#!/bin/sh
# 
# FTP (WU-FTPD) Honeypot-Script intended for use with 
# Honeyd from Niels Provos 
# -> http://www.citi.umich.edu/u/provos/honeyd/
# 
# Author: Maik Ellinger
# Last modified: 13/06/2002
# Version: 0.0.8
# 
# Changelog: 
# 0.0.6; some ftp comamnds implemented (MKD)
# 
# 0.0.4; some ftp comamnds implemented (CWD)
# 
# 0.0.3: some bugfixes/new commands implemented
#
# 0.0.1: initial release
# 

#set -x -v
DATE=`date`
host=`hostname`
domain=`dnsdomainname`
log=/tmp/honeyd/ftp-$1.log
AUTH="no"
PASS="no"
echo "$DATE: FTP started from $1 Port $2" >> $log
echo -e "220 $host.$domain FTP server (Version wu-2.6.0(5) $DATE) ready.\r"
while read incmd parm1 parm2 parm3 parm4 parm5
do
	# remove control-characters
	incmd=`echo $incmd | sed s/[[:cntrl:]]//g`
	parm1=`echo $parm1 | sed s/[[:cntrl:]]//g`
	parm2=`echo $parm2 | sed s/[[:cntrl:]]//g`
	parm3=`echo $parm3 | sed s/[[:cntrl:]]//g`
	parm4=`echo $parm4 | sed s/[[:cntrl:]]//g`
	parm5=`echo $parm5 | sed s/[[:cntrl:]]//g`

	# convert to upper-case
	incmd_nocase=`echo $incmd | gawk '{print toupper($0);}'`
	#echo $incmd_nocase

	if [ "$AUTH" == "no" ]
        then
	    if [ "$incmd_nocase" != "USER" ]
            then 
		if [ "$incmd_nocase" != "QUIT" ]
    		then 
        	    echo -e "530 Please login with USER and PASS.\r"
		    continue
		fi
	    fi
	fi

	case $incmd_nocase in

	    QUIT* )	
		echo -e "221 Goodbye.\r"
                exit 0;;
	    SYST* )	
		echo -e "215 UNIX Type: L8\r"
                ;;
	    HELP* )
		echo -e "214-The following commands are recognized (* =>'s unimplemented).\r"
		echo -e "   USER    PORT    STOR    MSAM*   RNTO    NLST    MKD     CDUP\r"
		echo -e "   PASS    PASV    APPE    MRSQ*   ABOR    SITE    XMKD    XCUP\r"
		echo -e "   ACCT*   TYPE    MLFL*   MRCP*   DELE    SYST    RMD     STOU\r"
		echo -e "   SMNT*   STRU    MAIL*   ALLO    CWD     STAT    XRMD    SIZE\r"
		echo -e "   REIN*   MODE    MSND*   REST    XCWD    HELP    PWD     MDTM\r"
		echo -e "   QUIT    RETR    MSOM*   RNFR    LIST    NOOP    XPWD\r"
		echo -e "214 Direct comments to ftp@$domain.\r"
		;;
	    USER* )
		parm1_nocase=`echo $parm1 | gawk '{print toupper($0);}'`
		if [ "$parm1_nocase" == "ANONYMOUS" ]
		then
		  echo -e "331 Guest login ok, send your complete e-mail address as a password.\r"
                  AUTH="ANONYMOUS"
		else
		  echo -e "331 Password required for $parm1\r"
                  AUTH=$parm1
		fi
		;;
	    PASS* )
                PASS=$parm1
		if [ "$AUTH" == "ANONYMOUS" ]
		then
		    echo -e "230-Hello User at $1,\r"
		    echo -e "230-we have 911 users (max 1800) logged in in your class at the moment.\r"
		    echo -e "230-Local time is: $DATE\r"
		    echo -e "230-All transfers are logged. If you don't like this, disconnect now.\r"
		    echo -e "230-\r"
		    echo -e "230-tar-on-the-fly and gzip-on-the-fly are implemented; to get a whole\r"
		    echo -e "230-directory \"foo\", \"get foo.tar\" or \"get foo.tar.gz\" may be used.\r"
		    echo -e "230-Please use gzip-on-the-fly only if you need it; most files already\r"
		    echo -e "230-are compressed, and I will kill your processes if you waste my\r"
		    echo -e "230-ressources.\r"
		    echo -e "230-\r"
		    echo -e "230-The command \"site exec locate pattern\" will create a list of all\r"
		    echo -e "230-path names containing \"pattern\".\r"
		    echo -e "230-\r"
		    echo -e "230 Guest login ok, access restrictions apply.\r"
		else
		  echo -e "530 Login incorrect.\r"
		fi
		;;
	    MKD* )
		# choose :
		echo -e "257 \"$parm1\" new directory created.\r"
		#echo -e "550 $parm1: Permission denied.\r"
		;;
	    CWD* )
		# choose :
		echo -e "250 CWD command successful.\r"
		# echo -e "550 $parm1: No such file or directory.\r"
		;;
	    NOOP* )
		echo -e "200 NOOP command successful.\r"
		;;
	    PASV* )
		echo -e "227 Entering Passive Mode (134,76,11,100,165,53)\r"
		;;
	    ACCT* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    SMNT* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    REIN* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MLFL* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MAIL* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MSND* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MSON* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MSAM* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MRSQ* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MRCP* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    MLFL* )
		echo -e "502 $incmd command not implemented.\r"
		;;
	    * )
		echo -e "500 '$incmd': command not understood.\r"
		;;
	esac
	echo -e "$incmd $parm1 $parm2 $parm3 $parm4 $parm5" >> $log
done