mushorg / glutton

Generic Low Interaction Honeypot
MIT License
244 stars 56 forks source link

Glutton depends on lsof #128

Closed glaslos closed 1 year ago

glaslos commented 5 years ago

We assumed we always have lsof which seems to be not true. We either need to check first if it exists or find a pure Go alternative. Ref: https://github.com/mushorg/glutton/blob/e5e4c564daab44bc6ccb9e25acb2b499b7244845/system.go#L14

nassimabedi commented 5 years ago

what do you think about parsing /procdirectory to get all open files. something like this:

func getOpenfiles() (openfiles map[string]bool) {
    files, _ := ioutil.ReadDir("/proc")
    openfiles = make(map[string]bool)
    for _, f := range files {
        m, _ := filepath.Match("[0-9]*", f.Name())
        if f.IsDir() && m {
            fdpath := filepath.Join("/proc", f.Name(), "fd")
            ffiles, _ := ioutil.ReadDir(fdpath)
            for _, f := range ffiles {
                fpath, err := os.Readlink(filepath.Join(fdpath, f.Name()))
                if err != nil {
                    continue
                }
                openfiles[fpath] = true
            }
        }
    }
    return openfiles
}
sladyn98 commented 5 years ago

If I am correct the 'lsof' command is only available in linux.So correct me if I am wrong we could check the OS platform using runtime.GOOS == "windows" and if yes then execute netstat else go ahead and execute the normal lsof. Thoughts on this @glaslos

Phantsure commented 5 years ago

i think lsof is also not always installed on linux, so a either a pure Go approach or should say that lsof must be installed

glaslos commented 5 years ago

Glutton only works on Linux, so I think the pure Go approach using /proc is what we should go for.

sladyn98 commented 5 years ago

Yeah we could implement a function that parses the proc directory. And returns in a format similar to lsof

srafi1 commented 5 years ago

Is anyone actively working on this issue? If not, I would like to give it a try.

sladyn98 commented 5 years ago

Yeah there is an active PR in this regard and it is almost complete. https://github.com/mushorg/glutton/pull/129

glaslos commented 1 year ago

Closed with https://github.com/mushorg/glutton/commit/ecdde0c0f33dfc902972781583a048b2a972cc47