Need help with cowrie?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

cowrie
3.6K Stars 658 Forks Other 2.4K Commits 82 Opened issues

Description

Cowrie SSH/Telnet Honeypot https://cowrie.readthedocs.io

Services available

!
?

Need anything else?

Contributors list

Cowrie

|travis|_ |circleci|_ |codecov|_

Welcome to the Cowrie GitHub repository


This is the official repository for the Cowrie SSH and Telnet Honeypot effort.

What is Cowrie


Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker. In medium interaction mode (shell) it emulates a UNIX system in Python, in high interaction mode (proxy) it functions as an SSH and telnet proxy to observe attacker behavior to another system.

Cowrie 
_ is maintained by Michel Oosterhof.

Documentation


The Documentation can be found

here 
_.

Slack


You can join the Cowrie community at the following

Slack workspace 
_.

Features


  • Choose to run as an emulated shell (default):

    • Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
    • Possibility of adding fake file contents so the attacker can
      cat
      files such as
      /etc/passwd
      . Only minimal file contents are included
    • Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection
  • Or proxy SSH and telnet to another system

    • Run as a pure telnet and ssh proxy with monitoring
    • Or let Cowrie manage a pool of Qemu emualted servers to provide the systems to login to

For both settings:

  • Session logs are stored in an
    UML Compatible 
    _ format for easy replay with the
    bin/playlog
    utility.
  • SFTP and SCP support for file upload
  • Support for SSH exec commands
  • Logging of direct-tcp connection attempts (ssh proxying)
  • Forward SMTP connections to SMTP Honeypot (e.g.
    mailoney 
    _)
  • JSON logging for easy processing in log management solutions

Docker


Docker versions are available.

  • To get started quickly and give Cowrie a try, run::

    docker run -p 2222:2222 cowrie/cowrie ssh -p 2222 [email protected]

  • On Docker Hub: https://hub.docker.com/r/cowrie/cowrie

  • Or get the Dockerfile directly at https://github.com/cowrie/docker-cowrie

Requirements


Software required:

  • Python 3.6+
  • python-virtualenv

For Python dependencies, see

requirements.txt 
_.

Files of interest:


  • etc/cowrie.cfg
    - Cowrie's configuration file. Default values can be found in
    etc/cowrie.cfg.dist 
    _.
  • share/cowrie/fs.pickle
    - fake filesystem
  • etc/userdb.txt
    - credentials to access the honeypot
  • honeyfs/ 
    _ - file contents for the fake filesystem - feel free to copy a real system here or use
    bin/fsctl
  • honeyfs/etc/issue.net
    - pre-login banner
  • honeyfs/etc/motd 
    _ - post-login banner
  • var/log/cowrie/cowrie.json
    - transaction output in JSON format
  • var/log/cowrie/cowrie.log
    - log/debug output
  • var/lib/cowrie/tty/
    - session logs, replayable with the
    bin/playlog
    utility.
  • var/lib/cowrie/downloads/
    - files transferred from the attacker to the honeypot are stored here
  • share/cowrie/txtcmds/ 
    _ - file contents for simple fake commands
  • bin/createfs 
    _ - used to create the fake filesystem
  • bin/playlog 
    _ - utility to replay session logs

Data Sharing


Cowrie will by default upload data on crashes and Python exceptions to api.cowrie.org. This information is used to improve the honeypot and is not shared with third parties. It can be disabled by setting

enabled=false
in
[output_crashreporter]
.

Contributors


Many people have contributed to Cowrie over the years. Special thanks to:

  • Upi Tamminen (desaster) for all his work developing Kippo on which Cowrie was based
  • Dave Germiquet (davegermiquet) for TFTP support, unit tests, new process handling
  • Olivier Bilodeau (obilodeau) for Telnet support
  • Ivan Korolev (fe7ch) for many improvements over the years.
  • Florian Pelgrim (craneworks) for his work on code cleanup and Docker.
  • Guilherme Borges (sgtpepperpt) for SSH and telnet proxy (GSoC 2019)
  • And many many others.

.. |travis| image:: https://travis-ci.com/cowrie/cowrie.svg?branch=master .. _travis: https://travis-ci.com/cowrie/cowrie

.. |circleci| image:: https://circleci.com/gh/cowrie/cowrie.svg?style=svg .. _circleci: https://circleci.com/gh/cowrie/cowrie

.. |codecov| image:: https://codecov.io/gh/cowrie/cowrie/branch/master/graph/badge.svg .. _codecov: https://codecov.io/gh/cowrie/cowrie

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.