cowrie v2.3 releases: Cowrie SSH/Telnet Honeypot
What is Cowrie
Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker.
Cowrie is developed by Michel Oosterhof.
Features
Some interesting features:
- Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
- Possibility of adding fake file contents so the attacker can
cat
files such as/etc/passwd
. Only minimal file contents are included - Session logs stored in an UML Compatible format for easy replay with original timings
- Cowrie saves files downloaded with wget/curl or uploaded with SFTP and SCP for later inspection
Additional functionality over standard kippo:
- SFTP and SCP support for file upload
- Support for SSH exec commands
- Logging of direct-tcp connection attempts (ssh proxying)
- Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
- Logging in JSON format for easy processing in log management solutions
- Many, many additional commands
Files of interest:
cowrie.cfg
– Cowrie’s configuration file. Default values can be found incowrie.cfg.dist
data/fs.pickle
– fake filesystemdata/userdb.txt
– credentials allowed or disallowed to access the honeypotdl/
– files transferred from the attacker to the honeypot are stored herehoneyfs/
– file contents for the fake filesystem – feel free to copy a real system here or usebin/fsctl
log/cowrie.json
– transaction output in JSON formatlog/cowrie.log
– log/debug outputlog/tty/*.log
– session logstxtcmds/
– file contents for the fake commandsbin/createfs
– used to create the fake filesystembin/playlog
– utility to replay session logs
Changelog
v2.3
Release 2.3.0
Deprecate Python 3.6
Support Python 3.10
Dependency updates
MISP Output plugin extension
add new public keys ECDSAKeys and ed25519 (#1627)
fix userdb.example (#1619)
cache url submission to virustotal
MySQL connector (#1575) – needs new external dependency mysql-connector-python
Fix mysql string expansion (#1565)
Rewrite CSIRTG output plugin to use new library version
Fixed the Slack output to work with the versions 2.x of slackclient
fix MySQL error handling
fix tar command
limit connections to private address ranges
Update GreyNoise Output Script to Use Community API (#1524)
Implement getopt-style parsing for uname (#1516)
Allow SSLv3 connections for wget and curl
Support for 301 redirects in wget
Malshare update API (#1472)
Remove hpfeeds.py infavour of hpfeeds3.py
Docker
Docker versions are available.
- Get the Dockerfile directly at
https://github.com/cowrie/docker-cowrie
- Run from the Docker registry with:
docker pull cowrie/cowrie
Install
Use
Copyright (c) 2009 UPI Tamminen All rights reserved.