Global honeypot terraform @0xbanana

main.tf

variable "project_name" {
  type = string
}

variable "sensor_machine_type" {
  type = string
}

variable "sensor_startup_script" {
  type = string
}

variable "cnc_machine_type" {
  type = string
}

variable "cnc_startup_script" {
  type = string
}

provider "google" {
  credentials = file("your_supplied_credentials.json")
  project = var.project_name
}


resource "google_compute_network" "vpc_network" {
  name                    = "bco-hv-dev-vpc-1"
  auto_create_subnetworks = "true"
}


###########################################
#
#     CREATE THE SENSORS AND FW RULES
#
###########################################

resource "google_compute_instance" "sensor_asia" {
  name         = "sensor-asia"
  machine_type = var.sensor_machine_type
  zone         = "asia-east1-a"
  tags = ["sensor"]

  scheduling {
    preemptible = false
    automatic_restart = true
  }

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-9"
      size = 200
    }
  }

  network_interface {
    # A default network is created for all GCP projects
    network = google_compute_network.vpc_network.self_link
    access_config {
    }
  }
   metadata_startup_script = var.sensor_startup_script
}

resource "google_compute_instance" "sensor_eu" {
  name         = "sensor-eu"
  machine_type = var.sensor_machine_type
  zone         = "europe-west1-c"

  tags = ["sensor"]

  scheduling {
    preemptible = false
    automatic_restart = true
  }

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-9"
      size = 200
    }
  }

  network_interface {
    # A default network is created for all GCP projects
    network = google_compute_network.vpc_network.self_link
    access_config {
    }
  }
   metadata_startup_script = var.sensor_startup_script
}


resource "google_compute_firewall" "allow_sensor" {
  name    = "honeynet-ingress-allow-all"
  network = google_compute_network.vpc_network.self_link

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
  }

  target_tags = ["sensor"]
  source_ranges = ["0.0.0.0/0"]
}

###########################################
#
#     CREATE THE CNC AND FW RULES
#
###########################################


resource "google_compute_instance" "command_and_control" {
  name         = "cnc"
  machine_type = var.cnc_machine_type
  zone         = "us-central1-c"

  tags = ["admin"]

  scheduling {
    preemptible = false
    automatic_restart = true
  }

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-9"
      size = 200
    }
  }

  network_interface {
    # A default network is created for all GCP projects
    network = google_compute_network.vpc_network.self_link
    network_ip = "10.128.0.42"
    access_config {
     
    }
  }
metadata_startup_script = var.cnc_startup_script
}


resource "google_compute_firewall" "allow_admin" {
  name    = "honeynet-ingress-allow-admin"
  network = google_compute_network.vpc_network.self_link

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
    ports = ["64295", "64297", "22"]
  }

  target_tags = ["admin"]
  source_ranges = ["your.ip.address.here"]  
}

resource "google_compute_firewall" "allow_admin_pots" {
  name    = "honeynet-ingress-allow-admin-pots"
  network = google_compute_network.vpc_network.self_link

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
    ports = ["1-21", "23-64294", "64296", "64298-65535"]
  }

  target_tags = ["admin"]
  source_ranges = ["0.0.0.0/0"]  
}



resource "google_compute_firewall" "allow_admin_internal" {
  name    = "honeynet-ingress-allow-admin-internal"
  network = google_compute_network.vpc_network.self_link

  allow {
    protocol = "icmp"
  }

  allow {
    protocol = "tcp"
  }

  target_tags = ["admin"]
  source_ranges = ["10.0.0.0/8"]  
}

variables.tfvars

project_name = "your-project-name-here"
sensor_machine_type =  "n1-standard-1"
sensor_startup_script = "echo aWYgW1sgISAtZiAvZmluaXNoZWQuZmxhZyBdXTsgdGhlbgpzdWRvIGFwdC1nZXQgdXBkYXRlOwpzdWRvIGFwdC1nZXQgaW5zdGFsbCBnaXQgZG9ja2VyLWNvbXBvc2UgYXB0LXRyYW5zcG9ydC1odHRwcyBjYS1jZXJ0aWZpY2F0ZXMgY3VybCBnbnVwZy1hZ2VudCBzb2Z0d2FyZS1wcm9wZXJ0aWVzLWNvbW1vbiAteTsKJChjdXJsIC1mc1NMIGh0dHBzOi8vZG93bmxvYWQuZG9ja2VyLmNvbS9saW51eC9kZWJpYW4vZ3BnIHwgc3VkbyBhcHQta2V5IGFkZCAtKTsKc3VkbyBhcHQta2V5IGZpbmdlcnByaW50IDBFQkZDRDg4IDsKc3VkbyBhZGQtYXB0LXJlcG9zaXRvcnkgImRlYiBbYXJjaD1hbWQ2NF0gaHR0cHM6Ly9kb3dubG9hZC5kb2NrZXIuY29tL2xpbnV4L2RlYmlhbiAkKGxzYl9yZWxlYXNlIC1jcykgc3RhYmxlIjsKc3VkbyBhcHQtZ2V0IHVwZGF0ZSAteTsKc3VkbyBhcHQtZ2V0IGluc3RhbGwgZG9ja2VyLWNlIGRvY2tlci1jZS1jbGkgY29udGFpbmVyZC5pbyAteTsKc3VkbyBnaXQgY2xvbmUgaHR0cHM6Ly9naXRodWIuY29tL3RlbGVrb20tc2VjdXJpdHkvdHBvdGNlOwpjZCB0cG90Y2UvaXNvL2luc3RhbGxlci87CnN1ZG8gY3AgdHBvdC5jb25mLmRpc3QgdHBvdC5jb25mOwpzdWRvIHNlZCAtaSAnNzE1LDcyN2QnIGluc3RhbGwuc2g7CnN1ZG8gLi9pbnN0YWxsLnNoIC0tdHlwZT1hdXRvIC0tY29uZj10cG90LmNvbmY7CnN1ZG8gd2dldCBodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vZWNob2h0cC90ZXN0aW5nLXNvbWV0aGluZy9tYXN0ZXIvc2Vuc29yX3QueW1sIC1QIC9vcHQvdHBvdC9ldGMvIDsKc3VkbyBybSAvb3B0L3Rwb3QvZXRjL3Rwb3QueW1sCnN1ZG8gbXYgL29wdC90cG90L2V0Yy9zZW5zb3JfdC55bWwgL29wdC90cG90L2V0Yy90cG90LnltbApzdWRvIHdnZXQgaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2VjaG9odHAvdGVzdGluZy1zb21ldGhpbmcvbWFzdGVyL2xvZ3N0YXNoLmNvbmYgLVAgL29wdC90cG90L2V0Yy8gOwpzdWRvIHRvdWNoIC9maW5pc2hlZC5mbGFnIDsKc3VkbyByZWJvb3QgLW4KZmk= | base64 -d - | bash"
cnc_machine_type =  "n1-standard-2"
cnc_startup_script = "echo aWYgW1sgISAtZiAvZmluaXNoZWQuZmxhZyBdXTsgdGhlbgpzdWRvIGFwdC1nZXQgdXBkYXRlIApzdWRvIGFwdC1nZXQgaW5zdGFsbCBnaXQgZG9ja2VyLWNvbXBvc2UgYXB0LXRyYW5zcG9ydC1odHRwcyBjYS1jZXJ0aWZpY2F0ZXMgY3VybCBnbnVwZy1hZ2VudCBzb2Z0d2FyZS1wcm9wZXJ0aWVzLWNvbW1vbiBweXRob24zLXBpcCAteSAgOwokKGN1cmwgLWZzU0wgaHR0cHM6Ly9kb3dubG9hZC5kb2NrZXIuY29tL2xpbnV4L2RlYmlhbi9ncGcgfCBzdWRvIGFwdC1rZXkgYWRkIC0pICA7CnN1ZG8gYXB0LWtleSBmaW5nZXJwcmludCAwRUJGQ0Q4OCA7CnN1ZG8gYWRkLWFwdC1yZXBvc2l0b3J5ICJkZWIgW2FyY2g9YW1kNjRdIGh0dHBzOi8vZG93bmxvYWQuZG9ja2VyLmNvbS9saW51eC9kZWJpYW4gJChsc2JfcmVsZWFzZSAtY3MpIHN0YWJsZSIgOwpzdWRvIGFwdC1nZXQgdXBkYXRlIC15IDsKc3VkbyBhcHQtZ2V0IGluc3RhbGwgZG9ja2VyLWNlIGRvY2tlci1jZS1jbGkgY29udGFpbmVyZC5pbyAteSA7CnN1ZG8gZ2l0IGNsb25lIGh0dHBzOi8vZ2l0aHViLmNvbS90ZWxla29tLXNlY3VyaXR5L3Rwb3RjZSA7CmNkIHRwb3RjZS9pc28vaW5zdGFsbGVyLyA7CnN1ZG8gY3AgdHBvdC5jb25mLmRpc3QgdHBvdC5jb25mIDsKc3VkbyBzZWQgLWkgJzcxNSw3MjdkJyBpbnN0YWxsLnNoOwpzdWRvICAuL2luc3RhbGwuc2ggLS10eXBlPWF1dG8gLS1jb25mPXRwb3QuY29uZiAgOwpzdWRvIHJtIC9vcHQvdHBvdC9ldGMvdHBvdC55bWwKc3VkbyB3Z2V0IGh0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9lY2hvaHRwL3Rlc3Rpbmctc29tZXRoaW5nL21hc3Rlci90cG90LnltbCAtUCAvb3B0L3Rwb3QvZXRjLyA7IApzdWRvIHRvdWNoIC9maW5pc2hlZC5mbGFnIDsKc3VkbyByZWJvb3QgLW47CmZp | base64 -d - | bash"