Flamingo

Flamingo#

Flamingo captures credentials sprayed across the network by IT and security products. Run it on a defended host or a redirector to soak up SSH, HTTP, LDAP, DNS, FTP, and SNMP scanner logins.

Build#

Grab the binary from releases or build from source.

$ GOOS=win32 GOARCH=amd64 go build -o flamingo.exe
$ go get -u -v github.com/atredispartners/flamingo && \
    go install -v github.com/atredispartners/flamingo && \
    $GOPATH/bin/flamingo

Run#

Run the binary and collect credentials.

C:\> flamingo.exe

Sample output.

{"_etime":"2020-01-10T17:56:51Z","_host":"1.2.3.4:18301","_proto":"ssh",
 "method":"pubkey","pubkey":"ssh-ed25519 AAAAC3...","pubkey-sha256":"SHA256:7UkX...",
 "username":"devuser","version":"SSH-2.0-OpenSSH_for_Windows_7.7"}
{"_etime":"2020-01-10T17:56:52Z","_host":"1.2.3.4:1361","_proto":"ssh",
 "method":"password","password":"SuperS3kr3t^!","username":"root",
 "version":"SSH-2.0-OpenSSH_for_Windows_7.7"}
{"_etime":"2020-01-10T17:56:53Z","_host":"1.2.3.4:9992","_proto":"ssh",
 "method":"password","password":"DefaultPotato","username":"vulnscan-a",
 "version":"SSH-2.0-OpenSSH_for_Windows_7.7"}

Default log path is flamingo.log in the working directory plus standard output.

Options#

  • --protocols, configure enabled protocol listeners. Use additional options to specify ports and protocol options. Remaining command-line arguments are output destinations.

Outputs#

Flamingo can write recorded credentials to several formats. By default it logs to flamingo.log and standard output.

  • Standard output, specifying - or stdout restricts output to standard output only.

  • File destinations, specifying one or more file paths appends to those files.

  • HTTP destinations, specifying HTTP / HTTPS URLs sends a webhook POST per credential. Supports Slack, Mattermost, and other inbound webhook platforms.

HTTP POST format.

POST /specified-url
Content-Type: application/json
User-Agent: flamingo/v0.0.0

{"text": "full-json-output of credential report"}

Syslog#

Specifying syslog or syslog:<parameters> ships credentials to syslog. Supported forms:

  • syslog, default syslog output (unix socket).

  • syslog:unix:/dev/log, specific unix stream socket.

  • syslog:host, host using UDP and port 514.

  • syslog:host:port, host using UDP and a specific port.

  • syslog:udp:host and syslog:udp:host:port, UDP variants.

  • syslog:tcp:host and syslog:tcp:host:port, TCP variants.

  • syslog:tcp+tls:host and syslog:tcp+tls:host:port, TLS over TCP.

References#

Contents