Handle a general event within the output plugin

Write errors to the user on stderr

Return True if path refers to an existing path. Returns False for broken symbolic links.

This function does not need to be in this class, it has no dependencies

Like write() but input is bytes

This returns the Cowrie file system object for a path

note: this actually returns bytes!

Parse ``line`` into ordered statements. Raises nothing for input the grammar rejects: it returns a single :class:`SyntaxError_` with

Return a log-safe printable representation of arbitrary bytes. Bytes outside printable US-ASCII (0x20-0x7e) are rendered as ``\\xNN`` so cont

Return True if path is an existing directory. This follows symbolic links, so both islink() and isdir() can be true for the same path

Sometimes client is disconnected and command exits after. So cmdstack is gone ``code`` sets this command's exit status (``$?`` for t

Run ``line`` then return what ``echo $?`` prints (without the prompt).

Run the next queued command, or finish when the queue is drained. This is a trampoline. A command that completes synchronously calls

Take a Cowrie logentry and turn it into an OCSF event (a dict ready to be json.dumps'd by the output plugin). OCSF is a JSON schema, not

This returns the Cowrie file system objects for a directory

Parse arguments for redirections and return cleaned args and ordered redirection operations.

Send one line, return only the bytes it produced (prompt stripped).

Retrieve the content of a file in the honeyfs It follows links. It retrieves the content in this order 1) if there's

Just run a deferred sql query, only care about errors

Used to resolve a current working directory and a relative reference into an absolute file reference.

Called when we send data to the user @type data: L{bytes} @param data: Data sent to the client from the server

Build a T_DIR entry.

Just run a deferred sql query, only care about errors

Build the root pickle entry (a T_DIR named '/').

Return True if communication to this address is allowed, False if blocked (for both IPs and DNS names).

Return True if path is an existing regular file. This follows symbolic links, so both islink() and isfile() can be true for the same

args must be a list of arguments

Check if a request for the given key is allowed. Args: key: The key to check (e.g., hostname, IP address) Retur

Fake function for mockup.

Return the host from my session's transport.

Return the peer from my session's transport.

saves the current file system to the pickle :return:

Parse statements separated by ``;`` / newline / ``&&`` / ``||`` until a reserved stop word, a ``)`` / ``;;`` token, or the end of input.

Parse NEW-ENVIRON subnegotiation data into a dictionary. Format: [VAR|USERVAR name VALUE value]* with ESC for escaping.

Expand a command's words against the live context, now. Operator strings pass through; each word tree is evaluated against the curren

Return True if ``contents`` looks like a binary executable, not a script. A shell script is text: ASCII, or otherwise valid UTF-8. So anything wi

Build common HTTP headers for VT API requests

Build a T_FILE pickle entry: [name, T_FILE, uid, gid, size, mode, ctime, contents, target, realfile].

Make an HTTP request with standard error handling Args: method: HTTP method (GET, POST, etc) url: Full URL t

Mark rules as flushed

Create ConfigParser from a config_string.

Load /etc/group

Use logDispatch when the HoneypotTransport prefix is not available. Here you can explicitly set the sessionIds to tie the sessions to

Override because OpenSSH pads with 0 on KEXINIT

Handle NEW-ENVIRON (RFC 1572) subnegotiation. Parses environment variables sent by the client and logs them. Also detects CV

Build a T_DIR entry.