OpenAI Beelzebub Linux Simulation with Custom Wazuh Detection Rules

#ai #beginners #wazuh #beelzebub

Intro

I set out on this lab to learn how to set up a honey pot and how to connect it to SIEM. I choose a honeypot called Beelzebub that can emulate real shell responses to attackers by querying OpenAI with an API key. The SIEM I am using is Wazuh for it's customization and flexibility. Using Wazuh will allow me to write custom rules that will send alerts for 3 different attacker simulations I want to run on Beelzebub. The attacks I am going to carry out is a TCP port scan, a brute force attack, and running Linux shell commands over ssh. I want to thank the developers of Beelzebub for making this awesome open source tool and I also want to give a massive thanks to Taylor Walton, whose article I used as an outline for my lab.

Before we get into it a little about me. I have been studying cybersecurity for a little over 3 years now. I seen the blind spot that people have for security on the internet and I want to help fill the role of protecting. I am always looking to help others and cybersecurity is a really good way to protect others.

Setup

Before I can jump into using Beelzebub I need to make sure I meet all the prerequisites. I met all except Docker was not installed yet. Once I had Docker installed I could start my journey with Beelzebub. I started by getting a clone of the Beelzebub-labs and then ran './install.sh --docker'. Once I had confirmed docker was up and had recorded a log I shut down docker using 'docker compose down' and I had quite a few configurations I needed to add/edit. I used Beelzebub ssh for port 2222 since I was using ssh port 22 to run the machine I was on. This also created a problem when I first tried launching all the Beelzebub instances. It tried running on ssh on port 22, among many other things, but since the Linux machine was using it, it failed to launch. I had to go into 'beelzebub.yml' and remove port 22 from the configuration so it would finally work. Once I had figured that out, I moved on to configuring the ssh 2222 Yamal file to respond as if it were an actual instance of Linux. I ran into a bump here where I could connect to Beelzebub via ssh but I would not get any responses when using commands.

This was quite annoying, but, after combing back through everything a few times, I found a couple of mistakes I had made. First, I had not correctly copied the API key so I basically had no key at all. Second, I figured out needed to pay a small fee to get the API keys to respond from OpenAI. Now $5 poorer, Beelzebub finally responded to my Linux commands.

Pretty awesome to see Beelzebub responding as if I had connected to a real instance of Linux. I wasn't quite done just yet though. I needed to set up a Wazuh agent on the machine to forward logs to the SIEM. Once I had installed the agent I needed to tell the agent where to get the logs from. I needed to change 'beelzebub.yaml' to save the logs to a text file. I ran into more trouble here but it was a typo. I had misspelled one of the words by one letter in the configuration file and I just couldn't find it for the longest time. When I finally realized what I had done, I felt so dumb. On the bright side though it did cause me to be much more cautions and I did not make another typo for the remainder of this lab... I'm sure I will eventually make this mistake again. With all the configurations now spelt the right way, I was finally getting logs in my SIEM from Beelzebub. On to the attacks!!!

Simulating Attacker Behavior

PORT SCAN

The first attack I wanted to see Beelzebub detect was a stealth scan... Until I realized it couldn't detect it. I could not get Beelzebub to detect the stealth scan but I could get it to detect a TCP port scan. I pivoted to making a Wazuh manager rule for TCP traffic instead.

This rule will detect a new TCP session and send an alert to the Wazuh SIEM that says "Possible TCP port scan." I know this isn't exactly the best way to detect a TCP port scan but for this lab this is enough for a proof of concept. I was a little frustrated I couldn't get a better alert for this attack but my other attempts kept ending in failure. I did however get an alert to go off when new TCP sessions were created which is a good start to me.

(Wazuh events of TCP traffic)

BRUTE FORCE (METASPLOIT)

Any excuse to use Metasploit is a welcome one for me. One of my early memories of getting into cybersecurity is using Metasploit to hack into other computers in labs. Of course I could've just manually typed in multiple different passwords at random... but where's the fun in that. First though, I configured a few new alerts for the Wazuh manager.

Now that Wazuh will send alerts for the login attempts it was time to use Metasploit. I went to the 'ssh_login' and set up all the values I needed. I created my own password list and made sure I was trying this over port 2222. Then I ran the command and let it try all the passwords for me.

(values set for Metasploit ssh_login)
Unfortunately for me Metasploit could not create an actual session so my time with the tool was over but it had created the traffic I needed to have logs pop up in my SIEM.

(Metasploit output.)

(These are all logs of failed login attempts along with one successful one.)

RUNNING COMMANDS

The final attack I wanted to do is to run commands over ssh. This was partly because I wanted to see how Beelzebub would respond to different commands. Just like all the others I started by making the rule for the Wazuh manager.

I then ran a few commands to generate some logs. The commands I ran were the same as the image I posted earlier in this blog. It was really cool to see it spit out so believable responses. I then went over to the Wazuh SIEM and found all the logs of the commands I ran.

(logs of commands executed)

I feel very acomplished in this lab. First of all, I actually got Beelzebub working. Then I moved on to an attackers point of view. I scanned for open ports I could connect to. Then I tried using Metasploit to brute force over ssh into the Beelzebub honeypot. Once I got a password, I used ssh over a normal shell to connect to Beelzebub and run commands on it. I also created rules that would trigger alerts to Wazuh. I was able to successfully receive alerts from each simulated attack proving my amazing new rules worked.
I went too fast at times and made some silly mistakes like typos but this also taught me how careful I have to be with editing configuration files. I also learned that sometimes the answer is just a couple of bucks. I also learned that Beelzebub can't capture every kind of scan which helped show me the importance of having multiple defenses in place.

The End

I enjoyed messing with Beelzebub and Wazuh. I had fun figuring out how to customize my own alerts using Wazuh rules. It was also cool to use AI to simulate a fake Linux shell to attackers. I wish I had been more careful when editing the configuration files. It also would've help to really take on the challenge one step at a time. There were multiple times during this lab that I thought something else was broken when really it was that typo or the API key being wrong. I wouldn't have been able to do this with out Taylor Walton. He wrote an excellent article on Medium and even made a video to go along with it. It was immense help during this lab and I often found myself referencing it when things went wrong.