Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix - Message "Non ^A command attempt" (guardian_ast) #578

Open
TheMalwareGuardian opened this issue Jan 26, 2023 · 0 comments
Open

Fix - Message "Non ^A command attempt" (guardian_ast) #578

TheMalwareGuardian opened this issue Jan 26, 2023 · 0 comments
Labels

Comments

@TheMalwareGuardian
Copy link

Describe the bug
I have deployed Conpot using the template guardian_ast, but I get this message "Non ^A command attempt x.x.x.x" when I try to connect to it using telnet/ncat (telnet ip port). However, if I use the same method against a real Guardian AST everything works as expected so there is something strange when decoding the request (It seems the template only works when the attacker scans the machine using the script atg-info.nse (nmap --script atg-info -p 10001 )).

To Reproduce
Steps to reproduce the behavior:

  1. Execute ncat.exe vps_ipaddress 10001 or telnet vps_ipaddress 10001
  2. Write for example: ^AI20100
  3. Pulse Enter
  4. There is no output (If you have access to vps_ipaddress you are going to see the message "Non ^A command attempt x.x.x.x")

Solution
Analyzing the source code of GasPot (in fact, Stephen Hilt has already updated GasPot using my commit sjhilt/GasPot#13) and the source code of Conpot related to guardian_ast, I found the issue so I have modified some lines. If anyone has the same problem, here is the commit: 5e65a8a

Expected behavior
This is the output you see when you update the code

PS C:\Users\usuario> ncat.exe 194.1xx.x.x 10001
^AI20100
I20100
01/26/2023 20:31
STATOIL STATION

IN-TANK INVENTORY
TANK PRODUCT VOLUME TC VOLUME ULLAGE HEIGHT WATER TEMP
1 SUPER 8218 8283 6102 49.03 5.90 56.59
2 UNLEAD 1068 1267 8811 35.32 2.68 54.23
3 DIESEL 3905 3939 9359 41.76 1.28 57.37
4 PREMIUM 4120 4264 9359 27.69 1.25 57.93

Desktop:

  • OS: Debian 5.10.103-1 (2022-03-07) x86_64 GNU/Linux
  • Python 3.9.2
@TheMalwareGuardian TheMalwareGuardian changed the title Message "Non ^A command attempt" (guardian_ast) Fix - Message "Non ^A command attempt" (guardian_ast) Jan 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant