cowrie/cowrie
1
0
Fork 0
mirror of https://github.com/cowrie/cowrie.git synced 2025-07-01 18:07:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

use log msg command.input rather than command.success

Browse Source 
This is done because many multi-command lines now come in. Better to log the full individual line rather than the parsed individual parts
This commit is contained in:
Michel Oosterhof
2018-02-07 06:11:24 +00:00
parent 99c16f49c0
commit 1fe013cff0
7 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cowrie/core/output.py
View File

@ -46,7 +46,7 @@ import time
# cowrie.client.version
# cowrie.command.input
# cowrie.command.failed
# cowrie.command.success
# cowrie.command.success (deprecated)
# cowrie.direct-tcpip.data
# cowrie.direct-tcpip.request
# cowrie.log.closed

2
cowrie/output/hpfeeds.py
View File

@ -302,7 +302,7 @@ class Output(cowrie.core.output.Output):
u, p = entry['username'], entry['password']
self.meta[session]['credentials'].append((u, p))
elif entry["eventid"] == 'cowrie.command.success':
elif entry["eventid"] == 'cowrie.command.input':
c = entry['input']
self.meta[session]['commands'].append(c)

3
cowrie/output/influx.py
View File

@ -112,8 +112,7 @@ class Output(cowrie.core.output.Output):
}
# event parsing
if eventid in ['cowrie.command.success',
'cowrie.command.failed',
if eventid in ['cowrie.command.failed',
'cowrie.command.input']:
m['fields'].update({
'input': entry['input'],

2
cowrie/output/mongodb.py
View File

@ -90,7 +90,7 @@ class Output(cowrie.core.output.Output):
elif eventid in ['cowrie.login.success', 'cowrie.login.failed']:
self.insert_one(self.col_auth, entry)
elif eventid in ['cowrie.command.success', 'cowrie.command.failed']:
elif eventid in ['cowrie.command.input', 'cowrie.command.failed']:
self.insert_one(self.col_input, entry)
elif eventid == 'cowrie.session.file_download':

2
cowrie/output/mysql.py
View File

@ -135,7 +135,7 @@ class Output(cowrie.core.output.Output):
(entry["session"], 0, entry['username'], entry['password'],
entry["time"]))
elif entry["eventid"] == 'cowrie.command.success':
elif entry["eventid"] == 'cowrie.command.input':
self.simpleQuery('INSERT INTO `input`' + \
' (`session`, `timestamp`, `success`, `input`)' + \
' VALUES (%s, FROM_UNIXTIME(%s), %s , %s)',

2
cowrie/output/sqlite.py
View File

@ -96,7 +96,7 @@ class Output(cowrie.core.output.Output):
(entry["session"], 0, entry['username'], entry['password'],
entry["timestamp"]))
elif entry["eventid"] == 'cowrie.command.success':
elif entry["eventid"] == 'cowrie.command.input':
self.simpleQuery('INSERT INTO `input`' + \
' (`session`, `timestamp`, `success`, `input`)' + \
' VALUES (?, ?, ?, ?)',

2
cowrie/shell/honeypot.py
View File

@ -356,7 +356,7 @@ class HoneyPotShell(object):
cmdclass = self.protocol.getCommand(cmd['command'], environ['PATH'] .split(':'))
if cmdclass:
log.msg(eventid='cowrie.command.success', input=cmd['command'] + " " + ' '.join(cmd['rargs']), format='Command found: %(input)s')
log.msg(input=cmd['command'] + " " + ' '.join(cmd['rargs']), format='Command found: %(input)s')
if index == len(cmd_array)-1:
lastpp = StdOutStdErrEmulationProtocol(self.protocol, cmdclass, cmd['rargs'], None, None)
pp = lastpp