-
添加了日志中外网IP的json字段,格式为
{"dest_ip": 127.0.0.1}
-
修改了Linux下free
命令的内存大小。因更新后cowrie实现了简单的动态显示内存,暂时使用该功能,暂未进行测试。
-
修改hostname为ubuntu
,文件路径为:honeyfs/etc/hostname
这个需要使用配置文件中的hostname字段进行修改。
-
修改pre-login banner为
Ubuntu 16.04.5 LTS \n \l
,文件路径为:honeyfs/etc/issuel
-
修改post-login banner为以下,文件路径为:
honeyfs\etc\motd
Welcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-1066-aws x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage Get cloud support with Ubuntu Advantage Cloud Guest: http://www.ubuntu.com/business/services/cloud 0 packages can be updated. 0 updates are security updates. Last login: Mon Aug 27 06:27:10 2018 from 127.0.0.1
-
修改cpu信息为
Intel(R) Xeon(R) CPU X5650 @ 2.67GHz
,文件路径为:honeyfs/proc/cpuinfo
- 定时删除日志?
This is the official repository for the Cowrie SSH and Telnet Honeypot effort.
Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.
Cowrie is developed by Michel Oosterhof.
You can join the Cowrie community at the following Slack workspace
Some interesting features:
-
Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
-
Possibility of adding fake file contents so the attacker can
cat
files such as/etc/passwd
. Only minimal file contents are included -
Session logs are stored in an UML Compatible format for easy replay with original timings with the
bin/playlog
utility. -
Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection log Additional functionality over standard kippo:
-
SFTP and SCP support for file upload
-
Support for SSH exec commands
-
Logging of direct-tcp connection attempts (ssh proxying)
-
Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
-
Logging in JSON format for easy processing in log management solutions
-
Many, many additional commands
Docker versions are available.
- Get the Dockerfile directly at https://github.com/cowrie/docker-cowrie
- Run from Docker Hub with:
docker pull cowrie/cowrie
Software required:
- Python 2.7+, (Limited Python 3 support available for SSH only)
- python-virtualenv
For Python dependencies, see requirements.txt
cowrie.cfg
- Cowrie's configuration file. Default values can be found inetc/cowrie.cfg.dist
share/cowrie/fs.pickle
- fake filesystemetc/userdb.txt
- credentials allowed or disallowed to access the honeypothoneyfs/
- file contents for the fake filesystem - feel free to copy a real system here or usebin/fsctl
honeyfs/etc/issue.net
- pre-login bannerhoneyfs/etc/motd
- post-login bannervar/log/cowrie/cowrie.json
- transaction output in JSON formatvar/log/cowrie/cowrie.log
- log/debug outputvar/lib/cowrie/tty/
- session logs, replayable with thebin/playlog
utility.var/lib/cowrie/downloads/
- files transferred from the attacker to the honeypot are stored hereshare/cowrie/txtcmds/
- file contents for simple fake commandsbin/createfs
- used to create the fake filesystembin/playlog
- utility to replay session logs
Maybe. See FAQ
Please visit https://cowrie.slack.com/ and join the #questions channel
Many people have contributed to Cowrie over the years. Special thanks to:
- Upi Tamminen (desaster) for all his work developing Kippo on which Cowrie was based
- Dave Germiquet (davegermiquet) for TFTP support, unit tests, new process handling
- Olivier Bilodeau (obilodeau) for Telnet support
- Ivan Korolev (fe7ch) for many improvements over the years.
- Florian Pelgrim (craneworks) for his work on code cleanup and Docker.
- And many many others.