07-06-2023, 10:12 PM
Hey. I found a bug while Cowrie. It could be weaponized to mass scan the internet and detect Cowrie honeypots, and I'm pretty sure the same bug exists in all honeypots that are forks of Cowrie although I haven't tested.
I found this while messing with Bash inside of a local Cowrie instance because I wanted to find different ways to know if you were operating inside of a Cowrie honeypot, and I had found that all of the binaries that exist by default are all the same:
So, I decided to just make a basic Bash command to check the mkdir file for a string:
On a normal Linux instance, this should just echo 1, for example:
But, the first weird thing I noticed was that it failed to execute return in Bash:
Just randomly, I decided to wrap the whole command in an echo command into Bash, and I know some people may be confused by this but it executes still perfectly fine on real Linux machines:
And, piping commands to Bash like this should normally work just fine within a Cowrie instance:
But for some reason, this command when ran by piping it into Bash inside of Cowrie causes the Cowrie instance to disconnect the user and crash:
And when looking at Docker logs (removed some things):
Not sure what causes this issue to occur but it's pretty funny. You can do more testing if you'd like, I just thought it was interesting.
I found this while messing with Bash inside of a local Cowrie instance because I wanted to find different ways to know if you were operating inside of a Cowrie honeypot, and I had found that all of the binaries that exist by default are all the same:
root@svr04:/bin# cat busybox
ELF>x@@?@8@@@yy ?.shstrtab.text
x@xy
root@svr04:/bin# cat which
ELF>x@@?@8@@@yy ?.shstrtab.text
x@xy
root@svr04:/bin# cat ping
ELF>x@@?@8@@@yy ?.shstrtab.text
x@xy
root@svr04:/bin# cat nc
ELF>x@@?@8@@@yy ?.shstrtab.text
x@xy
root@svr04:/bin#grep -q "ELF>x@@?@8@@@yy ?.shstrtab.text" /bin/mkdir && return 0 || echo 1On a normal Linux instance, this should just echo 1, for example:
house@house:/# grep -q "ELF>x@@?@8@@@yy ?.shstrtab.text" /bin/mkdir && return 0 || echo 1
1But, the first weird thing I noticed was that it failed to execute return in Bash:
root@svr04:/# grep -q "ELF>x@@?@8@@@yy ?.shstrtab.text" /bin/mkdir && return 0 || echo 1
-bash: return: command not found
1Just randomly, I decided to wrap the whole command in an echo command into Bash, and I know some people may be confused by this but it executes still perfectly fine on real Linux machines:
house@house:/# echo 'grep -q "ELF>x@@?@8@@@yy ?.shstrtab.text" /bin/mkdir && return 0 || echo 1' | bash
1And, piping commands to Bash like this should normally work just fine within a Cowrie instance:
root@svr04:/# echo 'echo 1' | bash
1But for some reason, this command when ran by piping it into Bash inside of Cowrie causes the Cowrie instance to disconnect the user and crash:
root@svr04:/# echo 'grep -q "ELF>x@@?@8@@@yy ?.shstrtab.text" /bin/mkdir && return 0 || echo 1' | bashConnection to localhost closed by remote host.
Connection to localhost closed.
house@house:/#And when looking at Docker logs (removed some things):
[cowrie.ssh.connection.CowrieSSHConnection#info] sending close 0
[HoneyPotSSHTransport,8,*] Command found: echo 1
[HoneyPotSSHTransport,8,*] Unhandled Error
Traceback (most recent call last):
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/python/log.py", line 96, in callWithLogger
return callWithContext({"system": lp}, func, *args, **kw)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/python/log.py", line 80, in callWithContext
return context.call({ILogContext: newCtx}, func, *args, **kw)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/python/context.py", line 117, in callWithContext
return self.currentContext().callWithContext(ctx, func, *args, **kw)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/python/context.py", line 82, in callWithContext
return func(*args, **kw)
--- <exception caught here> ---
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/internet/posixbase.py", line 487, in _doReadOrWrite
why = selectable.doRead()
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/internet/tcp.py", line 248, in doRead
return self._dataReceived(data)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/internet/tcp.py", line 253, in _dataReceived
rval = self.protocol.dataReceived(data)
File "/cowrie/cowrie-git/src/cowrie/ssh/transport.py", line 144, in dataReceived
self.dispatchMessage(messageNum, packet[1:])
File "/cowrie/cowrie-git/src/cowrie/ssh/transport.py", line 148, in dispatchMessage
transport.SSHServerTransport.dispatchMessage(self, messageNum, payload)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/ssh/transport.py", line 790, in dispatchMessage
self.service.packetReceived(messageNum, payload)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/ssh/service.py", line 50, in packetReceived
return f(packet)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/ssh/connection.py", line 265, in ssh_CHANNEL_DATA
channel.dataReceived(data)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/ssh/session.py", line 165, in dataReceived
self.client.transport.write(data)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/ssh/session.py", line 225, in write
self.proto.dataReceived(data)
File "/cowrie/cowrie-git/src/cowrie/insults/insults.py", line 126, in dataReceived
insults.ServerProtocol.dataReceived(self, data)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/insults/insults.py", line 520, in dataReceived
self.terminalProtocol.keystrokeReceived(ch, None)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/recvline.py", line 435, in keystrokeReceived
m()
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 328, in handle_RETURN
return recvline.RecvLine.handle_RETURN(self)
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/recvline.py", line 493, in handle_RETURN
self.lineReceived(line)
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 189, in lineReceived
self.cmdstack[-1].lineReceived(string)
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 114, in lineReceived
self.runCommand()
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 333, in runCommand
self.protocol.call_command(pp, cmdclass, *cmd_array[0]["rargs"])
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 309, in call_command
HoneyPotBaseProtocol.call_command(self, pp, cmd, *args)
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 201, in call_command
self.pp.outConnectionLost()
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 545, in outConnectionLost
self.protocol.call_command(self.next_command, npcmd, *npcmdargs)
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 309, in call_command
HoneyPotBaseProtocol.call_command(self, pp, cmd, *args)
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 198, in call_command
obj.start()
File "/cowrie/cowrie-git/src/cowrie/shell/command.py", line 146, in start
self.call()
File "/cowrie/cowrie-git/src/cowrie/commands/base.py", line 1023, in call
self.execute_commands(self.input_data.decode("utf8"))
File "/cowrie/cowrie-git/src/cowrie/commands/base.py", line 1033, in execute_commands
self.protocol.cmdstack[-1].lineReceived(cmds)
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 114, in lineReceived
self.runCommand()
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 333, in runCommand
self.protocol.call_command(pp, cmdclass, *cmd_array[0]["rargs"])
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 309, in call_command
HoneyPotBaseProtocol.call_command(self, pp, cmd, *args)
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 198, in call_command
obj.start()
File "/cowrie/cowrie-git/src/cowrie/commands/fs.py", line 88, in start
self.exit()
File "/cowrie/cowrie-git/src/cowrie/shell/command.py", line 170, in exit
self.protocol.cmdstack[-1].resume()
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 338, in resume
self.runCommand()
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 329, in runCommand
runOrPrompt()
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 201, in runOrPrompt
self.runCommand()
File "/cowrie/cowrie-git/src/cowrie/shell/honeypot.py", line 333, in runCommand
self.protocol.call_command(pp, cmdclass, *cmd_array[0]["rargs"])
File "/cowrie/cowrie-git/src/cowrie/shell/protocol.py", line 308, in call_command
self.setTypeoverMode()
File "/cowrie/cowrie-env/lib/python3.9/site-packages/twisted/conch/recvline.py", line 411, in setTypeoverMode
self.terminal.resetModes([insults.modes.IRM])
builtins.AttributeError: 'NoneType' object has no attribute 'resetModes'Not sure what causes this issue to occur but it's pretty funny. You can do more testing if you'd like, I just thought it was interesting.
