mushorg / glastopf

Web Application Honeypot
http://glastopf.org
560 stars 168 forks source link

Sending G-Mail with Glastopf 3.0.9-dev #113

Closed kfeger closed 11 years ago

kfeger commented 11 years ago

Dear All, here's seems to be another one. I configured Glastopf 3.0.9-dev for sending email to a gmail account. When shooting my rfi from issue #112 against it, the following happens:

2013-06-09 14:18:09,557 (glastopf.sandbox.sandbox) File successfully parsed with sandbox.
Exception in thread Thread-2:
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 552, in __bootstrap_inner
    self.run()
  File "/usr/lib/python2.7/threading.py", line 505, in run
    self.__target(*self.__args, **self.__kwargs)
  File "/usr/local/lib/python2.7/dist-packages/Glastopf-3.0.9_dev-py2.7.egg/glastopf/glastopf.py", line 128, in post_processer
    logger.insert(attack_event)
  File "/usr/local/lib/python2.7/dist-packages/Glastopf-3.0.9_dev-py2.7.egg/glastopf/modules/reporting/auxiliary/log_mail.py", line 78, in insert
    self.send_mail(attack_event)
  File "/usr/local/lib/python2.7/dist-packages/Glastopf-3.0.9_dev-py2.7.egg/glastopf/modules/reporting/auxiliary/log_mail.py", line 54, in send_mail
    msg = self._build_mail_body_event(attack_event)
  File "/usr/local/lib/python2.7/dist-packages/Glastopf-3.0.9_dev-py2.7.egg/glastopf/modules/reporting/auxiliary/log_mail.py", line 44, in _build_mail_body_event
    for header in attack_event.http_request.request_header.keys():
AttributeError: HTTPHandler instance has no attribute 'request_header'
johnnykv commented 11 years ago

Yeah, i see the problem. Just pushed a potential fix to 3.0.9-dev. Not that well tested - but it might just work :)

kfeger commented 11 years ago

I installed it, but now it’s not reacting on my rfi test nymore. Mail enabled or not.

glaslos commented 11 years ago

Those should be not related at all. Could you be more specific about "it’s not reacting"?

johnnykv commented 11 years ago

Unless there is a critical error which crashes the worker greenlet (TODO: harden the consumer :) ) @kfeger could you provide en entire output from your current error?

kfeger commented 11 years ago

It is starting up normally, but when I fire my rfi-test of issue 112 against it, I do not see any reaction in the output. I get “Page can not be displayed” in the browser- Previously I got a blank page back.

Since I installed the new version already and (shame on me) didn’t save the previous state in a snapshot, I can not roll back. Sorry!

Von: Lukas Rist [mailto:notifications@github.com] Gesendet: Sonntag, 9. Juni 2013 15:06 An: glastopf/glastopf Cc: kfeger Betreff: Re: [glastopf] Sending G-Mail with Glastopf 3.0.9-dev (#113)

Those should be not related at all. Could you be more specific about "it’s not reacting"?

— Reply to this email directly or view it on GitHub https://github.com/glastopf/glastopf/issues/113#issuecomment-19165774 . https://github.com/notifications/beacon/t46sTbUOQuGjus10UXgmGpvT9jN2d7hA2baFGfuh9NVENvdeMAa1WpOJD5DQpoQF.gif

kfeger commented 11 years ago

Stop all thinking (no, not really..). My fault. I deleted the glastopf.cfg a build a new one with glastopf-runner to the clean.

Well, then Glastopf listens to port 80….

Setting the port to 8080 and enabling mail resulted in the following:

New attack from 84.180.103.6 with request /was_schickes/vuln.php%3Dhttp://www.smuldom.de/rfi.php

Complete Request:

GET /was_schickes/vuln.php%3Dhttp://www.smuldom.de/rfi.php HTTP/1.1

Accept: text/html, application/xhtml+xml, /

Accept-Encoding: gzip, deflate

Accept-Language: de-DE

Connection: Keep-Alive

Dnt: 1

Host: http://www.smuldom.de:8080 www.smuldom.de:8080

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

So thanks again for the solution and sorry for the trouble.