Add support for custom commands that mimic actual malware based on their file

name or size


git-svn-id: https://kippo.googlecode.com/svn/trunk@203 951d7100-d841-11de-b865-b3884708a8e2

kippo/commands/tar.py

@@ -3,11 +3,20 @@
 
 from kippo.core.honeypot import HoneyPotCommand
 from kippo.core.fs import *
-from kippo.commands import dice
+from kippo.commands import dice, malware
 import time, random, tarfile, os
 
 commands = {}
 
+def pick_handler(cmd, size):
+    if size in malware.slist:
+        handler = malware.slist[size]
+    elif cmd in malware.clist:
+        handler = malware.clist[cmd]
+    else:
+        handler = random.choice(dice.clist)
+    return handler
+
 class command_tar(HoneyPotCommand):
     def mkfullpath(self, path, f):
         l, d = path.split('/'), []
@@ -66,7 +75,8 @@ class command_tar(HoneyPotCommand):
             elif f.isfile():
                 self.mkfullpath(os.path.dirname(dest), f)
                 self.fs.mkfile(dest, 0, 0, f.size, f.mode, f.mtime)
-                self.honeypot.commands[dest] = random.choice(dice.clist)
+                self.honeypot.commands[dest] = \
+                    pick_handler(os.path.basename(dest), f.size)
             else:
                 print 'tar: skipping [%s]' % f.name
 commands['/bin/tar'] = command_tar