Commit Graph

1602 Commits

Author SHA1 Message Date
2f2d458fee Correct TftpClient initialization, close file handle on exception (#458) 2017-02-18 19:28:03 +04:00
a27662efa0 Fix #461 2017-02-16 13:36:59 +00:00
1cf7e02fe1 rename OSX references to MacOS 2017-02-14 22:16:29 +04:00
89fc09d1c2 update changelog 2017-02-12 23:22:07 +04:00
3e87206fbe new option [ssh] forwarding=false this will disable all ssh forwarding 2017-02-12 23:22:07 +04:00
741710ac68 Put tftp usage into 'with' statement, refactored code (#439)
* Put tftp usage into with statement, refactored code

* Report full url instead of just file name
2017-02-08 16:51:37 +08:00
21bbe7fd75 Update busybox.py (#448)
As per commit from @fe7ch

https://github.com/fe7ch/cowrie/commit/9b33509
2017-02-08 16:50:58 +08:00
097a7ceb23 remove database_slack 2017-02-07 05:14:01 +00:00
fb8eb6e095 Merge branch 'master' of https://github.com/micheloosterhof/cowrie 2017-02-07 05:09:12 +00:00
4d1ac60dbf seems we need these 2017-02-07 05:08:55 +00:00
53ccf45c7c Remove redundant [geoip][coordinates] field, since we already have [geoip][location] (added by geoip filter itself) (#440) 2017-02-02 18:11:15 +08:00
e2033c36f3 Append redirection support (#428)
* Add support for '>>' redirection

* Add redir files hashing

* Delete only ">" or ">>" + file name from cmd args

* Update stdin/redir messages to include SHA-256 hash of the file content

* Small style fixes, log if we don't store duplicate

* Bug fixes for wget command

* Use os.path.join instead of string formatting
* Use "with" for hashing a file to prevent handle leakage
* Don't overwrite self.safeoutfile if it was already set in HoneyPotyCommand's init method
* Don't overwrite self.safeoutfile with hash, else it will break stuff in insults.py

* Revert "Delete only ">" or ">>" + file name from cmd args"

This reverts commit f3f8b90cbe.

* Fix bugged check for presence of safeoutfile attribute.

* Don't overwrite safeoutfile in curl

* Don't store None objects

* Include transportId and sessionId to all safeoutfiles to avoid collisions.
2017-02-01 02:53:31 +08:00
7f003c2da3 in README.md refer to requirements.txt 2017-01-30 14:33:29 +04:00
8307b86e4d Remove empty tftp files, double logging fix (#430)
* Remove empty tftp files, double logging fix

* Remove duplicate of os.symlink() call, add transportID, sessionID to safeoutfile name

* Remove empty file in case of exception
2017-01-28 15:55:14 +08:00
fbf2dbaf3c Mongo Output (#413)
* Extend mongo output to use more collections. Matching the style of the other output methods

* Start to update session from other keys

* Logging and endtime in to session
2017-01-27 15:16:11 +08:00
4711b1108a Remove entries from honeyfs/proc/mounts that does not have corresponding folders. (#423) 2017-01-27 14:43:08 +08:00
74916c1d72 Fix paths for egrep/fgrep commands (#426)
* Support grep/egrep/fgrep without full path

* Fixed path for egrep/fgrep

* There is no grep/egrep/fgrep in /usr/bin in standard cowrie's fs.pickle.
2017-01-27 14:42:07 +08:00
0757e057ae Prevent cowrie from crashing on invalid host for wget (#429)
Thanks for submitting this!
2017-01-27 14:40:55 +08:00
ce6b996de0 Fixed IndexError caused by intentionally constructed empty cmdstack (#418)
Thanks!
2017-01-23 11:07:10 +08:00
c58056b01a Refuse to enable SGA and LINEMODE during authentication (#415)
Some telnet clients attempt to initiate negotiation about SGA and LINEMODE themselves, but only when a port isn't specified on the command line. If we allow them to enable SGA or LINEMODE, they change from sending a newline character when enter is pressed to sending a carriage return.  Cowrie can't handle this properly at the login prompt, which prevents the client from being able to login.

I left the old code commented out so it is easier re-enable once Cowrie/Twisted support the Telnet protocol better.

Fixes #414
2017-01-21 14:30:31 +08:00
2152a73cc6 Ignore parentheses in command. Fixed issue #361 (#416) 2017-01-21 14:28:50 +08:00
8c3286276a Move mongodb.py file to correct location. (#410) 2017-01-15 00:44:48 +04:00
eb638750a1 Added MongoDB output support (#407) 2017-01-13 17:57:19 +04:00
cf16ff398e Elk doc update (#408)
* Update logstash's configuration to reflect changes in maxmind's geoip databases

* Update documentation on "ELK Stack"

* Add sample of filebeat configuration

* Update documentation for "ELK Stack" with FileBeat option

* Add some tips on configuration of kibana

* Remove outdated kibana-cowrie.conf

* Add link to XPack
2017-01-13 17:56:35 +04:00
df735dd286 Update dshield.py (#404) 2017-01-11 21:53:31 +04:00
6380825960 Update dshield.py (#401)
fix for dshield.py
2017-01-10 21:43:06 +04:00
37f178a915 Fixed issue #398 (#399) 2017-01-08 21:29:20 +04:00
6e36f98863 Merge branch 'master' of https://github.com/micheloosterhof/cowrie 2017-01-06 00:44:12 +04:00
ed3ac80fa3 Fix #385 by implementing telnet_Command (#392) 2017-01-05 17:48:59 +04:00
cbb02c7f04 Fixes #396 (#397) 2017-01-05 10:33:23 +04:00
0254a78d53 Updated to correct PIDFile path for cowrie.service (#395)
* Updated service template to use the virtual-env and proper PID file location

* Fixed PIDFile path in cowrie.service template

* Revert "Fixed PIDFile path in cowrie.service template"

This reverts commit 022afb7134.

* Revert "Revert "Fixed PIDFile path in cowrie.service template""

This reverts commit 5b01372176.

Revert changes

* Fixed PIDFile path in cowrie.service template

* Updated to correct PIDFile path for cowrie.service
2017-01-04 23:26:53 +04:00
439ef8499f Fixed PIDFile path in cowrie.service template (#394)
* Updated service template to use the virtual-env and proper PID file location

* Fixed PIDFile path in cowrie.service template

* Revert "Fixed PIDFile path in cowrie.service template"

This reverts commit 022afb7134.

* Revert "Revert "Fixed PIDFile path in cowrie.service template""

This reverts commit 5b01372176.

Revert changes

* Fixed PIDFile path in cowrie.service template
2017-01-04 22:19:25 +04:00
1685f3af79 ignore trial dirs 2017-01-02 14:54:59 +04:00
24c251b405 Improve handling of ImportErrors to notify users that they need to install new dependencies (#389)
* Improve handling of ImportErrors to notify users that they need to install new dependencies

Also added missing dependency to requirements.txt

* Mention installing dependencies in virtualenv if used

* Move requirements used only by output modules to a separate file

* Using a virtualenv is now the only officially supported method

* Handle ImportErrors when loading output plugins so different install instructions can be given

* Cleanup requirements-output.txt
2017-01-01 21:18:59 +04:00
ccbd05746e Updated service template to use the virtual-env and proper PID file location (#387) 2017-01-01 21:17:28 +04:00
a1675e3cea remove interact feature 2016-12-20 11:40:26 +00:00
20e6984793 fix telnet memory leak? 2016-12-20 08:02:08 +00:00
a320ae5145 debug code removed 2016-12-20 07:40:45 +00:00
345e36fab1 remove old dblog plugins 2016-12-20 07:19:50 +00:00
0ad2e65ef7 Merge branch 'master' of https://github.com/micheloosterhof/cowrie
Conflicts:
	start.sh
2016-12-20 07:18:24 +00:00
1a462eafe6 Documentation and start script changes to assist with supervisord usage (#346)
* * Updating start script to run in the foreground when using supervisord.
* Update install documentation to reference use of supervisord and install on OSX

* Updating index of INSTALL.md to with reference to supervisord

* Adding slack output and db

* Restoring start.sh back to default of AUTHBIND_ENABLED=no and DAEMONIZE=no

* Updating with pretty formatting of json dump
2016-12-20 11:15:28 +04:00
83065bcaeb use $PIDFILE instead of fixedname 2016-12-19 06:49:04 +00:00
1a0ed7baa6 Fix exception in connectionLost due to not passing self (#382) 2016-12-19 10:47:34 +04:00
cde3f71d4b fix call 2016-12-18 15:42:10 +00:00
b64d0d3802 set interactive timeout to 3min 2016-12-18 15:10:29 +04:00
95ce0f0fec unset session 2016-12-18 15:07:29 +04:00
ee177d5482 remove circular references 2016-12-18 15:01:38 +04:00
393d770713 remove drive 2016-12-18 14:32:24 +04:00
b134f9d791 clear references on connectionLost 2016-12-18 14:29:11 +04:00
8dc54822cf Added ftpget command. (#379) 2016-12-17 22:43:33 +04:00