Cowrie Honeypot Deployment Setup

Honeypots are used to simulate vulnerable systems and observe how attackers behave in real-world scenarios.

In this lab, you deploy an SSH honeypot using Cowrie and actively attack it from a separate machine to capture and analyze activity.

Environment

Victim machine (Ubuntu) - Server hosting the SSH honeypot. Attacker machine (Ubuntu) - Used to performattacks against the honeypot.

System Preparation

The victim machine was first prepared by updating the system.

Install Docker along with the required dependencies.

• Remove old versions:

sudo apt-get remove docker docker-engine docker.io containerd runc

• Update APT and install dependencies:

sudo apt-get update sudo apt-get install \ ca-certificates \ curl \ gnupg \ lsb-release

• Add Docker’s GPG key:

sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \ sudo gpg — dearmor -o /etc/apt/keyrings/docker.gpg

• Set up the Docker repository:

echo \ “deb [arch=$(dpkg — print-architecture) \ signed-by=/etc/apt/keyrings/docker.gpg] \ https://download.docker.com/linux/ubuntu \ $(lsb_release -cs) stable” | \ sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

• Update APT again:

sudo apt-get update

• Install Docker Engine:

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

• Verify Docker is working:

sudo docker run hello-world

You should see the message: “Hello from Docker!”

Deploying the Honeypot

Download and start the Cowrie honeypot container:

docker run -p 2222:2222 cowrie/cowrie:latest

This downloads Cowrie and maps its SSH service to port 2222 on the victim machine (10.10.10.9).

Cowrie is now installed and ready to use.

Follow the project’s README for additional setup and tweaks:

cd cowrie cat README.rst

Attacking the Honeypot

From the attacker machine, start with reconnaissance.

Perform an Nmap scan to identify open ports and running services. You should find SSH running on port 2222, typically appearing as a Debian-based service.

You have the option to change the default port number in the mounted Cowrie Docker volume. This helps reduce obvious indicators that the system is a honeypot, since 2222 is the default Cowrie port.

Next, perform a brute-force attack using Hydra.

You can obtain wordlists containing commonly used SSH credentials from SecLists. These include lists for brute forcing SSH, Wi-Fi passwords, default credentials, and more.

For this demo, use: https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt

Run:

hydra -C <path-to-wordlist> ssh://10.10.10.9

You can run this and many other attacks against the honeypot via SSH.

Captured Activity

Every activity that takes place on the honeypot is immediately captured and can be used to trace attacker TTPs.

The brute-force attempt is logged, showing the source IP, usernames and passwords attempted, and whether each attempt succeeds or fails.

Gaining Access

After identifying valid credentials, establish an SSH connection:

ssh -p 2222 root@10.10.10.9

Log in using password:

qwasyx21

Simulated Attacks

Since Cowrie emulates a real system, you can perform additional attack scenarios such as:

• File uploads or malware dropping.
• Privilege escalation.
• Clearing your tracks and more.

Recommendations for Improvement

Always deploy the honeypot in a DMZ and not within the internal network.

Change the default port (2222) to avoid easy detection as a honeypot.

Change default credentials (toor) to improve authenticity.

Enhance realism by customizing the filesystem to make the system less suspicious.

Perform vulnerability scans to assess system exposure via SSH.