Commit Graph

1492 Commits

Author SHA1 Message Date
53ccf45c7c Remove redundant [geoip][coordinates] field, since we already have [geoip][location] (added by geoip filter itself) (#440) 2017-02-02 18:11:15 +08:00
e2033c36f3 Append redirection support (#428)
* Add support for '>>' redirection

* Add redir files hashing

* Delete only ">" or ">>" + file name from cmd args

* Update stdin/redir messages to include SHA-256 hash of the file content

* Small style fixes, log if we don't store duplicate

* Bug fixes for wget command

* Use os.path.join instead of string formatting
* Use "with" for hashing a file to prevent handle leakage
* Don't overwrite self.safeoutfile if it was already set in HoneyPotyCommand's init method
* Don't overwrite self.safeoutfile with hash, else it will break stuff in insults.py

* Revert "Delete only ">" or ">>" + file name from cmd args"

This reverts commit f3f8b90cbe.

* Fix bugged check for presence of safeoutfile attribute.

* Don't overwrite safeoutfile in curl

* Don't store None objects

* Include transportId and sessionId to all safeoutfiles to avoid collisions.
2017-02-01 02:53:31 +08:00
7f003c2da3 in README.md refer to requirements.txt 2017-01-30 14:33:29 +04:00
8307b86e4d Remove empty tftp files, double logging fix (#430)
* Remove empty tftp files, double logging fix

* Remove duplicate of os.symlink() call, add transportID, sessionID to safeoutfile name

* Remove empty file in case of exception
2017-01-28 15:55:14 +08:00
fbf2dbaf3c Mongo Output (#413)
* Extend mongo output to use more collections. Matching the style of the other output methods

* Start to update session from other keys

* Logging and endtime in to session
2017-01-27 15:16:11 +08:00
4711b1108a Remove entries from honeyfs/proc/mounts that does not have corresponding folders. (#423) 2017-01-27 14:43:08 +08:00
74916c1d72 Fix paths for egrep/fgrep commands (#426)
* Support grep/egrep/fgrep without full path

* Fixed path for egrep/fgrep

* There is no grep/egrep/fgrep in /usr/bin in standard cowrie's fs.pickle.
2017-01-27 14:42:07 +08:00
0757e057ae Prevent cowrie from crashing on invalid host for wget (#429)
Thanks for submitting this!
2017-01-27 14:40:55 +08:00
ce6b996de0 Fixed IndexError caused by intentionally constructed empty cmdstack (#418)
Thanks!
2017-01-23 11:07:10 +08:00
c58056b01a Refuse to enable SGA and LINEMODE during authentication (#415)
Some telnet clients attempt to initiate negotiation about SGA and LINEMODE themselves, but only when a port isn't specified on the command line. If we allow them to enable SGA or LINEMODE, they change from sending a newline character when enter is pressed to sending a carriage return.  Cowrie can't handle this properly at the login prompt, which prevents the client from being able to login.

I left the old code commented out so it is easier re-enable once Cowrie/Twisted support the Telnet protocol better.

Fixes #414
2017-01-21 14:30:31 +08:00
2152a73cc6 Ignore parentheses in command. Fixed issue #361 (#416) 2017-01-21 14:28:50 +08:00
8c3286276a Move mongodb.py file to correct location. (#410) 2017-01-15 00:44:48 +04:00
eb638750a1 Added MongoDB output support (#407) 2017-01-13 17:57:19 +04:00
cf16ff398e Elk doc update (#408)
* Update logstash's configuration to reflect changes in maxmind's geoip databases

* Update documentation on "ELK Stack"

* Add sample of filebeat configuration

* Update documentation for "ELK Stack" with FileBeat option

* Add some tips on configuration of kibana

* Remove outdated kibana-cowrie.conf

* Add link to XPack
2017-01-13 17:56:35 +04:00
df735dd286 Update dshield.py (#404) 2017-01-11 21:53:31 +04:00
6380825960 Update dshield.py (#401)
fix for dshield.py
2017-01-10 21:43:06 +04:00
37f178a915 Fixed issue #398 (#399) 2017-01-08 21:29:20 +04:00
6e36f98863 Merge branch 'master' of https://github.com/micheloosterhof/cowrie 2017-01-06 00:44:12 +04:00
ed3ac80fa3 Fix #385 by implementing telnet_Command (#392) 2017-01-05 17:48:59 +04:00
cbb02c7f04 Fixes #396 (#397) 2017-01-05 10:33:23 +04:00
0254a78d53 Updated to correct PIDFile path for cowrie.service (#395)
* Updated service template to use the virtual-env and proper PID file location

* Fixed PIDFile path in cowrie.service template

* Revert "Fixed PIDFile path in cowrie.service template"

This reverts commit 022afb7134.

* Revert "Revert "Fixed PIDFile path in cowrie.service template""

This reverts commit 5b01372176.

Revert changes

* Fixed PIDFile path in cowrie.service template

* Updated to correct PIDFile path for cowrie.service
2017-01-04 23:26:53 +04:00
439ef8499f Fixed PIDFile path in cowrie.service template (#394)
* Updated service template to use the virtual-env and proper PID file location

* Fixed PIDFile path in cowrie.service template

* Revert "Fixed PIDFile path in cowrie.service template"

This reverts commit 022afb7134.

* Revert "Revert "Fixed PIDFile path in cowrie.service template""

This reverts commit 5b01372176.

Revert changes

* Fixed PIDFile path in cowrie.service template
2017-01-04 22:19:25 +04:00
1685f3af79 ignore trial dirs 2017-01-02 14:54:59 +04:00
24c251b405 Improve handling of ImportErrors to notify users that they need to install new dependencies (#389)
* Improve handling of ImportErrors to notify users that they need to install new dependencies

Also added missing dependency to requirements.txt

* Mention installing dependencies in virtualenv if used

* Move requirements used only by output modules to a separate file

* Using a virtualenv is now the only officially supported method

* Handle ImportErrors when loading output plugins so different install instructions can be given

* Cleanup requirements-output.txt
2017-01-01 21:18:59 +04:00
ccbd05746e Updated service template to use the virtual-env and proper PID file location (#387) 2017-01-01 21:17:28 +04:00
a1675e3cea remove interact feature 2016-12-20 11:40:26 +00:00
20e6984793 fix telnet memory leak? 2016-12-20 08:02:08 +00:00
a320ae5145 debug code removed 2016-12-20 07:40:45 +00:00
345e36fab1 remove old dblog plugins 2016-12-20 07:19:50 +00:00
0ad2e65ef7 Merge branch 'master' of https://github.com/micheloosterhof/cowrie
Conflicts:
	start.sh
2016-12-20 07:18:24 +00:00
1a462eafe6 Documentation and start script changes to assist with supervisord usage (#346)
* * Updating start script to run in the foreground when using supervisord.
* Update install documentation to reference use of supervisord and install on OSX

* Updating index of INSTALL.md to with reference to supervisord

* Adding slack output and db

* Restoring start.sh back to default of AUTHBIND_ENABLED=no and DAEMONIZE=no

* Updating with pretty formatting of json dump
2016-12-20 11:15:28 +04:00
83065bcaeb use $PIDFILE instead of fixedname 2016-12-19 06:49:04 +00:00
1a0ed7baa6 Fix exception in connectionLost due to not passing self (#382) 2016-12-19 10:47:34 +04:00
cde3f71d4b fix call 2016-12-18 15:42:10 +00:00
b64d0d3802 set interactive timeout to 3min 2016-12-18 15:10:29 +04:00
95ce0f0fec unset session 2016-12-18 15:07:29 +04:00
ee177d5482 remove circular references 2016-12-18 15:01:38 +04:00
393d770713 remove drive 2016-12-18 14:32:24 +04:00
b134f9d791 clear references on connectionLost 2016-12-18 14:29:11 +04:00
8dc54822cf Added ftpget command. (#379) 2016-12-17 22:43:33 +04:00
115ccd6886 Telnet negotiation errors (#380)
* Telnet option negotiation now chained and handled better to prevent logging expected errors

Also added support for parsing NAWS negotiation and setting windowSize accordingly
This still needs more work to realistically behave like other Telnet servers, but it is limited significantly by Twisted's limited option support and Telnet clients' inconsistent behavior

* While not standard, negotiating these options here does result in better client behavior

* Cleanup old comments and unused code
2016-12-16 11:56:17 +04:00
30d08f6347 Fix Setup Virtual Environment anchor in install doc (#377) 2016-12-15 12:05:29 +04:00
82e3b1fccd remove non-virtual environment from install doc 2016-12-11 15:40:00 +04:00
f785711a1f logDispatch not required here 2016-12-11 15:27:26 +04:00
1c527a5910 style changes tftp 2016-12-11 15:15:24 +04:00
d6b9115ba7 cowrie script needs to be bash 2016-12-11 15:05:00 +04:00
0fda46b933 Remove redundant space, handle double slashes in escape string (#340) 2016-12-11 14:53:44 +04:00
Wes
c0aecda450 re-factored a bit, added telnet support (#375) 2016-12-11 14:52:21 +04:00
2102b1b9e1 Hash files downloaded via tftp (#363) 2016-12-11 02:15:50 +04:00
98b907b26d Merge branch 'master' of https://github.com/micheloosterhof/cowrie
Conflicts:
	cowrie/output/csirtg.py
2016-12-06 17:46:06 +00:00