[AmunServer]

### define the amun server ip
ip: {{amun_conf.listen_ip}}
#ip: 192.168.0.1 - 192.168.0.5, 192.168.15.1 - 192.168.15.15
#ip: 192.168.0.1, 192.168.0.2, 192.168.0.5
#ip: 192.168.0.0/28
#ip: eth0

### define the user amun should run as
### NOTE: non-root user cannot open bindports below 1024
user: root
group: root

### timeouts in seconds when everything else fails
### (can be changed while running)
connection_timeout: 120
bindport_timeout: 120
ftp_timeout: 180

### port range for ftp connections
### (can be changed while running)
ftp_port_range: 51025-65535

### use this ip for ftp (NAT), set to None if no NAT is used
### (can be changed while running)
ftp_nat_ip: None

### retransmit last request every x seconds
### (can be changed while running)
tftp_retransmissions: 5

### determine the number of tftp retransmissions
### (can be changed while running)
tftp_max_retransmissions: 10

### block refused IPs, timeouts, successfull downloads, or successfull exploits for x seconds
### (can be changed while running)
refused_blocktime: 1200
timeout_blocktime: 1200
sucdown_blocktime: 1200
sucexpl_blocktime: 1200

### block ips which refuse a connection, throw a timeout, or
### from which we already have a successfull download or exploit
### (can be changed while running)
block_refused: 0
block_timeout: 0
block_sucdown: 0
block_sucexpl: 0

### http header filesize check
### (can be changed while running)
check_http_filesize: 1

### store unfinished tftp transfers
### (can be changed while running)
store_unfinished_tftp: 0

### replace local ip with attacker ip
### (can be changed while running)
replace_local_ip: 1

### set iptables rule to block icmp echo-requests
honeypot_pingable: 1

### check for new vuln-modules every x seconds, read configuration
### (can be changed while running)
check_new_vulns: 240

### debug option
### (can be changes while running)
output_curr_sockets: 0
log_local_downloads: 0
verbose_logging: 0
max_open_sockets: 800

### define submission modules
### Note: with the submission of binaries to third party
###       services you must read, understand, and agree
###   to their terms and conditions!
submit_modules:
    submit-md5
#   submit-anubis,
#   submit-cwsandbox,
#   submit-joebox

### define logging modules
log_modules:
    log-hpfeeds
#   log-hpfeeds
#   log-surfnet,
#   log-syslog,
#   log-mysql

### define the vulnerability modules to load
### Note: modules listening on the same port
###       answer to requests in the order they
###       appear here.
### (can be changed while running)
vuln_modules:
        vuln-smb,
        vuln-sasserftpd,
        vuln-msdtc,
        vuln-mydoom,
        vuln-wins,
        vuln-axigen,
        vuln-slmail,
        vuln-mdaemon,
        vuln-ca,
        vuln-iis,
        vuln-ftpd,
        vuln-dcom,
        vuln-upnp,
        vuln-maxdb,
        vuln-arc,
        vuln-imail,
        vuln-tivoli,
        vuln-msmq,
        vuln-sub7,
        vuln-mercury,
#       vuln-analyzer,
        vuln-lotusdomino,
        vuln-arkeia,
        vuln-dameware,
        vuln-symantec,
        vuln-veritas,
        vuln-check,
        vuln-trend,
        vuln-bagle,
        vuln-goodtech,
        vuln-helix,
        vuln-hpopenview,
        vuln-http,
        vuln-peercast,
        vuln-rdp,
        vuln-speedport

### define ports for vulnerability modules
### (can be changed while running)
vuln-smb: 445,139
vuln-dcom: 135
vuln-ca: 10203
vuln-ftpd: 21
vuln-sasserftpd: 1023,5554
vuln-wins: 42
vuln-arc: 6070,41523,1900
vuln-symantec: 2967,2968,38292
vuln-msdtc: 3372,1025
vuln-axigen: 110
vuln-slmail: 110
vuln-mdaemon: 110
vuln-upnp: 5000,2555
vuln-iis: 443
vuln-maxdb: 9999
vuln-tivoli: 8080,1111,1581
vuln-msmq: 2101,2103,2105,2107
vuln-sub7: 27347
vuln-imail: 25,587
vuln-mercury: 105
vuln-lotusdomino: 143
vuln-arkeia: 617
vuln-dameware: 6129
vuln-veritas: 6101
vuln-trend: 5168,3268,3628
vuln-bagle: 2745
vuln-goodtech: 2380
vuln-helix: 554
vuln-hpopenview: 2954
vuln-http: 80
vuln-peercast: 7144
vuln-speedport: 7547

### work in progress
vuln-rdp: 3389

### kein shellcode sondern direkt file download
vuln-mydoom: 3127,3128,1080

### analyze interesting ports
#vuln-analyzer: 139

### simulate vulnerable telnet (in work)
vuln-check: 23

### linux shellcode not recognized
#vuln-rsync: 873
### Sample Exploit requires connection termination (this does not work with other modules listening on port 110)
#vuln-cyruspop3: 110

### incomplete (work in progress)
#vuln-mssql: 1433
#vuln-mysql: 3306
#vuln-realvnc: 5900

[logging]
logdir = logs
