Skip to content

Instantly share code, notes, and snippets.

@echohtp
Created October 9, 2020 22:23
Show Gist options
  • Save echohtp/8141b9aaab1461bc34ba1b07bcab8d9a to your computer and use it in GitHub Desktop.
Save echohtp/8141b9aaab1461bc34ba1b07bcab8d9a to your computer and use it in GitHub Desktop.
Global honeypot terraform @0xbanana
variable "project_name" {
type = string
}
variable "sensor_machine_type" {
type = string
}
variable "sensor_startup_script" {
type = string
}
variable "cnc_machine_type" {
type = string
}
variable "cnc_startup_script" {
type = string
}
provider "google" {
credentials = file("your_supplied_credentials.json")
project = var.project_name
}
resource "google_compute_network" "vpc_network" {
name = "bco-hv-dev-vpc-1"
auto_create_subnetworks = "true"
}
###########################################
#
# CREATE THE SENSORS AND FW RULES
#
###########################################
resource "google_compute_instance" "sensor_asia" {
name = "sensor-asia"
machine_type = var.sensor_machine_type
zone = "asia-east1-a"
tags = ["sensor"]
scheduling {
preemptible = false
automatic_restart = true
}
boot_disk {
initialize_params {
image = "debian-cloud/debian-9"
size = 200
}
}
network_interface {
# A default network is created for all GCP projects
network = google_compute_network.vpc_network.self_link
access_config {
}
}
metadata_startup_script = var.sensor_startup_script
}
resource "google_compute_instance" "sensor_eu" {
name = "sensor-eu"
machine_type = var.sensor_machine_type
zone = "europe-west1-c"
tags = ["sensor"]
scheduling {
preemptible = false
automatic_restart = true
}
boot_disk {
initialize_params {
image = "debian-cloud/debian-9"
size = 200
}
}
network_interface {
# A default network is created for all GCP projects
network = google_compute_network.vpc_network.self_link
access_config {
}
}
metadata_startup_script = var.sensor_startup_script
}
resource "google_compute_firewall" "allow_sensor" {
name = "honeynet-ingress-allow-all"
network = google_compute_network.vpc_network.self_link
allow {
protocol = "icmp"
}
allow {
protocol = "tcp"
}
target_tags = ["sensor"]
source_ranges = ["0.0.0.0/0"]
}
###########################################
#
# CREATE THE CNC AND FW RULES
#
###########################################
resource "google_compute_instance" "command_and_control" {
name = "cnc"
machine_type = var.cnc_machine_type
zone = "us-central1-c"
tags = ["admin"]
scheduling {
preemptible = false
automatic_restart = true
}
boot_disk {
initialize_params {
image = "debian-cloud/debian-9"
size = 200
}
}
network_interface {
# A default network is created for all GCP projects
network = google_compute_network.vpc_network.self_link
network_ip = "10.128.0.42"
access_config {
}
}
metadata_startup_script = var.cnc_startup_script
}
resource "google_compute_firewall" "allow_admin" {
name = "honeynet-ingress-allow-admin"
network = google_compute_network.vpc_network.self_link
allow {
protocol = "icmp"
}
allow {
protocol = "tcp"
ports = ["64295", "64297", "22"]
}
target_tags = ["admin"]
source_ranges = ["your.ip.address.here"]
}
resource "google_compute_firewall" "allow_admin_pots" {
name = "honeynet-ingress-allow-admin-pots"
network = google_compute_network.vpc_network.self_link
allow {
protocol = "icmp"
}
allow {
protocol = "tcp"
ports = ["1-21", "23-64294", "64296", "64298-65535"]
}
target_tags = ["admin"]
source_ranges = ["0.0.0.0/0"]
}
resource "google_compute_firewall" "allow_admin_internal" {
name = "honeynet-ingress-allow-admin-internal"
network = google_compute_network.vpc_network.self_link
allow {
protocol = "icmp"
}
allow {
protocol = "tcp"
}
target_tags = ["admin"]
source_ranges = ["10.0.0.0/8"]
}
project_name = "your-project-name-here"
sensor_machine_type = "n1-standard-1"
sensor_startup_script = "echo aWYgW1sgISAtZiAvZmluaXNoZWQuZmxhZyBdXTsgdGhlbgpzdWRvIGFwdC1nZXQgdXBkYXRlOwpzdWRvIGFwdC1nZXQgaW5zdGFsbCBnaXQgZG9ja2VyLWNvbXBvc2UgYXB0LXRyYW5zcG9ydC1odHRwcyBjYS1jZXJ0aWZpY2F0ZXMgY3VybCBnbnVwZy1hZ2VudCBzb2Z0d2FyZS1wcm9wZXJ0aWVzLWNvbW1vbiAteTsKJChjdXJsIC1mc1NMIGh0dHBzOi8vZG93bmxvYWQuZG9ja2VyLmNvbS9saW51eC9kZWJpYW4vZ3BnIHwgc3VkbyBhcHQta2V5IGFkZCAtKTsKc3VkbyBhcHQta2V5IGZpbmdlcnByaW50IDBFQkZDRDg4IDsKc3VkbyBhZGQtYXB0LXJlcG9zaXRvcnkgImRlYiBbYXJjaD1hbWQ2NF0gaHR0cHM6Ly9kb3dubG9hZC5kb2NrZXIuY29tL2xpbnV4L2RlYmlhbiAkKGxzYl9yZWxlYXNlIC1jcykgc3RhYmxlIjsKc3VkbyBhcHQtZ2V0IHVwZGF0ZSAteTsKc3VkbyBhcHQtZ2V0IGluc3RhbGwgZG9ja2VyLWNlIGRvY2tlci1jZS1jbGkgY29udGFpbmVyZC5pbyAteTsKc3VkbyBnaXQgY2xvbmUgaHR0cHM6Ly9naXRodWIuY29tL3RlbGVrb20tc2VjdXJpdHkvdHBvdGNlOwpjZCB0cG90Y2UvaXNvL2luc3RhbGxlci87CnN1ZG8gY3AgdHBvdC5jb25mLmRpc3QgdHBvdC5jb25mOwpzdWRvIHNlZCAtaSAnNzE1LDcyN2QnIGluc3RhbGwuc2g7CnN1ZG8gLi9pbnN0YWxsLnNoIC0tdHlwZT1hdXRvIC0tY29uZj10cG90LmNvbmY7CnN1ZG8gd2dldCBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vZWNob2h0cC90ZXN0aW5nLXNvbWV0aGluZy9tYXN0ZXIvc2Vuc29yX3QueW1sIC1QIC9vcHQvdHBvdC9ldGMvIDsKc3VkbyBybSAvb3B0L3Rwb3QvZXRjL3Rwb3QueW1sCnN1ZG8gbXYgL29wdC90cG90L2V0Yy9zZW5zb3JfdC55bWwgL29wdC90cG90L2V0Yy90cG90LnltbApzdWRvIHdnZXQgaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2VjaG9odHAvdGVzdGluZy1zb21ldGhpbmcvbWFzdGVyL2xvZ3N0YXNoLmNvbmYgLVAgL29wdC90cG90L2V0Yy8gOwpzdWRvIHRvdWNoIC9maW5pc2hlZC5mbGFnIDsKc3VkbyByZWJvb3QgLW4KZmk= | base64 -d - | bash"
cnc_machine_type = "n1-standard-2"
cnc_startup_script = "echo aWYgW1sgISAtZiAvZmluaXNoZWQuZmxhZyBdXTsgdGhlbgpzdWRvIGFwdC1nZXQgdXBkYXRlIApzdWRvIGFwdC1nZXQgaW5zdGFsbCBnaXQgZG9ja2VyLWNvbXBvc2UgYXB0LXRyYW5zcG9ydC1odHRwcyBjYS1jZXJ0aWZpY2F0ZXMgY3VybCBnbnVwZy1hZ2VudCBzb2Z0d2FyZS1wcm9wZXJ0aWVzLWNvbW1vbiBweXRob24zLXBpcCAteSAgOwokKGN1cmwgLWZzU0wgaHR0cHM6Ly9kb3dubG9hZC5kb2NrZXIuY29tL2xpbnV4L2RlYmlhbi9ncGcgfCBzdWRvIGFwdC1rZXkgYWRkIC0pICA7CnN1ZG8gYXB0LWtleSBmaW5nZXJwcmludCAwRUJGQ0Q4OCA7CnN1ZG8gYWRkLWFwdC1yZXBvc2l0b3J5ICJkZWIgW2FyY2g9YW1kNjRdIGh0dHBzOi8vZG93bmxvYWQuZG9ja2VyLmNvbS9saW51eC9kZWJpYW4gJChsc2JfcmVsZWFzZSAtY3MpIHN0YWJsZSIgOwpzdWRvIGFwdC1nZXQgdXBkYXRlIC15IDsKc3VkbyBhcHQtZ2V0IGluc3RhbGwgZG9ja2VyLWNlIGRvY2tlci1jZS1jbGkgY29udGFpbmVyZC5pbyAteSA7CnN1ZG8gZ2l0IGNsb25lIGh0dHBzOi8vZ2l0aHViLmNvbS90ZWxla29tLXNlY3VyaXR5L3Rwb3RjZSA7CmNkIHRwb3RjZS9pc28vaW5zdGFsbGVyLyA7CnN1ZG8gY3AgdHBvdC5jb25mLmRpc3QgdHBvdC5jb25mIDsKc3VkbyBzZWQgLWkgJzcxNSw3MjdkJyBpbnN0YWxsLnNoOwpzdWRvICAuL2luc3RhbGwuc2ggLS10eXBlPWF1dG8gLS1jb25mPXRwb3QuY29uZiAgOwpzdWRvIHJtIC9vcHQvdHBvdC9ldGMvdHBvdC55bWwKc3VkbyB3Z2V0IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9lY2hvaHRwL3Rlc3Rpbmctc29tZXRoaW5nL21hc3Rlci90cG90LnltbCAtUCAvb3B0L3Rwb3QvZXRjLyA7IApzdWRvIHRvdWNoIC9maW5pc2hlZC5mbGFnIDsKc3VkbyByZWJvb3QgLW47CmZp | base64 -d - | bash"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment