Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ls command in cowrie shell does not have working -h flag #1756

Open
n0kovo opened this issue Aug 22, 2022 · 3 comments
Open

ls command in cowrie shell does not have working -h flag #1756

n0kovo opened this issue Aug 22, 2022 · 3 comments

Comments

@n0kovo
Copy link

n0kovo commented Aug 22, 2022

I'm seeing a lot of attack scripts disconnecting from the system after executing:
which ls followed by ls -lh $(which ls)

In the Cowrie shell, the output of which ls is:
/bin/ls

and the output of ls -lh $(which ls) is:
-rwxr-xr-x 1 root root 112700 2013-04-05 11:52 ls

In a real bash shell, the output of ls -lh $(which ls) is:
-rwxr-xr-x 1 root root 144K Sep 24 2020 /usr/bin/ls

Is Cowrie not handling ls -lh $(which ls) correctly?
It would seem that the attacking script is comparing the output of the two commands, realising it's in a honeypot and aborting.

How do I get Cowrie to output -rwxr-xr-x 1 root root 144K Sep 24 2020 /usr/bin/ls when running ls -lh $(which ls)?

@micheloosterhof
Copy link
Member

To do this the ls command needs to be updated in src/cowrie/commands/fs.py.

@micheloosterhof
Copy link
Member

To make this fully work, the ls command needs to have a working -h flag, -h for human output will print the output in Kilobyte or Megabyte.

@micheloosterhof micheloosterhof changed the title ls -lh $(which ls) output ls command in cowrie shell does not have working -h flag Jan 7, 2023
@AJ-Acevedo
Copy link

To do this the ls command needs to be updated in src/cowrie/commands/fs.py.

Does the ls command need to be updated in src/cowrie/commands/fs.py or did you mean src/cowrie/commands/ls.py?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants