From fd5409d673df200b2c1651780be726b238904d5a Mon Sep 17 00:00:00 2001 From: fe7ch Date: Mon, 22 May 2017 20:54:06 +0300 Subject: [PATCH] Fix tftp download url reporting (#517) --- cowrie/commands/tftp.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/cowrie/commands/tftp.py b/cowrie/commands/tftp.py index 0f973554..eae60f3f 100644 --- a/cowrie/commands/tftp.py +++ b/cowrie/commands/tftp.py @@ -67,6 +67,9 @@ class command_tftp(HoneyPotCommand): try: tclient = tftpy.TftpClient(self.hostname, int(self.port)) tclient.download(self.file_to_get, self.safeoutfile, progresshook) + + url = 'tftp://%s/%s' % (self.hostname, self.file_to_get.strip('/')) + self.file_to_get = self.fs.resolve_path(self.file_to_get, self.protocol.cwd) if hasattr(tclient.context, 'metrics'): self.fs.mkfile(self.file_to_get, 0, 0, tclient.context.metrics.bytes, 33188) @@ -95,8 +98,6 @@ class command_tftp(HoneyPotCommand): os.remove(self.safeoutfile) log.msg("Not storing duplicate content " + shasum) - url = 'tftp://%s/%s' % (self.hostname, self.file_to_get.strip('/')) - log.msg(eventid='cowrie.session.file_download', format='Downloaded tftpFile (%(url)s) with SHA-256 %(shasum)s to %(outfile)s', url=url,