Get password info and feed it to my own TI

[IronT3cH]

Hi guys,

Actually, I have a research lab, I have distributed TPOT with 1 hive and 1 sensor. I want to feed all the password attempts I have collected to my own "kind of TI". The idea is I want to its information in real-time.

Can someone give me an idea how to make it ?

Thank you.

[dmille6]

there are a bunch of ways to do it, all are based around doing queries to the elasticsearch database that tpot uses.

usernames and passwords are stored in the fields "username" and "password" I think.. so you'd just query for all the results in a time period that have the field "username" and "password".. you can get fancy and make a query that only pulls the aggrigated unique values.

you can do it with curl, python.. whatever you'd like.
unless you want to open up a port on your hive server, you'd want to do that query on the hive server. then push the results where you want them.
OpenCTI is a good open source security/intelligence app. you could throw each log/password into one of OpenCTI's credential objects.

[dmille6]

here is some quick python code from chatGPT that will at least give you a place to start:

ChatGPT Prompt: "i need a python example of querying elasticsearch index "logstash-*" for all the unique entries in the fields "username" and "password" over the last hour, from an elasticsearch server on localhost"

from elasticsearch import Elasticsearch
from datetime import datetime, timedelta

# Connect to the Elasticsearch server running on localhost
es = Elasticsearch(["http://localhost:9200"])

# Get the current time and the time one hour ago
now = datetime.utcnow()
one_hour_ago = now - timedelta(hours=1)

# Define the query to filter documents within the last hour
query = {
    "bool": {
        "must": [
            {
                "range": {
                    "@timestamp": {
                        "gte": one_hour_ago.isoformat(),
                        "lte": now.isoformat(),
                        "format": "strict_date_optional_time"
                    }
                }
            }
        ]
    }
}

# Define composite aggregation for unique combinations of username and password
aggs = {
    "unique_user_pass_combinations": {
        "composite": {
            "sources": [
                {"username": {"terms": {"field": "username.keyword"}}},
                {"password": {"terms": {"field": "password.keyword"}}}
            ],
            "size": 1000  # Adjust size based on your expected cardinality and limits
        }
    }
}

# Perform the search with aggregation
response = es.search(
    index="logstash-*",
    body={
        "query": query,
        "size": 0,  # We don't need the actual documents, just the aggregation
        "aggs": aggs
    }
)

# Extract and print unique username-password combinations
buckets = response['aggregations']['unique_user_pass_combinations']['buckets']
print("Unique Username-Password Combinations:")
for bucket in buckets:
    username = bucket['key']['username']
    password = bucket['key']['password']
    print(f"Username: {username}, Password: {password}")