mirror of
https://github.com/aljazceru/cowrie.git
synced 2026-02-19 13:24:27 +01:00
15cdfa4b10
* Can run LS in TEST assertion. Having a problem when assert ends with this: DirtyReactorAggregateError: Reactor was unclean * First Test Case Enabled Modified Example configuration file Added some test unit cases for all BASE commands Some more additions to FakeTransport. Used Official Config file instead of mock config Separated FakeTransport from unitTests Added FS commands to testing Fixed up some problems with grep in test case You can now run unit tests with trial. We should probably copy over the data files in a script to a common location....however to run unit tests using trial trial cowrie/unittests/TestBaseCommands.py Fixed rmdir test. Fixed Some Formatting for TwistedChecker
Cowrie
Cowrie is a medium interaction SSH honeypot designed to log brute force attacks and the shell interaction performed by the attacker.
Cowrie is developed by Michel Oosterhof and is based on Kippo by Upi Tamminen (desaster).
Features
Some interesting features:
- Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
- Possibility of adding fake file contents so the attacker can
catfiles such as/etc/passwd. Only minimal file contents are included - Session logs stored in an UML Compatible format for easy replay with original timings
- Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection
Additional functionality over standard kippo:
- SFTP and SCP support for file upload
- Support for SSH exec commands
- Logging of direct-tcp connection attempts (ssh proxying)
- Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
- Logging in JSON format for easy processing in log management solutions
- Many, many additional commands
Requirements
Software required:
- An operating system (tested on Debian, CentOS, FreeBSD and Windows 7)
- Python 2.7+
- Twisted 8.0+
- python-crypto
- python-pyasn1
- python-gmpy2 (recommended)
- python-mysqldb (for MySQL output)
- Zope Interface 3.6.0+
Files of interest:
cowrie.cfg- Cowrie's configuration file. Default values can be found incowrie.cfg.distdata/fs.pickle- fake filesystemdata/userdb.txt- credentials allowed or disallowed to access the honeypotdl/- files transferred from the attacker to the honeypot are stored herehoneyfs/- file contents for the fake filesystem - feel free to copy a real system here or usebin/fsctllog/cowrie.json- transaction output in JSON formatlog/cowrie.log- log/debug outputlog/tty/*.log- session logstxtcmds/- file contents for the fake commandsbin/createfs- used to create the fake filesystembin/playlog- utility to replay session logs
Is it secure?
Maybe. See FAQ
I have some questions!
Please visit https://github.com/micheloosterhof/cowrie/issues