honeypot.go

/*
CVE-2020-0618 SQL Reporting Services RCE Honeypot
Details: https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/

Author: maarten.goet@wortell.nl
        https://twitter.com/maarten_goet
        Wortell Enterprise Security

License: MIT

Built on top of the work of robert@x1sec.com
Thanks to maurice.de.jong@wortell.nl for fixing date/time issues

To generate self-signed certificate:

- openssl genrsa -out server.key 2048
- openssl ecparam -genkey -name secp384r1 -out server.key
- openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
*/

package main

import (
	"fmt"
	"github.com/gorilla/mux"
	"io"
	"log"
	"net/http"
	"net/http/httputil"
	"os"
	"strings"
	"sync"
	"time"
)

type eventLogger struct {
	mu     sync.Mutex
	logger *log.Logger
	path   string
	file   io.Writer
}

var (
	cveLog          eventLogger
	allRequestsLog  eventLogger
)

func main() {

	fmt.Println("CVE-2020-0618 SQL Reporting Services RCE Honeypot")
	fmt.Println(" ")
	fmt.Println("888                                                     888")    
	fmt.Println("888   .w0rtell.                                         888")    
	fmt.Println("888                                                     888")  
	fmt.Println("88888b.  .d88b. 88888b.  .d88b. 888  88888888b.  .d88b. 888888")
	fmt.Println("888 '88bd88''88b888 '88bd8P  Y8b888  888888 '88bd88''88b888")    
	fmt.Println("888  888888  888888  88888888888888  888888  888888  888888")    
	fmt.Println("888  888Y88..88P888  888Y8b.    Y88b 888888 d88PY88..88PY88b.")  
	fmt.Println("888  888  Y88P  888  888  Y8888   Y8888888888P    Y88P    Y888") 
    fmt.Println("                                     888888")                    
    fmt.Println("                                Y8b d88P888")                    
    fmt.Println("                                 'Y88P  888")   
	fmt.Println(" ")

	setupLogging()

	r := mux.NewRouter()

	// Custom 404
	r.NotFoundHandler = http.HandlerFunc(notFoundHandler)

    // Detect possible exploitation
    // Match on URL and (parts of) the header
    r.HandleFunc("/ReportServer/pages/ReportViewer.aspx", cveHandler)

	// Lots of content to serve (css, png etc)
	r.PathPrefix("/ui/").Handler(staticWrapper(http.FileServer(http.Dir("./static/"))))

    // Serve fake main page
	r.HandleFunc("/", indexHandler)

	fmt.Println("Listening on port 80 and 443 ... ")

	// Listen on plain HTTP
	go func() {
		http.ListenAndServe(":80", logHandler(r))
	}()

	// log invalid TLS connections to file  
	tlsErrLog, err := os.Create("./logs/tls.log")
	if err != nil {
		panic(err)
	}
	defer tlsErrLog.Close()

	// support HTTPS
	if _, err := os.Stat("./server.crt"); os.IsNotExist(err) {
		fmt.Println("TLS certificate missing.")
		os.Exit(1)
	}
	if _, err := os.Stat("./server.key"); os.IsNotExist(err) {
		fmt.Println("Private key missing.")
		os.Exit(1)
	}

	// Listen on HTTPS
	srv := &http.Server{
		ErrorLog: log.New(tlsErrLog, "", log.LstdFlags|log.Lshortfile),
		Handler:  logHandler(r),
		Addr:     ":443",
	}

	srv.ListenAndServeTLS("server.crt", "server.key")
}

/* 404 */
func notFoundHandler(w http.ResponseWriter, r *http.Request) {
	w.Write([]byte("The requested page was not found on this server."))
}

/* main page */
func indexHandler(w http.ResponseWriter, r *http.Request) {
	http.ServeFile(w, r, "./static/index.html")
}

/* detect attempts of CVE-2020-0618 exploitation */
func cveHandler(w http.ResponseWriter, r *http.Request) {

	message := "Exploitation of CVE-2020-0618 detected ... "

	writeLogEntry(r, message)

	headers := `Cache-Control : no-cache
        Content-Encoding: gzip
        Content-Type: text/html; charset=utf-8
        Date: Thu, 28 Nov 2019 20:19:22 GMT
        Expires: -1
        Pragma: no-cache
        Server: Microsoft-IIS/6.0
        Tranfer-Encoding: chunked
        Vary: Accept-Encoding
        X-AspNet-Version: 2.0.50727
        X-Powered-By: ASP.NET`

	setResponseHeaders(w, headers)
}

/* Log all requests regardless of match */
func logHandler(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

		clientIP := r.RemoteAddr
		if colon := strings.LastIndex(clientIP, ":"); colon != -1 {
			clientIP = clientIP[:colon]
		}

		requestLine := fmt.Sprintf("%s %s %s", r.Method, r.RequestURI, r.Proto)
		x := fmt.Sprintf("%s - - \"%s\"\n", clientIP, requestLine)
                t := time.Now()
		formattedLogLine := fmt.Sprintf("%d-%02d-%02d %02d:%02d:%02d %s",
				t.Year(), t.Month(), t.Day(),
						t.Hour(), t.Minute(), t.Second(), x)
		allRequestsLog.logger.Printf(formattedLogLine)

		h.ServeHTTP(w, r)
	})
}

/* default headers */
func staticWrapper(h http.Handler) http.HandlerFunc {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

                headers := `Cache-Control : no-cache
                Content-Encoding: gzip
                Content-Type: text/html; charset=utf-8
                Date: Thu, 28 Nov 2019 20:19:22 GMT
                Expires: -1
                Pragma: no-cache
                Server: Microsoft-IIS/6.0
                Tranfer-Encoding: chunked
                Vary: Accept-Encoding
                X-AspNet-Version: 2.0.50727
                X-Powered-By: ASP.NET`

		setResponseHeaders(w, headers)

		h.ServeHTTP(w, r)
	})
}

/* set headers in response */
func setResponseHeaders(w http.ResponseWriter, h string) {
	t := time.Now().UTC()
	d := t.Format(time.RFC1123)
	dh := "Date: " + d + "\n"
	ah := dh + h

	for _, l := range strings.Split(ah, "\n") {
		k := strings.SplitN(l, ":", 2)
		w.Header().Set(strings.TrimLeft(k[0], "\t"), strings.Trim(k[1], " "))
	}
}

/* Log everything related to CVE-2020-0618 */
func writeLogEntry(r *http.Request, message string) {
	cveLog.mu.Lock()
	defer cveLog.mu.Unlock()

	logLine := "\n-------------------\n"
	if message != "" {
		logLine = logLine + message + "\n"
	}

	i := strings.LastIndex(r.RemoteAddr, ":")
	if i != -1 {
		logLine += "Source IP: " + r.RemoteAddr[:i] + "\n"
	}

	l, err := httputil.DumpRequest(r, true)
	if err == nil {
	        logLine = logLine + string(l)
	} else {
	        fmt.Println("error")
	}

        t := time.Now()
	formattedLogLine := fmt.Sprintf("%d-%02d-%02d %02d:%02d:%02d %s",
			t.Year(), t.Month(), t.Day(),
					t.Hour(), t.Minute(), t.Second(), logLine)
	cveLog.logger.Println(formattedLogLine)

}

/* setup the required logging structure */
func setupLogging() {

	cdir, _ := os.Getwd()
	dir := cdir + "/logs/"

	// create logs dir
	if _, err := os.Stat(dir); os.IsNotExist(err) {
		err = os.MkdirAll(dir, 0755)
		if err != nil {
			panic(err)
		}
	}

	openLogger(&cveLog, dir + "cve.log")
	openLogger(&allRequestsLog, dir + "allrequests.log")
}

/* logger */
func openLogger(e *eventLogger, path string) {
	var err error
	e.path = path
	e.file, err = os.OpenFile(e.path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
	if err != nil {
		panic(err)
	}
	e.logger = log.New(e.file, "", 0)
}