tcp4   *:2105                *:*
root     nepenthes  7669  23 tcp4   *:2107                *:*
root     nepenthes  7669  24 tcp4   *:3372                *:*
root     nepenthes  7669  25 udp4   *:1434                *:*
root     nepenthes  7669  26 tcp4   *:3127                *:*
root     nepenthes  7669  27 tcp4   *:139                 *:*
root     nepenthes  7669  28 tcp4   *:3140                *:*
root     nepenthes  7669  29 tcp4   *:5554                *:*
root     nepenthes  7669  30 tcp4   *:1023                *:*
root     nepenthes  7669  31 tcp4   *:27347               *:*
root     nepenthes  7669  32 tcp4   *:5000                *:*
root     nepenthes  7669  33 tcp4   *:10000               *:*
root     nepenthes  7669  34 tcp4   *:42                  *:*
root     nepenthes  7669  35 tcp4   *:80                  *:*

The system running Nepenthes has a private IP and it sits behind my Comcast cable modem. I decided to tell my router connected to the cable modem to forward ports 80 and 443 to the Nepenthes system.

Now, if I connect to port 80 on my router, Nepenthes handles the connection.

janney:/root# nc -v bej.dyndns.org 80
Connection to bej.dyndns.org 80 port [tcp/http] succeeded!
HEAD / HTTP/1.0
janney:/root# 

Here is what Nepenthes reports:

[ debug net mgr ] Socket TCP  (bind) 0.0.0.0:0 -> 0.0.0.0:80
        DialogueFactory ASN1 Dialogue Factory creates dialogues for the SMB and IIS flaw
 killbill showed us could Accept a Connection
[ spam net handler ] 
[ spam net handler ] Socket TCP  (accept) 192.168.2.1:55966 -> 192.168.2.7:80 
[ spam net handler ] Adding Dialogue ASN1 Dialogue Factory 
[ spam mgr event ] 
[ debug net mgr ] Accepted Connection Socket TCP  (accept) 192.168.2.1:55966 -> 192.168.2.7:80 
 32 Sockets in list
[ spam net handler ] 
[ spam mgr event ] 
[ spam net handler ] doRecv() 16
[ debug net handler ] Dialogue IISDialogue inactive, returned CL_DROP
[ debug net handler ] Socket TCP  (accept) 192.168.2.1:55966 -> 192.168.2.7:80
 has no active Dialogues left, closing 
[ debug net mgr ] Deleting Socket TCP  (accept) 192.168.2.1:55966 -> 192.168.2.7:80
 due to closed connection 
[ spam net handler ] 
[ spam net handler ] Socket TCP  (accept) 192.168.2.1:55966 -> 192.168.2.7:80
 clearing DialogueList (1 entries)
[ spam net handler ]    Removing Dialog "IISDialogue" 
[ warn dia ] Unknown IIS 16 bytes State 0
[ dia  ] =------------------[ hexdump(0x0808c300 , 0x00000010) ]-------------------=
[ dia  ] 0x0000  48 45 41 44 20 2f 20 48  54 54 50 2f 31 2e 30 0a  HEAD / H TTP/1.0.
[ dia  ] =-------------------------------------------------------------------------=

If I find anything interesting, I will pass it on. Here I just wanted to document what I had to do to get Nepenthes running.