mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
139ee56af7
Adding docker-compose based example of man-in-the-middle attack against installation scripts and how it can be detected using sysdig falco. The docker-compose environment starts a good web server, compromised nginx installation, evil web server, and a copy of sysdig falco. The README walks through the process of compromising a client by using curl http://localhost/get-software.sh | bash and detecting the compromise using ./fbash. The fbash program included in this example fixes https://github.com/draios/falco/issues/46.
19 lines
530 B
Python
19 lines
530 B
Python
import socket;
|
|
import signal;
|
|
import os;
|
|
|
|
os.close(0);
|
|
os.close(1);
|
|
os.close(2);
|
|
|
|
signal.signal(signal.SIGINT,signal.SIG_IGN);
|
|
serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
serversocket.bind(('0.0.0.0', 1234))
|
|
serversocket.listen(5);
|
|
while 1:
|
|
(clientsocket, address) = serversocket.accept();
|
|
clientsocket.send('Waiting for botnet command and control commands...\n');
|
|
command = clientsocket.recv(1024)
|
|
clientsocket.send('Ok, will execute "{}"\n'.format(command.strip()))
|
|
clientsocket.close()
|