cowrie v2.5 releases: Cowrie SSH/Telnet Honeypot
What is Cowrie
Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.
Cowrie is developed by Michel Oosterhof.
Features
Some interesting features:
- Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
- Possibility of adding fake file contents so the attacker can
cat
files such as/etc/passwd
. Only minimal file contents are included - Session logs stored in an UML Compatible format for easy replay with original timings
- Cowrie saves files downloaded with wget/curl or uploaded with SFTP and SCP for later inspection
Additional functionality over standard kippo:
- SFTP and SCP support for file upload
- Support for SSH exec commands
- Logging of direct-tcp connection attempts (ssh proxying)
- Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
- Logging in JSON format for easy processing in log management solutions
- Many, many additional commands
Files of interest:
cowrie.cfg
– Cowrie’s configuration file. Default values can be found incowrie.cfg.dist
data/fs.pickle
– fake filesystemdata/userdb.txt
– credentials allowed or disallowed to access the honeypotdl/
– files transferred from the attacker to the honeypot are stored herehoneyfs/
– file contents for the fake filesystem – feel free to copy a real system here or usebin/fsctl
log/cowrie.json
– transaction output in JSON formatlog/cowrie.log
– log/debug outputlog/tty/*.log
– session logstxtcmds/
– file contents for the fake commandsbin/createfs
– used to create the fake filesystembin/playlog
– utility to replay session logs
Changelog v2.5
- Datadog output module (Fred Baguelin frederic.baguelin@datadoghq.com)
- General improvements to shell expansion handling
- New version of Twisted supported
- Python 3.11 support
- Pypy 3.9 support
- Add session type to Telegram output
Docker
Docker versions are available.
- Get the Dockerfile directly at
https://github.com/cowrie/docker-cowrie
- Run from the Docker registry with:
docker pull cowrie/cowrie
Install
Use
Copyright (c) 2009 UPI Tamminen All rights reserved.