Awesome
Honeybits-win
A simple tool to create breadcrumbs and honeytokens, to lead the attackers to your honeypots!
The Linux version of this project: honeybits
Author: Adel "0x4D31" Karimi.
Features:
- Creating fake credentials in Windows Credential Manager
- Reading config from a remote Key/Value Store such as Consule or etcd
Requirements:
- Go Lang 1.7+
- Viper (
go get github.com/spf13/viper
) - crypt (
go get github.com/xordataexchange/crypt/config
)
Usage:
> go run honeybits-win.go
/\ /\___ _ __ ___ _ _| |__ (_) |_ ___
/ /_/ / _ \| '_ \ / _ \ | | | '_ \| | __/ __|
/ __ / (_) | | | | __/ |_| | |_) | | |_\__ \
\/ /_/ \___/|_| |_|\___|\__, |_.__/|_|\__|___/
========================|___/=================
Failed reading remote config. Reading the local config file...
Local config file loaded.
[+] Generic credential created (192.168.1.66)
[+] Generic credential created (realco-AWS_SECRET_ACCESS_KEY-david)
[+] Domain credential created (domain01)
[+] Domain credential created (winsrv)
TODO:
- Honeyfiles
- Type 1 - honeytoken (monitored)
- Type 2 - breadcrumb (containing false information)
- Type 3 - beacon docs
- Content generator module for honeyfiles
- More traps, including:
- AWS credentials file
- Fake entries in CMD/PowerShell commands history
- Fake browser history, bookmarks and saved passwords
- Database files/backups: SQLite, MySQL
- Confoguration, backup, and connection files such as RDP and VPN
- MS Outlook Data file (.ost/.pst)
- Hosts files (hosts, lmhosts)
- Fake ARP entries
- KeePass file with fake entries (.kdbx)
- Registery keys (WinSCP, PuTTY, etc.)
- Injected fake credentials in LSASS
- Documentation