Python config.CONFIG类代码示例

 def __init__(self):
     self.host = CONFIG.get(self.RETHINK_DB_SEGMENT, 'host')
     self.port = CONFIG.getint(self.RETHINK_DB_SEGMENT, 'port')
     self.db = CONFIG.get(self.RETHINK_DB_SEGMENT, 'db')
     self.table = CONFIG.get(self.RETHINK_DB_SEGMENT, 'table')
     self.password = CONFIG.get(self.RETHINK_DB_SEGMENT, 'password', raw=True)
     cowrie.core.output.Output.__init__(self)

    def __init__(self, username, server):
        avatar.ConchUser.__init__(self)
        self.username = username.decode('utf-8')
        self.server = server

        self.channelLookup[b'session'] = sshsession.HoneyPotSSHSession

        try:
            pwentry = pwd.Passwd().getpwnam(self.username)
            self.uid = pwentry['pw_uid']
            self.gid = pwentry['pw_gid']
            self.home = pwentry['pw_dir']
        except:
            self.uid = 1001
            self.gid = 1001
            self.home = '/home'

        # SFTP support enabled only when option is explicitly set
        try:
            if CONFIG.getboolean('ssh', 'sftp_enabled') == True:
                self.subsystemLookup[b'sftp'] = conchfiletransfer.FileTransferServer
        except ValueError as e:
            pass

        # SSH forwarding disabled only when option is explicitly set
        self.channelLookup[b'direct-tcpip'] = forwarding.cowrieOpenConnectForwardingClient
        try:
            if CONFIG.getboolean('ssh', 'forwarding') == False:
                del self.channelLookup[b'direct-tcpip']
        except:
            pass

    def __init__(self, username, server):
        avatar.ConchUser.__init__(self)
        self.username = username.decode('utf-8')
        self.server = server

        self.channelLookup[b'session'] = sshsession.HoneyPotSSHSession

        try:
            pwentry = pwd.Passwd().getpwnam(self.username)
            self.temporary = False
        except KeyError:
            pwentry = pwd.Passwd().setpwentry(self.username)
            self.temporary = True

        self.uid = pwentry['pw_uid']
        self.gid = pwentry['pw_gid']
        self.home = pwentry['pw_dir']

        # SFTP support enabled only when option is explicitly set
        if CONFIG.getboolean('ssh', 'sftp_enabled', fallback=False):
            self.subsystemLookup[b'sftp'] = conchfiletransfer.FileTransferServer

        # SSH forwarding disabled only when option is explicitly set
        if CONFIG.getboolean('ssh', 'forwarding', fallback=True):
            self.channelLookup[b'direct-tcpip'] = forwarding.cowrieOpenConnectForwardingClient

    def start(self):
        """
        """
        log.msg("WARNING: Beta version of new hpfeeds enabled. This will become hpfeeds in a future release.")

        if CONFIG.has_option('output_hpfeeds', 'channel'):
            self.channel = CONFIG.get('output_hpfeeds', 'channel')

        if CONFIG.has_option('output_hpfeeds', 'endpoint'):
            endpoint = CONFIG.get('output_hpfeeds', 'endpoint')
        else:
            server = CONFIG.get('output_hpfeeds', 'server')
            port = CONFIG.getint('output_hpfeeds', 'port')

            if CONFIG.has_option('output_hpfeeds', 'tlscert'):
                with open(CONFIG.get('output_hpfeeds', 'tlscert')) as fp:
                    authority = ssl.Certificate.loadPEM(fp.read())
                options = ssl.optionsForClientTLS(server, authority)
                endpoint = endpoints.SSL4ClientEndpoint(reactor, server, port, options)
            else:
                endpoint = endpoints.HostnameEndpoint(reactor, server, port)

        ident = CONFIG.get('output_hpfeeds', 'identifier')
        secret = CONFIG.get('output_hpfeeds', 'secret')

        self.meta = {}

        self.client = ClientSessionService(endpoint, ident, secret)
        self.client.startService()

    def download(self, url, fakeoutfile, outputfile, *args, **kwargs):
        try:
            parsed = compat.urllib_parse.urlparse(url)
            scheme = parsed.scheme
            host = parsed.hostname.decode('utf8')
            port = parsed.port or (443 if scheme == 'https' else 80)
            if scheme != b'http' and scheme != b'https':
                raise NotImplementedError
        except Exception:
            self.errorWrite('curl: (1) Protocol "{}" not supported or disabled in libcurl\n'.format(scheme))
            self.exit()
            return None

        factory = HTTPProgressDownloader(
            self, fakeoutfile, url, outputfile, *args, **kwargs)
        out_addr = None
        if CONFIG.has_option('honeypot', 'out_addr'):
            out_addr = (CONFIG.get('honeypot', 'out_addr'), 0)

        if scheme == 'https':
            contextFactory = ssl.ClientContextFactory()
            contextFactory.method = SSL.SSLv23_METHOD
            reactor.connectSSL(host, port, factory, contextFactory, bindAddress=out_addr)
        else:  # Can only be http
            self.connection = reactor.connectTCP(
                host, port, factory, bindAddress=out_addr)

        return factory.deferred

    def __init__(self):
        addr = CONFIG.get('output_socketlog', 'address')
        self.host = addr.split(':')[0]
        self.port = int(addr.split(':')[1])

        self.timeout = CONFIG.getint('output_socketlog', 'timeout')
        cowrie.core.output.Output.__init__(self)

 def __init__(self):
     cowrie.core.output.Output.__init__(self)
     fn = CONFIG.get('output_jsonlog', 'logfile')
     self.epoch_timestamp = CONFIG.getboolean('output_jsonlog', 'epoch_timestamp', fallback=False)
     dirs = os.path.dirname(fn)
     base = os.path.basename(fn)
     self.outfile = cowrie.python.logfile.CowrieDailyLogFile(base, dirs, defaultMode=0o664)

    def connectionMade(self):
        pt = self.getProtoTransport()

        self.realClientIP = pt.transport.getPeer().host
        self.realClientPort = pt.transport.getPeer().port
        self.logintime = time.time()

        log.msg(eventid='cowrie.session.params', arch=self.user.server.arch)

        try:
            timeout = CONFIG.getint('honeypot', 'interactive_timeout')
        except Exception:
            timeout = 180
        self.setTimeout(timeout)

        # Source IP of client in user visible reports (can be fake or real)
        try:
            self.clientIP = CONFIG.get('honeypot', 'fake_addr')
        except Exception:
            self.clientIP = self.realClientIP

        # Source IP of server in user visible reports (can be fake or real)
        if CONFIG.has_option('honeypot', 'internet_facing_ip'):
            self.kippoIP = CONFIG.get('honeypot', 'internet_facing_ip')
        else:
            try:
                s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
                s.connect(("8.8.8.8", 80))
                self.kippoIP = s.getsockname()[0]
            except Exception:
                self.kippoIP = '192.168.0.1'
            finally:
                s.close()

    def checkUserPass(self, theusername, thepassword, ip):
        # UserDB is the default auth_class
        authname = auth.UserDB

        # Is the auth_class defined in the config file?
        if CONFIG.has_option('honeypot', 'auth_class'):
            authclass = CONFIG.get('honeypot', 'auth_class')
            authmodule = "cowrie.core.auth"

            # Check if authclass exists in this module
            if hasattr(modules[authmodule], authclass):
                authname = getattr(modules[authmodule], authclass)
            else:
                log.msg('auth_class: %s not found in %s' % (authclass, authmodule))

        theauth = authname()

        if theauth.checklogin(theusername, thepassword, ip):
            log.msg(eventid='cowrie.login.success',
                    format='login attempt [%(username)s/%(password)s] succeeded',
                    username=theusername,
                    password=thepassword)
            return True
        else:
            log.msg(eventid='cowrie.login.failed',
                    format='login attempt [%(username)s/%(password)s] failed',
                    username=theusername,
                    password=thepassword)
            return False

    def __init__(self):
        self.sessions = {}
        self.ttylogs = {}
        # FIXME figure out what needs to be done here regarding
        self.re_sessionlog = re.compile(
            r'.*HoneyPotSSHTransport,([0-9]+),[:a-f0-9.]+$')

        # cowrie.session.connect is special since it kicks off new logging session,
        # and is not handled here
        self.events = {
            'cowrie.login.success': self.handleLoginSucceeded,
            'cowrie.login.failed': self.handleLoginFailed,
            'cowrie.log.open': self.handleTTYLogOpened,
            'cowrie.command.success': self.handleCommand,
            'cowrie.command.failed': self.handleUnknownCommand,
            'cowrie.session.file_download': self.handleFileDownload,
            'cowrie.command.input': self.handleInput,
            'cowrie.client.version': self.handleClientVersion,
            'cowrie.client.size': self.handleTerminalSize,
            'cowrie.session.closed': self._connectionLost,
            'cowrie.log.closed': self.handleTTYLogClosed,
        }

        self.reported_ssh_port = None
        if CONFIG.has_option('honeypot', 'reported_ssh_port'):
            self.reported_ssh_port = CONFIG.getint('honeypot', 'reported_ssh_port')

        self.report_public_ip = False
        if CONFIG.has_option('honeypot', 'report_public_ip'):
            if CONFIG.getboolean('honeypot', 'report_public_ip') == True:
                self.report_public_ip = True
                import urllib
                self.public_ip = urllib.urlopen('http://myip.threatstream.com').readline()

        self.start()

 def __init__(self):
     """
     """
     facilityString = CONFIG.get('output_localsyslog', 'facility')
     self.format = CONFIG.get('output_localsyslog', 'format')
     self.facility = vars(syslog)['LOG_' + facilityString]
     self.syslog = twisted.python.syslog.SyslogObserver(prefix='cowrie', facility=self.facility)
     cowrie.core.output.Output.__init__(self)

    def start(self):

        server = CONFIG.get('output_hpfeeds', 'server')
        port = CONFIG.getint('output_hpfeeds', 'port')
        ident = CONFIG.get('output_hpfeeds', 'identifier')
        secret = CONFIG.get('output_hpfeeds', 'secret')
        debug = CONFIG.getboolean('output_hpfeeds', 'debug')
        self.client = hpclient(server, port, ident, secret, debug)
        self.meta = {}

 def __init__(self):
     """
     """
     self.host = CONFIG.get('output_elasticsearch', 'host')
     self.port = CONFIG.get('output_elasticsearch', 'port')
     self.index = CONFIG.get('output_elasticsearch', 'index')
     self.type = CONFIG.get('output_elasticsearch', 'type')
     self.pipeline = CONFIG.get('output_elasticsearch', 'pipeline')
     cowrie.core.output.Output.__init__(self)

def cowrieOpenConnectForwardingClient(remoteWindow, remoteMaxPacket, data, avatar):
    """
    This function will redirect an SSH forward request to another address
    or will log the request and do nothing
    """
    remoteHP, origHP = forwarding.unpackOpen_direct_tcpip(data)

    log.msg(eventid='cowrie.direct-tcpip.request',
            format='direct-tcp connection request to %(dst_ip)s:%(dst_port)s from %(src_ip)s:%(src_port)s',
            dst_ip=remoteHP[0], dst_port=remoteHP[1],
            src_ip=origHP[0], src_port=origHP[1])

    # Forward redirect
    redirectEnabled = CONFIG.getboolean('ssh', 'forward_redirect', fallback=False)
    if redirectEnabled:
        redirects = {}
        items = CONFIG.items('ssh')
        for i in items:
            if i[0].startswith('forward_redirect_'):
                destPort = i[0].split('_')[-1]
                redirectHP = i[1].split(':')
                redirects[int(destPort)] = (redirectHP[0], int(redirectHP[1]))
        if remoteHP[1] in redirects:
            remoteHPNew = redirects[remoteHP[1]]
            log.msg(eventid='cowrie.direct-tcpip.redirect',
                    format='redirected direct-tcp connection request from %(src_ip)s:%(src_port)' +
                           'd to %(dst_ip)s:%(dst_port)d to %(new_ip)s:%(new_port)d',
                    new_ip=remoteHPNew[0], new_port=remoteHPNew[1],
                    dst_ip=remoteHP[0], dst_port=remoteHP[1],
                    src_ip=origHP[0], src_port=origHP[1])
            return SSHConnectForwardingChannel(remoteHPNew, remoteWindow=remoteWindow, remoteMaxPacket=remoteMaxPacket)

    # TCP tunnel
    tunnelEnabled = CONFIG.getboolean('ssh', 'forward_tunnel', fallback=False)
    if tunnelEnabled:
        tunnels = {}
        items = CONFIG.items('ssh')
        for i in items:
            if i[0].startswith('forward_tunnel_'):
                destPort = i[0].split('_')[-1]
                tunnelHP = i[1].split(':')
                tunnels[int(destPort)] = (tunnelHP[0], int(tunnelHP[1]))
        if remoteHP[1] in tunnels:
            remoteHPNew = tunnels[remoteHP[1]]
            log.msg(eventid='cowrie.direct-tcpip.tunnel',
                    format='tunneled direct-tcp connection request %(src_ip)s:%(src_port)' +
                           'd->%(dst_ip)s:%(dst_port)d to %(new_ip)s:%(new_port)d',
                    new_ip=remoteHPNew[0], new_port=remoteHPNew[1],
                    dst_ip=remoteHP[0], dst_port=remoteHP[1],
                    src_ip=origHP[0], src_port=origHP[1])
            return TCPTunnelForwardingChannel(remoteHPNew,
                                              remoteHP,
                                              remoteWindow=remoteWindow,
                                              remoteMaxPacket=remoteMaxPacket)

    return FakeForwardingChannel(remoteHP, remoteWindow=remoteWindow, remoteMaxPacket=remoteMaxPacket)

    def __init__(self):
        self.auth_key = CONFIG.get('output_dshield', 'auth_key')
        self.userid = CONFIG.get('output_dshield', 'userid')
        self.batch_size = CONFIG.getint('output_dshield', 'batch_size')
        try:
            self.debug = CONFIG.getboolean('output_dshield', 'debug')
        except:
            self.debug = False

        cowrie.core.output.Output.__init__(self)