mirror of
https://github.com/aljazceru/cowrie.git
synced 2025-12-17 05:54:21 +01:00
914e704b11
* Improve handling of ImportErrors to notify users that they need to install new dependencies Also added missing dependency to requirements.txt * Mention installing dependencies in virtualenv if used * Improve handling of ImportErrors to notify users that they need to install new dependencies Also added missing dependency to requirements.txt * Mention installing dependencies in virtualenv if used * Move requirements used only by output modules to a separate file * Using a virtualenv is now the only officially supported method * Handle ImportErrors when loading output plugins so different install instructions can be given
Welcome to the Cowrie GitHub repository
This is the official repository for the Cowrie SSH and Telnet Honeypot effort.
What is Cowrie
Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.
Cowrie is developed by Michel Oosterhof.
Features
Some interesting features:
- Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
- Possibility of adding fake file contents so the attacker can
catfiles such as/etc/passwd. Only minimal file contents are included - Session logs stored in an UML Compatible format for easy replay with original timings
- Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection
Additional functionality over standard kippo:
- SFTP and SCP support for file upload
- Support for SSH exec commands
- Logging of direct-tcp connection attempts (ssh proxying)
- Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
- Logging in JSON format for easy processing in log management solutions
- Many, many additional commands
Requirements
Software required:
- Python 2.7+, (Python 3 not yet supported due to Twisted dependencies)
- Zope Interface 3.6.0+
- Twisted 12.0+
- python-crypto
- python-cryptography
- python-pyasn1
- python-gmpy2 (recommended)
- python-mysqldb (for MySQL output)
- python-OpenSSL
Files of interest:
etc/cowrie.cfg- Cowrie's configuration file. Default values can be found inetc/cowrie.cfg.distetc/userdb.txt- credentials allowed or disallowed to access the honeypotvar/log/cowrie/cowrie.log- Twisted format logvar/log/cowrie/cowrie.json- transaction output in JSON formatvar/lib/ttylog/- session logs UML formatvar/lib/dl/- files transferred from the attacker to the honeypot are stored hereshare/cowrie/fs.pickle- fake filesystemshare/cowrie/txtcmds/- file contents for fake commandsshare/cowrie/honeyfs/- file contents for the fake filesystembin/createfs- used to create the honeypot filesystembin/playlog- utility to replay session logs in UML format
Is it secure?
Maybe. See FAQ
I have some questions!
Please visit https://github.com/micheloosterhof/cowrie/issues
Contributors
Many people have contributed to Cowrie over the years. Special thanks to:
- Upi Tamminen (desaster) for all his work developing Kippo on which Cowrie was based