272 lines
8.6 KiB
JavaScript
272 lines
8.6 KiB
JavaScript
const { FLAGS, createFlagCollection } = require('../flags.js');
|
|
const logIpToFile = require('../logIpToFile.js');
|
|
const tailFile = require('../services/tailFile.js');
|
|
const logger = require('../logger.js');
|
|
const resolvePath = require('../pathResolver.js');
|
|
const { COWRIE_LOG_FILE, SERVER_ID } = require('../../config.js').MAIN;
|
|
|
|
const LOG_FILE = resolvePath(COWRIE_LOG_FILE);
|
|
const REPORT_DELAY = SERVER_ID === 'development' ? 30 * 1000 : 10 * 60 * 1000;
|
|
|
|
const CREDS_LIMIT = 885;
|
|
const ipBuffers = new Map();
|
|
|
|
const extractSessionData = sessions => {
|
|
const commands = [];
|
|
const flags = createFlagCollection();
|
|
|
|
const credsSet = new Set();
|
|
const fingerprints = new Set();
|
|
const uploads = new Set();
|
|
const tunnels = new Set();
|
|
|
|
let dpt = null, proto = null, sshVersion = null, timestamp = null;
|
|
const downloadUrls = new Set();
|
|
|
|
for (const s of sessions) {
|
|
dpt ??= s.dpt;
|
|
proto ??= s.proto;
|
|
sshVersion ??= s.sshVersion;
|
|
timestamp ??= s.timestamp;
|
|
|
|
s.credentials?.forEach((_, cred) => credsSet.add(cred));
|
|
commands.push(...s.commands);
|
|
|
|
if (s.fingerprint) fingerprints.add(s.fingerprint);
|
|
if (s.uploads) s.uploads.forEach(f => uploads.add(f));
|
|
if (s.tunnels) s.tunnels.forEach(t => tunnels.add(t));
|
|
if (s.download?.url) {
|
|
flags.add(FLAGS.WEB_APP_ATTACK);
|
|
downloadUrls.add(s.download.url);
|
|
}
|
|
}
|
|
|
|
const creds = [...credsSet];
|
|
const loginAttempts = creds.length;
|
|
const cmdCount = commands.length;
|
|
|
|
if (loginAttempts >= 2) flags.add(FLAGS.BRUTE_FORCE);
|
|
if (proto === 'ssh') flags.add(FLAGS.SSH);
|
|
if (proto === 'telnet') flags.add(FLAGS.TELNET);
|
|
if (cmdCount) flags.add(FLAGS.EMAIL);
|
|
if (!loginAttempts && !cmdCount) flags.add(FLAGS.PORT_SCAN);
|
|
|
|
return {
|
|
dpt, proto, sshVersion, timestamp, creds, commands,
|
|
categories: flags.toString(),
|
|
downloadUrls: [...downloadUrls],
|
|
fingerprints: [...fingerprints],
|
|
uploads: [...uploads],
|
|
tunnels: [...tunnels],
|
|
};
|
|
};
|
|
|
|
const buildComment = ({ serverId, dpt, proto, creds, commands, sshVersion, downloadUrls, fingerprints, uploads, tunnels }, full = false) => {
|
|
const loginAttempts = creds.length;
|
|
const cmdCount = commands.length;
|
|
const lines = [];
|
|
|
|
lines.push(`Honeypot ${serverId ? `[${serverId}]` : 'hit'}: ${loginAttempts ? 'Brute-force attack' : 'Unauthorized connection attempt'} detected on ${dpt}/${proto.toUpperCase()}`);
|
|
|
|
if (loginAttempts === 1) {
|
|
lines.push(`• Credential used: ${creds[0]}`);
|
|
} else if (loginAttempts > 1) {
|
|
let joined = creds.join(', ');
|
|
if (!full && joined.length > CREDS_LIMIT) joined = joined.slice(0, CREDS_LIMIT).replace(/,[^,]*$/, '') + '...';
|
|
lines.push(`• Credentials: ${joined}`);
|
|
}
|
|
|
|
if (loginAttempts) lines.push(`• Number of login attempts: ${loginAttempts}`);
|
|
if (cmdCount) lines.push(`• ${cmdCount} command(s) were executed during the session`);
|
|
if (sshVersion) lines.push(`• Client: ${sshVersion}`);
|
|
if (downloadUrls.length) lines.push(`• Suspicious file URLs: ${downloadUrls.join(', ')}`);
|
|
if (fingerprints.length) lines.push(`• SSH key fingerprints: ${fingerprints.join(', ')}`);
|
|
if (uploads.length) lines.push(`• Uploaded files: ${uploads.join(', ')}`);
|
|
if (tunnels.length) lines.push(`• TCP tunnels: ${tunnels.join(', ')}`);
|
|
|
|
return lines.join('\n');
|
|
};
|
|
|
|
const flushBuffer = async (srcIp, reportIp) => {
|
|
const buffer = ipBuffers.get(srcIp);
|
|
if (!buffer) return;
|
|
|
|
clearTimeout(buffer.timer);
|
|
ipBuffers.delete(srcIp);
|
|
|
|
const sessions = buffer.sessions || [];
|
|
if (!sessions.length) return;
|
|
|
|
const {
|
|
dpt, proto, sshVersion, timestamp, creds, commands,
|
|
categories, downloadUrls, fingerprints, uploads, tunnels,
|
|
} = extractSessionData(sessions);
|
|
|
|
if (!srcIp || !dpt || !proto) {
|
|
return logger.warn(`COWRIE -> Incomplete data for ${srcIp}, discarded`);
|
|
}
|
|
|
|
const shortComment = buildComment({ serverId: SERVER_ID, dpt, proto, creds, commands, sshVersion, downloadUrls, fingerprints, uploads, tunnels }, false);
|
|
const [, ...restLines] = shortComment.split('\n');
|
|
const rest = restLines.length ? `\n${restLines.join('\n')}` : '';
|
|
|
|
await reportIp('COWRIE', { srcIp, dpt, proto, timestamp }, categories, shortComment);
|
|
if (restLines.length) await logger.info(rest);
|
|
await logger.webhook(`### Cowrie: ${srcIp} on ${dpt}/${proto}${rest}`);
|
|
|
|
logIpToFile(srcIp, { honeypot: 'COWRIE', comment: buildComment({ serverId: SERVER_ID, dpt, proto, creds, commands, sshVersion, downloadUrls, fingerprints, uploads, tunnels }, true) });
|
|
};
|
|
|
|
const processCowrieLogLine = async (entry, reportIp) => {
|
|
const ip = entry?.src_ip;
|
|
const sessionId = entry?.session;
|
|
const { eventid } = entry;
|
|
if (!ip || !eventid || !sessionId) return logger.warn('COWRIE -> Skipped: missing src_ip, eventid or sessionId');
|
|
|
|
let buffer = ipBuffers.get(ip);
|
|
if (!buffer) {
|
|
buffer = {
|
|
sessions: [],
|
|
timer: setTimeout(() => flushBuffer(ip, reportIp), REPORT_DELAY),
|
|
lastSeen: Date.now(),
|
|
};
|
|
ipBuffers.set(ip, buffer);
|
|
} else {
|
|
buffer.lastSeen = Date.now();
|
|
}
|
|
|
|
let session = buffer.sessions.find(s => s.sessionId === sessionId);
|
|
if (!session && eventid !== 'cowrie.session.closed') {
|
|
session = {
|
|
sessionId,
|
|
srcIp: ip,
|
|
dpt: null,
|
|
proto: null,
|
|
timestamp: null,
|
|
credentials: new Map(),
|
|
commands: [],
|
|
sshVersion: null,
|
|
download: null,
|
|
fingerprint: null,
|
|
uploads: [],
|
|
tunnels: [],
|
|
};
|
|
buffer.sessions.push(session);
|
|
}
|
|
|
|
switch (eventid) {
|
|
case 'cowrie.session.connect':
|
|
if (session) {
|
|
session.dpt = entry.dst_port;
|
|
session.proto = entry.protocol;
|
|
session.timestamp = entry.timestamp;
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: Connect`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.login.success':
|
|
case 'cowrie.login.failed':
|
|
if (session && (entry.username || entry.password)) {
|
|
session.credentials.set(`${entry.username}:${entry.password}`, true);
|
|
const status = eventid === 'cowrie.login.success' ? 'Connected' : 'Failed login';
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: ${status} » ${entry.username}:${entry.password}`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.client.version':
|
|
if (session) {
|
|
session.sshVersion = entry.version;
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: SSH version » ${entry.version}`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.command.input':
|
|
if (session && entry.input) {
|
|
session.commands.push(entry.input);
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: $ ${entry.input}`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.session.file_download':
|
|
if (session && entry.url) {
|
|
session.commands.push(`[download] ${entry.url}`);
|
|
session.download = { url: entry.url, outfile: entry.outfile };
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: File download » ${entry.url}`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.client.fingerprint':
|
|
if (session && entry.fingerprint) {
|
|
session.fingerprint = entry.fingerprint;
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: SSH key fingerprint » ${entry.fingerprint}`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.session.file_upload':
|
|
if (session && entry.filename) {
|
|
session.uploads.push(entry.filename);
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: File upload » ${entry.filename}`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.direct-tcpip.request':
|
|
if (session && entry.dst_ip && entry.dst_port) {
|
|
const tunnel = `${entry.dst_ip}:${entry.dst_port}`;
|
|
session.tunnels.push(tunnel);
|
|
logger.info(`COWRIE -> ${ip}/${session.proto}/${session.dpt}: TCP tunnel request » ${tunnel}`);
|
|
}
|
|
break;
|
|
|
|
case 'cowrie.session.closed':
|
|
logger.info(`COWRIE -> ${ip}/${session?.proto ?? 'unknown'}/${session?.dpt ?? '-'}: Session ${sessionId} closed`);
|
|
break;
|
|
}
|
|
};
|
|
|
|
module.exports = reportIp => {
|
|
tailFile(LOG_FILE, async line => {
|
|
if (!line.length) return;
|
|
|
|
let entry;
|
|
try {
|
|
entry = JSON.parse(line);
|
|
} catch (err) {
|
|
return logger.error(`COWRIE -> JSON parse error: ${err.message}\nFaulty line: ${JSON.stringify(line)}`);
|
|
}
|
|
|
|
try {
|
|
await processCowrieLogLine(entry, reportIp);
|
|
} catch (err) {
|
|
logger.error(err);
|
|
}
|
|
}, { label: 'COWRIE' }).catch(err => logger.error(err));
|
|
|
|
// Clean buffer
|
|
const cleanupInterval = setInterval(() => {
|
|
const now = Date.now();
|
|
for (const [ip, buffer] of ipBuffers.entries()) {
|
|
if (now - buffer.lastSeen > 30 * 60 * 1000) {
|
|
clearTimeout(buffer.timer);
|
|
ipBuffers.delete(ip);
|
|
logger.warn(`COWRIE -> Cleaned up stale session buffer for ${ip}`);
|
|
}
|
|
}
|
|
}, 15 * 60 * 1000);
|
|
|
|
logger.success('🛡️ COWRIE » Watcher initialized');
|
|
return {
|
|
flush: async () => {
|
|
for (const ip of ipBuffers.keys()) {
|
|
await flushBuffer(ip, reportIp);
|
|
}
|
|
},
|
|
cleanup: () => {
|
|
clearInterval(cleanupInterval);
|
|
for (const buffer of ipBuffers.values()) {
|
|
clearTimeout(buffer.timer);
|
|
}
|
|
ipBuffers.clear();
|
|
},
|
|
};
|
|
};
|