ncat -k -m 5 -l -p 4444
 
# -k : keep listening 
# -m : max-conns
# -l : listen
# -p : local port
 

 
echo HELO1|ncat 127.0.0.1 4444
echo HELO2|ncat 127.0.0.1 4444
echo HELO3|ncat 127.0.0.1 4444
echo HELO4|ncat 127.0.0.1 4444
echo HELO5|ncat 127.0.0.1 4444
 

 
ncat 127.0.0.1 4444
ncat 127.0.0.1 4444
ncat 127.0.0.1 4444
ncat 127.0.0.1 4444
ncat 127.0.0.1 4444
echo HELO6|ncat 127.0.0.1 4444
 

 
#!/bin/bash
 
APP="$(basename $0)"
 
WAIT=20
LOGS="logs"
DATA="data"
PORTS="7
13
21
22
23
25
53
110
137
161
443
445
965
1433
3306
3389
5060
7070
8080
33445
49152
60010"
 
ipcountry="$HOME/.local/scr/ip-country"
 
renice -20 $$
 
[ $# -eq 0 ] && arg="start"
[ $# -eq 1 ] && arg="$1"
wait=$WAIT
[ $# -eq 2 ] && wait="$2"
if [ $# -eq 1 ] && [ "$1" = "-h" ]
then
  echo "
Usage: $APP [start|stop|clean]
 
By default, start.
"
  exit 0
fi
 
_clean()
{
  printf "\\n + Sending KILL signal to all 'tcpdump'..."
  killall -9 tcpdump >/dev/null 2>&1
  printf "\\b\\b\\b, done."
 
  printf "\\n + Sending KILL signal to all 'netcat'..."
  killall -9 ncat >/dev/null 2>&1
  printf "\\b\\b\\b, done."
 
  printf "\\n + Deleting IPtables rules..."
  for port in $PORTS
  do
    iptables -D INPUT -p tcp -m tcp --dport $port -j ACCEPT
  done >/dev/null 2>&1
  (
   iptables -D INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
   iptables -D OUTPUT -m state --state NEW,RELATED,ESTABLISHED,UNTRACKED -j ACCEPT
  ) >/dev/null 2>&1
}
 
 
if [ "$arg" = "clean" ]
then
  printf "\\nCleaning log and capture files..."
  printf "\\n=================================\\n"
  rm -fv $LOGS/*.*
  printf "\\nDone.\\n\\n"
  printf "\\nUnloading NetCat honeypot..."
  printf "\\n============================"
  _clean
  printf "\\b\\b\\b, done."
 
  for pid in $(ps aux|grep $APP|egrep -v "vim|$$|grep"|awk '{ print $2 }')
  do
    printf "\\n + Sending KILL signal to PID '$pid'..."
    kill -KILL "$pid" >/dev/null 2>&1 && printf "\\r + Sending KILL signal to PID '$pid', done."
  done
 
  printf "\\n\\n"
  exit 0
fi
 
 
if [ "$arg" = "stop" ]
then
  printf "\\nUnloading NetCat honeypot..."
  printf "\\n============================"
  for pid in $(ps aux|grep $APP|egrep -v "vim|$$|grep"|awk '{ print $2 }')
  do
    printf "\\n + Sending KILL signal to PID '$pid'..."
    kill -KILL "$pid" >/dev/null 2>&1 && printf "\\r + Sending KILL signal to PID '$pid', done."
  done
  _clean
  printf "\\b\\b\\b, done.\\n\\n"
  exit 0
fi
 
 
if [ "$arg" = "start" ]
then
  printf "\\nLoading NetCat honeypot..."
  printf "\\n==========================\\n\\n"
  mkdir -p "$LOGS"
  mkdir -p "$DATA"
  RAW="/dev/urandom"
  echo " + Blocking INPUT packet by default"
  iptables -P INPUT DROP
  for port in $PORTS
  do
    echo " > $port"
    while true
    do
      (
       ok=1
       netstat -lntp|grep ":$port " >/dev/null 2>&1 && ok=0
       if [ $ok -eq 1 ]; then
         kill -KILL "$(ps aux|grep tcpdump|grep -v grep|grep tcpdump|grep "port $port"|awk '{ print $2 }')"
         iptables -D INPUT -p tcp -m tcp --dport $port -j ACCEPT
         sleep 1
         iptables -I INPUT -p tcp -m tcp --dport $port -j ACCEPT
         printf "\\n\\n\\n" >> $LOGS/$port.log
         echo "%% $(date) %%" >> $LOGS/$port.log
         echo "%% ------------------------------------- %%" >> $LOGS/$port.log
         ( tcpdump -A -vv  -e -f -H -K -l -p "port $port" -w $LOGS/$port.pcap & ) >/dev/null 2>&1
         cat "$RAW"|ncat -vv -klp $port 2>&1 >> $LOGS/$port.log
         printf "\\n\\n\\n" >> $LOGS/$port.log
       fi
      ) >/dev/null 2>&1
    done &
  done
  echo " + Allowing statefull inspected packet"
  iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
  iptables -I OUTPUT -m state --state NEW,RELATED,ESTABLISHED,UNTRACKED -j ACCEPT
  printf "\\nDone.\\n\\n"
fi
 
 
if [ "$arg" = "monitor" ]
then
  while true
  do
    clear
    printf -- "\\nMonitoring, $(date) :"
    printf "\\n==========================================\\n\\n"
 
    printf "\\nProcess =  tcpdump: $(ps aux|grep -v grep|grep -c tcpdump)"
    printf ", ncat:  $(ps aux|grep -v grep|grep -v $APP|grep -c ncat )\\n"
    for port in $PORTS
    do
      [ ! -f "$LOGS/$port.log" ] && continue
      # logfilesize=$(ls -l $LOGS/$port.log|awk '{ print $5 }')
      pkts=$(iptables -v -L -n|grep ":$port$"|awk '{ print "sent: "$1", received: "$2 }')
      lastlinelog=$(strings "$LOGS/$port.log"|\\
       egrep -o "^%% [A-Z][a-z][a-z] [A-Z0][a-z][a-z] [0-2][0-9] ([0-2])?[0-9]:([0-6])?[0-9]:([0-6])?[0-9] ... 20.. %%$" |\\
       tail -n1|\\
       sed 's/%%//g')
      lastip=$(tcpdump -n -r $LOGS/$port.pcap 2>&1|grep ".$port > "|\\
       awk '{ print $5 }'|\\
       cut -d'.' -f1,2,3,4|\\
       tail -n1)
      [ ! -z "$lastip" ] && lastipcountry=$($ipcountry $lastip)
      [ -z "$lastip" ] && lastipcountry=''
      lastpacket=$(hexdump -C "$LOGS/$port.pcap"|tail -n2|head -n1)
      netstat -lntp|grep ":$port " >/dev/null 2>&1 || continue
      printf -- "\\n%-5s \\t |  Last IP: %-15s, country: %-20s \\t |  Packets %-30s \\t |"
      printf -- "  Last bytes: \\`%s\\`" "$port" "$lastip" "$lastipcountry" "$pkts" "$lastpacket"
    done
    sleep $WAIT
  done
fi