Cowrie SSH/Telnet Honeypot https://cowrie.readthedocs.io

Go to file

Michel Oosterhof c63339ba65 document python-mysqldb dependency		2016-04-14 13:37:36 +04:00
cowrie	harmonize artifact filenames. use transport + sessionid	2016-04-13 20:32:35 +04:00
data	add correct entry for /	2016-01-13 19:09:48 +04:00
dl	Added 'empty' folders …	2014-05-28 05:00:21 +01:00
doc	Add init sqlite3 script	2016-02-28 23:55:22 +00:00
honeyfs	add random arpa info	2016-01-25 08:13:56 +00:00
log/tty	Added 'empty' folders …	2014-05-28 05:00:21 +01:00
twisted/plugins	interact now only listens on localhost interface	2015-12-28 18:42:06 +04:00
txtcmds	add 'free' command to replace txtcmd	2015-12-04 11:48:56 +00:00
utils	Able to playback multiple log files back to back	2016-01-21 23:40:50 +00:00
.gitattributes	cowrie rename	2015-05-12 14:57:29 +00:00
.gitignore	ignore macosx files	2016-01-17 10:33:08 +04:00
CHANGELOG.md	changelog update for zlib@openssh.com	2016-01-18 20:57:02 +00:00
INSTALL.md	document python-mysqldb dependency	2016-04-14 13:37:36 +04:00
README.md	document python-mysqldb dependency	2016-04-14 13:37:36 +04:00
cowrie.cfg.dist	more comments, consistent whitespace.	2016-04-13 20:12:38 +04:00
start.sh	Update start.sh	2016-01-18 09:26:48 +08:00
stop.sh	Remove "\n" in stop.sh.	2016-02-18 12:12:50 +08:00

Cowrie

Cowrie is a medium interaction SSH honeypot designed to log brute force attacks and the shell interaction performed by the attacker.

Cowrie is directly based on Kippo by Upi Tamminen (desaster).

Features

Some interesting features:

Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included
Session logs stored in an UML Compatible format for easy replay with original timings
Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection

Additional functionality over standard kippo:

Software required:

cowrie.cfg - Cowrie's configuration file. Default values can be found in cowrie.cfg.dist
data/fs.pickle - fake filesystem
data/userdb.txt - credentials allowed or disallowed to access the honeypot
dl/ - files transferred from the attacker to the honeypot are stored here
honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here or use utils/fsctl.py
log/cowrie.json - transaction output in JSON format
log/cowrie.log - log/debug output
log/tty/*.log - session logs
txtcmds/ - file contents for the fake commands
utils/createfs.py - used to create the fake filesystem
utils/playlog.py - utility to replay session logs

Maybe. See FAQ