mirror of https://github.com/cowrie/cowrie.git
118 lines
4.7 KiB
Python
118 lines
4.7 KiB
Python
# Copyright (c) 2009 Upi Tamminen <desaster@gmail.com>
|
|
# See the COPYRIGHT file for more information
|
|
|
|
# Commands mapped to common malware
|
|
|
|
from kippo.core.honeypot import HoneyPotCommand
|
|
|
|
commands = {}
|
|
clist = {} # names
|
|
slist = {} # sizes
|
|
|
|
# 9729c037cb0a32811ba3eb15e3c8a789
|
|
class command_nop(HoneyPotCommand):
|
|
def call(self):
|
|
pass
|
|
slist[317] = command_nop
|
|
clist['autorun'] = command_nop
|
|
|
|
# 158c35ecfd4a4a490b613d87a22088fa
|
|
class command_start1(HoneyPotCommand):
|
|
def call(self):
|
|
self.writeln('=====>Created by PuFoS<=====')
|
|
self.writeln('++++++ *Asta e o arhiva privata* ++++++++')
|
|
self.writeln('Exemplu : ./start canal ')
|
|
self.writeln('P.S : FARA DIEZ!')
|
|
slist[750] = command_start1
|
|
clist['start'] = command_start1
|
|
|
|
# d4655a3bdcb9e18c6718c29eda91725b
|
|
class command_start2(HoneyPotCommand):
|
|
def call(self):
|
|
self.writeln('Exemplu: ./start canal (fara diez)')
|
|
slist[608] = command_start2
|
|
|
|
# 9428fcc48cf2c01668678e9ea4874de4
|
|
class command_start3(HoneyPotCommand):
|
|
def call(self):
|
|
self.writeln('####################################################################')
|
|
self.writeln('# ______')
|
|
self.writeln('# .-. .-.')
|
|
self.writeln('# / \\')
|
|
self.writeln('# | zRR |')
|
|
self.writeln('# |, .-. .-. ,|')
|
|
self.writeln('# | )(z_/ \z_)( |')
|
|
self.writeln('# |/ /\ \|')
|
|
self.writeln('# _ (_ ^^ _)')
|
|
self.writeln('# _\ ____) \_______\__|IIIIII|__/_________________________')
|
|
self.writeln('# (_)[___]{}<________|-\IIIIII/-|__zRR__zRR__zRR___________\\')
|
|
self.writeln('# / )_/ \ /')
|
|
self.writeln('# \ ______ /')
|
|
self.writeln('# SCANER PRIVAT')
|
|
self.writeln('# SCANER FOLOSIT DOAR DE TEAMUL zRRTEAM')
|
|
self.writeln('# SACNERUL CONTINE UN PASS_FLIE DE 3MEGA !!')
|
|
self.writeln('####################################################################')
|
|
slist[6649] = command_start3
|
|
|
|
# f3511c928dbc381c0d7b35d63821ea01
|
|
class command_start_sh1(HoneyPotCommand):
|
|
def call(self):
|
|
self.writeln('Enjoy FloodBot based on OverKill')
|
|
slist[67] = command_start3
|
|
|
|
# 3c56bd3a394c1a842ec57226d8ee5d81
|
|
class command_go_sh1(HoneyPotCommand):
|
|
def call(self):
|
|
if not len(self.args):
|
|
self.writeln('A must be between 1 and 254')
|
|
else:
|
|
self.writeln('scanning network %s.*' % self.args[0])
|
|
self.writeln('usec: 30000, burst packets 50')
|
|
self.writeln('using interface eth0')
|
|
self.writeln('using "(tcp[tcpflags]=0x12) and (src port 22) and (dst port 15232)" as pcap filter')
|
|
self.writeln('my detected ip on eth0 is 127.0.0.1')
|
|
self.writeln('capturing process started pid 2259')
|
|
# much more happens after this, but I'm lazy
|
|
self.writeln('Toata \033[31mdragostea\033[0m mea pentru \033[32mdiavola\033[0m!!!!!!')
|
|
slist[92] = command_go_sh1
|
|
clist['go.sh'] = command_go_sh1
|
|
|
|
# 978cc6e3ce07787898519aa26f3b429c
|
|
# dc7b9585c47ab44830dc84a11e0272fe
|
|
class command_bash(HoneyPotCommand):
|
|
def call(self):
|
|
self.writeln('EnergyMech 2.9.3, May 16th, 2003')
|
|
self.writeln('Compiled on Mar 4 2005 15:06:49')
|
|
self.writeln('Features: DBG, LNE, SEE, LNK, TEL, PIP, DYN, ALS, SEF')
|
|
slist[492135] = command_bash # bash
|
|
slist[29] = command_bash # run
|
|
clist['bash'] = command_bash
|
|
|
|
# e41604f2449fb75eebbf5530ee3a8c2c
|
|
class command_a(HoneyPotCommand):
|
|
def start(self):
|
|
if not len(self.args):
|
|
self.writeln(' usage: ./a <b class>')
|
|
self.exit()
|
|
return
|
|
self.writeln('\033[1;31m\xAB\033[1;32m Created bY MaLa \033[1;31m\xBB\033[0m')
|
|
self.writeln('INCERC SA DAU VIATZA CIBERNETICI')
|
|
self.write('# scanning: %s (total: 0) (0.01%% done)' % self.args[0])
|
|
slist[1287] = command_a
|
|
clist['a'] = command_a
|
|
|
|
# b51a52c9c82bb4401659b4c17c60f89f
|
|
class command_ss(HoneyPotCommand):
|
|
def call(self):
|
|
if not len(self.args):
|
|
self.writeln('usage: ./ss <port> [-a <a class> | -b <b class>] [-i <interface] [-s <speed>]')
|
|
return
|
|
self.writeln('usec: 1000000, burst packets 50')
|
|
self.writeln('using "(tcp[tcpflags]=0x12) and (src port 22) and (dst port 38659)" as pcap filter')
|
|
self.writeln('my detected ip on eth0 is 127.0.0.1')
|
|
self.writeln('capturing process started pid 2282')
|
|
slist[453972] = command_ss
|
|
clist['ss'] = command_ss
|
|
|
|
# vim: set sw=4 et tw=0:
|