Rooba
/
cowrie
mirror of https://github.com/cowrie/cowrie.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Cowrie SSH/Telnet Honeypot https://cowrie.readthedocs.io
1,412 Commits 2 Branches 21 Tags 58 MiB
Python 98.4%
Shell 0.7%
Makefile 0.5%
Dockerfile 0.4%
Go to file
Michel Oosterhof 807f457829 virtualenv -> python-virtualenv 2017-03-05 20:24:25 +00:00
bin cowrie script needs to be bash 2016-12-11 15:05:00 +04:00
cowrie Squashed commit of the following: 2017-03-05 20:12:39 +00:00
data add bin/enable to pickle and enable sample output 2016-11-01 21:09:50 +04:00
dl Added 'empty' folders … 2014-05-28 05:00:21 +01:00
doc Added Graylog Documentation (#454) 2017-02-18 19:28:59 +04:00
etc Revert "move cfg.dist file" 2016-11-14 09:24:34 +04:00
honeyfs Remove entries from honeyfs/proc/mounts that does not have corresponding folders. (#423) 2017-01-27 14:43:08 +08:00
log/tty Added 'empty' folders … 2014-05-28 05:00:21 +01:00
share add share/cowrie 2016-10-30 15:14:04 +04:00
twisted/plugins Improve handling of ImportErrors to notify users that they need to install new dependencies (#389) 2017-01-01 21:18:59 +04:00
txtcmds wrong dir 2016-11-01 21:11:54 +04:00
var Add etc/ and var/ directory structure for future use 2016-10-24 14:53:43 +04:00
.gitattributes cowrie rename 2015-05-12 14:57:29 +00:00
.gitignore ignore trial dirs 2017-01-02 14:54:59 +04:00
.travis.yml disable python 3.x testing for now 2016-10-27 04:53:52 +00:00
CHANGELOG.md update changelog 2017-02-12 23:22:07 +04:00
INSTALL.md virtualenv -> python-virtualenv 2017-03-05 20:24:25 +00:00
README.md in README.md refer to requirements.txt 2017-01-30 14:33:29 +04:00
cowrie.cfg.dist ttylog switch implementation 2017-02-18 16:58:24 +00:00
requirements-output.txt Added MongoDB output support (#407) 2017-01-13 17:57:19 +04:00
requirements.txt removed duplicates from requirements.txt (#468) 2017-02-22 09:25:46 -08:00
start.sh Merge branch 'master' of https://github.com/micheloosterhof/cowrie 2016-12-20 07:18:24 +00:00
stop.sh move PID file to var/run directory 2016-10-24 15:21:32 +04:00

README.md

Welcome to the Cowrie GitHub repository

This is the official repository for the Cowrie SSH and Telnet Honeypot effort.

What is Cowrie

Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.

Cowrie is developed by Michel Oosterhof.

Features

Some interesting features:

  • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
  • Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included
  • Session logs stored in an UML Compatible format for easy replay with original timings
  • Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection

Additional functionality over standard kippo:

  • SFTP and SCP support for file upload
  • Support for SSH exec commands
  • Logging of direct-tcp connection attempts (ssh proxying)
  • Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
  • Logging in JSON format for easy processing in log management solutions
  • Many, many additional commands

Requirements

Software required:

  • Python 2.7+, (Python 3 not yet supported due to Twisted dependencies)
  • python-virtualenv

For Python dependencies, see requirements.txt

Files of interest:

  • cowrie.cfg - Cowrie's configuration file. Default values can be found in cowrie.cfg.dist
  • data/fs.pickle - fake filesystem
  • data/userdb.txt - credentials allowed or disallowed to access the honeypot
  • dl/ - files transferred from the attacker to the honeypot are stored here
  • honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here or use bin/fsctl
  • log/cowrie.json - transaction output in JSON format
  • log/cowrie.log - log/debug output
  • log/tty/*.log - session logs
  • txtcmds/ - file contents for the fake commands
  • bin/createfs - used to create the fake filesystem
  • bin/playlog - utility to replay session logs

Is it secure?

Maybe. See FAQ

I have some questions!

Please visit https://github.com/micheloosterhof/cowrie/issues

Contributors

Many people have contributed to Cowrie over the years. Special thanks to:

  • Upi Tamminen (desaster) for all his work developing Kippo on which Cowrie was based