Skip to main content

EndleSSH by Chris Wellens (github:skeeto)

 

Los Angeles CA ~ La Brea Tar Pits"Los Angeles CA ~ La Brea Tar Pits" by Onasill ~ Bill Badzo - - 70M Views is licensed under CC BY-NC-ND 2.0


I recently completed the SANS SEC503: Network Intrusion Detection course and while there is more than enough information to melt your brain, I picked up a few tricks I'd never seen before. I'd like to share one of the quickest and most practical here.

EndleSSH by Chris Wellens is a tarpit for would be SSH brute force attackers. Clearly in the Active Defense column, EndleSSH works by pretending to be an SSH server, and strings the attempted connections along for near infinite amounts of time.

An automated attack could sit for weeks tied to this connection before realizing something was wrong. Chris has a ton more information on his website above and on his GitHub.

Here's a quick walkthrough: 

Configuring EndleSSH on Debian based Droplets

Moving SSH

  • To move SSH run the following
    sed -i 's/#Port 22/Port $PORTYOUWANT/' /etc/ssh/sshd_config
  • To restart SSH on the new port
    systemctl restart ssh
  • To verify SSH listening port
    netstat -tulpn |grep $PORTYOUWANT

Moving endleSSH

  • To disable EndleSSH
    systemctl disable endlessh
  • To allow port of less than 1024.
    setcap 'cap_net_bind_service=+ep' /usr/bin/endlessh
  • To modify config
    sed -i 's/#Ambient/Ambient/' /lib/systemd/system/endlessh.service'
    sed -i 's/PrivateUsers/#PrivateUsers/ /lib/systemd/system/endlessh.service'
  • To create new local config
    printf "Port 22\nDelay 10000\nMaxLineLength 32\nMaxClients 4096\nLogLevel 0\nBindFamily 0" >> /etc/endlessh/config
  • Restart EndleSSH
    systemctl enable endlessh
  • Start EndleSSH
    systemctl enable endlessh

Modifying FW rules

  • List UFW Numbered ufw status numbered
  • Delete Old SSH rules ufw delete $RULENUMBER
  • Add New SSH rules ufw allow from $YOURIP to any port $PORTYOUWANT
  • Add New EndleSSH rules ufw allow from any to any port 22

 

Popular posts from this blog

LibWebP (CVE-2023-4863)

Here is a non-exhaustive list of possible mitigations to prevent the exploitation of CVE 2023-4863 in the LibWebP library. This library has a heap buffer overflow available across all operating systems, most browsers, an exceptional number of Electron framework applications. This CVE is rated a 10 after previously being rated 8.8. This was due to an original disclosure from Google stating that Chrome was the only effected application. After investigation, it was discovered that all instances of the LibWebP library were vulnerable across all platforms. A similar CVE ( 2023-5217 ) is pending analysis for the VP8 webstream video format (a sister library to libwep.) As working proof-of-concepts are generally available to the public and Google and Apple both acknowledge threat actors and spyware vendors making use of the vulnerability, it is essential that you begin reviewing and patching all business critical applications. Patch Browsers, All of them All major and minor browsers acr
Read more

Show And Tell

Once a week, our security team gathers everyone into a meeting and shares the last week’s worth of security related news and any new security initiatives. This one hour may be the most valuable meeting we attend and has the greatest impact on successful security outcomes. What is it? We call ours a Security Show & Tell. (You can call it whatever fun and exciting name fits your corporate culture.) Regardless of the name, the goal is to set aside an hour each week to share three kinds of security stories and our response to them. Stories that are in the news. Stories that impact our work. Stories that impact our lives. Author’s Note: There’s some helpful tips below on how to gather these stories.  Why you should do it There’s a lot of great reasons to do this, but I want to drive home a few really important ones. How many times has this happened to you? You wake up, open infosec.exchange , and begin scrolling only to find out that $Vendor has a nasty zero-day and organiza
Read more

HEAR Model

Photo by Oladimeji Ajegbile from Pexels This method of Bible study was handed down to me in 2008 at The University of Tennessee Chattanooga’s Baptist Collegiate Ministries (UTC-BCM). At the time Robbie Gallaty was leading Brainerd Baptist and had an intense focus on discipleship and relationship in the church family. His dedication to discipleship led to a resurgence of strong Godly men and families leading small groups in the community. Gus Hernandez was a mentee of Gallaty and passed the model down to the college group of which many BCM members were joint attendees of Brainerd. This model has been modified slightly by the 7 Questions model introduced to me by Jonathan Dixon, a mentor in both faith and career during my time at BlueCross BlueShield of TN. HEAR Model Highlight Explain Apply Respond The HEAR model is a technique used to rapidly assess the content, intent, and application of textual works. While it is useful for any context, this will specifically deal wi
Read more