How mr-r3b00t/honey_cracked works
This is an RDP credential honeypot: it accepts remote connection attempts, negotiates an RDP security path, captures plaintext credentials or a NetNTLMv2 hash, and closes the connection without forwarding it. An analyzer reports on stored captures and can check guesses against named accounts. The README also documents password-cracking materials, but the supplied tree does not include the stated listener, analyzer, or wordlists directory; their paths below follow README filenames. No source excerpts were available, so internal call ownership beyond documented behavior is omitted.
Main entry points: CRACKING.md Cracking runbook · passwords.txt Password lists · ntlm_hashes_51K.txt Hash lists · generator_space.rule Cracking rules
Components 17
Credential capture
- RDP listener
- Security negotiation
- TLS credentials
- Legacy credentials
- NLA credentials
- Capture database
- Capture exports
- NLA source state
Capture analysis
- Capture analyzer
- Reports and checks
Cracking materials
- Cracking runbook
CRACKING.md - Password lists
passwords.txt - Hash lists
ntlm_hashes_51K.txt - Cracking rules
generator_space.rule - Observed patterns
observed.hcmask
Other components
- RDP client
- Honeypot operator
Connections 17
- RDP client → RDP listener: connects via RDP
- RDP listener → Security negotiation: negotiates security
- Security negotiation → TLS credentials: selects TLS
- Security negotiation → Legacy credentials: selects legacy
- Security negotiation → NLA credentials: offers NLA
- TLS credentials → Capture database: records plaintext
- Legacy credentials → Capture database: records plaintext
- NLA credentials → Capture database: records hash
- RDP listener → Capture exports: writes captures
- RDP listener → NLA source state: persists refusals
- Capture analyzer → Capture database: reads captures
- Capture analyzer → Reports and checks: produces reports
- Honeypot operator → Capture analyzer: runs analysis
- Cracking runbook → Password lists: uses lists
- Cracking runbook → Hash lists: uses hashes
- Cracking runbook → Cracking rules: uses rules
- Cracking runbook → Observed patterns: uses patterns