Cowrie - SSH/Telnet Honeypot Tool - Hackers Online Club (HOC)

Cowrie SSH/Telnet Honeypot Tool

Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker. In medium interaction mode (shell) it emulates a UNIX system in Python, in high interaction mode (proxy) it functions as an SSH and telnet proxy to observe attacker behavior to another system.

Features

Choose to run as an emulated shell (default):

Fake filesystem with the ability to add/remove files. A full fake filesystem resembling a Debian 5.0 installation is included
Possibility of adding fake file contents so the attacker can cat files such as /etc/passwd. Only minimal file contents are included
Cowrie saves files downloaded with wget/curl or uploaded with SFTP and scp for later inspection

Or proxy SSH and telnet to another system

Run as a pure telnet and ssh proxy with monitoring
Or let Cowrie manage a pool of Qemu emualted servers to provide the systems to login to

For both settings:

Session logs are stored in an UML Compatible format for easy replay with the bin/playlog utility.
SFTP and SCP support for file upload
Support for SSH exec commands
Logging of direct-tcp connection attempts (ssh proxying)
Forward SMTP connections to SMTP Honeypot (e.g. mailoney)
JSON logging for easy processing in log management solutions

Docker

Docker versions are available.

To get started quickly and give Cowrie a try, run:

docker run -p 2222:2222 cowrie/cowrie

ssh -p 2222 root@localhost

On Docker Hub: https://hub.docker.com/r/cowrie/cowrie

Or get the Dockerfile directly at https://github.com/cowrie/docker-cowrie

Requirements

Software required:

Python 3.5+ (Python 2.7 support will be deprecated end of 2019)
python-virtualenv

For Python dependencies, see requirements.txt.

Files of interest:

etc/cowrie.cfg - Cowrie's configuration file. Default values can be found in etc/cowrie.cfg.dist.
share/cowrie/fs.pickle - fake filesystem
etc/userdb.txt - credentials to access the honeypot
honeyfs/ - file contents for the fake filesystem - feel free to copy a real system here or use bin/fsctl
honeyfs/etc/issue.net - pre-login banner
honeyfs/etc/motd - post-login banner
var/log/cowrie/cowrie.json - transaction output in JSON format
var/log/cowrie/cowrie.log - log/debug output
var/lib/cowrie/tty/ - session logs, replayable with the bin/playlog utility.
var/lib/cowrie/downloads/ - files transferred from the attacker to the honeypot are stored here
share/cowrie/txtcmds/ - file contents for simple fake commands
bin/createfs - used to create the fake filesystem
bin/playlog - utility to replay session logs

Data Sharing

Cowrie will by default upload data on crashes and Python exceptions to api.cowrie.org. This information is used to improve the honeypot and is not shared with third parties. It can be disabled by setting enabled=false in [output_crashreporter].

Cowrie is developed by Michel Oosterhof.

Download Cowrie

Cowrie - SSH/Telnet Honeypot Tool