Functions — github.com/cowrie/cowrie

hub / github.com/cowrie/cowrie / functions

Functions2,302 in github.com/cowrie/cowrie

⨍ Functions 2,302◇ Types & classes 393↳ Endpoints 20

↓ 7 callersMethodget_channel

(self, channel_num: int, parent: str)

src/cowrie/ssh_proxy/protocols/ssh.py:406

↓ 7 callersMethodhandle_CTRL_D

(self)

src/cowrie/llm/protocol.py:414

↓ 7 callersFunctionread_data_bytes

Read bundled cowrie.data/<parts> as bytes. Raises FileNotFoundError if the resource does not exist.

src/cowrie/core/resources.py:34

↓ 7 callersFunctionrun_exec

Run `cmd` over an exec channel and return the exit status the session would report to the SSH client via processEnded.

src/cowrie/test/test_exit_status.py:156

↓ 6 callersMethod_extract_cve_2026_24061_user

Extract username from CVE-2026-24061 exploit payload. The exploit uses USER=-f<user> or USER=-f <user> to bypass authentication.

src/cowrie/telnet/userauth.py:237

↓ 6 callersMethod_word_literal

Return the text of a word that is a single unquoted literal atom, else None. Keywords are recognised only through this, so a quoted or expande

src/cowrie/shell/bashparse.py:407

↓ 6 callersMethod_write

(self, relpath: str, data: bytes)

src/cowrie/test/test_createfs.py:34

↓ 6 callersMethodchmod

(self, path: str, perm: int)

src/cowrie/shell/fs.py:550

↓ 6 callersFunctioncreate_endpoint_services

(reactor, parent, listen_endpoints, factory)

src/cowrie/core/utils.py:158

↓ 6 callersFunctionlogit

(ftxt)

src/cowrie/scripts/createfs.py:83

↓ 6 callersFunctionprocess_status

A process-end reason carrying an exit status. ``ProcessDone`` for 0 (a clean exit) and ``ProcessTerminated`` otherwise, so the SSH session re

src/cowrie/shell/command.py:22

↓ 6 callersFunctionremove_stale_pidfile

Remove the PID file if it exists.

src/cowrie/scripts/cowrie.py:78

↓ 6 callersFunctionrun_exec_scp_push

Drive a full exec-channel `scp -t` push. The SCP-framed bytes are delivered after the command has started, exactly as the SSH channel deliver

src/cowrie/test/test_scp_exec.py:52

↓ 6 callersMethodshowPrompt

(self)

src/cowrie/shell/honeypot.py:721

↓ 6 callersMethodsleep

(self, time: float, time2: float | None = None)

src/cowrie/commands/apt.py:57

↓ 6 callersMethodstat

(self, path: str, follow_symlinks: bool = True)

src/cowrie/shell/fs.py:601

↓ 6 callersMethodwrite

(self, event: dict[str, Any])

src/cowrie/output/s3.py:57

↓ 6 callersMethodwrite

Because of the presence of two ProtocolTransportMixin in the protocol stack once authenticated, I need to override write() and remove

src/cowrie/telnet/transport.py:78

↓ 5 callersMethod_add_to_collection

Add a file or URL to the configured collection Args: resource_type: 'files' or 'urls' resource_id: The file

src/cowrie/output/virustotal.py:652

↓ 5 callersFunction_file_entry

Build a T_FILE pickle entry with empty A_CONTENTS.

src/cowrie/test/test_fsctl.py:18

↓ 5 callersFunction_link_entry

Build a T_LINK entry pointing at an absolute path inside the tree.

src/cowrie/test/test_honeyfs.py:33

↓ 5 callersMethod_patch_tree

(self, root: list)

src/cowrie/test/test_honeyfs.py:206

↓ 5 callersFunction_root

(children: list)

src/cowrie/test/test_fsctl.py:28

↓ 5 callersMethod_set_contents_path

(self, path: str)

src/cowrie/test/test_honeyfs.py:203

↓ 5 callersMethod_write

(self, relpath: str, data: bytes)

src/cowrie/test/test_fsctl.py:44

↓ 5 callersMethodcheckUserPass

(self, theusername: bytes, thepassword: bytes, ip: str)

src/cowrie/core/checkers.py:119

↓ 5 callersMethodchown

(self, path: str, uid: int, gid: int)

src/cowrie/shell/fs.py:556

↓ 5 callersMethodepoch_to_string_utc

(t)

src/cowrie/output/abuseipdb.py:367

↓ 5 callersMethodextract_bool

(self)

src/cowrie/ssh_proxy/protocols/base_protocol.py:54

↓ 5 callersFunctionis_process_running

Check if a process with the given PID is running.

src/cowrie/scripts/cowrie.py:69

↓ 5 callersFunctionmake_protocol

(channel_type: str)

src/cowrie/test/test_insults.py:30

↓ 5 callersMethodopen

#log.msg("fs.open %s" % filename) #if (openFlags & os.O_APPEND == os.O_APPEND): # log.msg("fs.open append") #if

src/cowrie/shell/fs.py:440

↓ 5 callersMethodparse_args

(self)

src/cowrie/commands/chmod.py:106

↓ 5 callersFunctionstring_to_hex

(message: str)

src/cowrie/ssh_proxy/util.py:11

↓ 4 callersMethod__init__

(self, avatar)

src/cowrie/shell/protocol.py:50

↓ 4 callersMethod__init__

(self, avatar)

src/cowrie/llm/protocol.py:38

↓ 4 callersMethod_assert_fs

(self, out: dict)

src/cowrie/test/test_ocsf.py:369

↓ 4 callersMethod_assert_ssh

(self, out: dict)

src/cowrie/test/test_ocsf.py:220

↓ 4 callersMethod_build_tree

(self)

src/cowrie/test/test_createfs.py:39

↓ 4 callersMethod_chainNegotiation

(self, res, func, option)

src/cowrie/telnet/transport.py:181

↓ 4 callersMethod_clip

(self, s: str, max_len: int)

src/cowrie/output/discord.py:196

↓ 4 callersMethod_emit_redirection_error

Send a redirection-related error to the terminal and flag failure.

src/cowrie/shell/pipe.py:268

↓ 4 callersMethod_end_loop

(self)

src/cowrie/shell/honeypot.py:300

↓ 4 callersMethod_eval

(self, command: object)

src/cowrie/test/test_bashparse.py:319

↓ 4 callersMethod_finish

(self, success: bool = True)

src/cowrie/commands/dd.py:89

↓ 4 callersMethod_getAttrs

(self, s)

src/cowrie/shell/filetransfer.py:200

↓ 4 callersMethod_get_option_name

Get human-readable name for a telnet option byte.

src/cowrie/telnet/transport.py:187

↓ 4 callersMethod_has_mode

(self, path: str, mask: int)

src/cowrie/commands/base.py:1381

↓ 4 callersMethod_is_separator

(self, node: Tree | Token | None)

src/cowrie/shell/bashparse.py:396

↓ 4 callersMethod_leaf_value

Return the string value of a node's single leaf token.

src/cowrie/shell/bashparse.py:905

↓ 4 callersMethod_log_negotiation

Log a telnet option negotiation once per (command, option) per connection. Logged for security monitoring and CVE detection. A scanne

src/cowrie/telnet/transport.py:194

↓ 4 callersMethod_post_comment

Send a comment to VirusTotal for a file or URL Args: resource_type: 'files' or 'urls' resource_id: The file

src/cowrie/output/virustotal.py:514

↓ 4 callersMethod_skip_separators

(self, cursor: _Cursor)

src/cowrie/shell/bashparse.py:731

↓ 4 callersFunction_ssh_activity

Fill in the shared OCSF 'SSH Activity' (class_uid 4007) scaffolding. Endpoints are built from whatever address keys are present in the event

src/cowrie/core/ocsf.py:62

↓ 4 callersMethodcheck_arguments

(self, application, args)

src/cowrie/shell/command.py:101

↓ 4 callersFunctioncheck_initialized

Refuse to start unless cwd looks like a cowrie state directory or a cowrie source checkout. Marker files (any one of): - ./etc/cowrie.cfg

src/cowrie/scripts/cowrie.py:33

↓ 4 callersMethodclose

(self)

src/cowrie/telnet_proxy/handler.py:111

↓ 4 callersMethodcommand_substitution

Execute ``source`` and return its captured stdout (newlines stripped).

src/cowrie/shell/bashparse.py:188

↓ 4 callersMethoddo_free

print free statistics

src/cowrie/commands/free.py:47

↓ 4 callersMethodgetProtoTransport

Due to protocol nesting differences, we need provide how we grab the proper transport to access underlying SSH information. Meant to

src/cowrie/llm/protocol.py:55

↓ 4 callersFunctionget_config_path

Locate operator config files. Search order, cwd-relative except the system-wide path: 1. /etc/cowrie/cowrie.cfg (system-wide install)

src/cowrie/core/config.py:67

↓ 4 callersMethodgetgrgid

Get group entry for gid

src/cowrie/shell/pwd.py:187

↓ 4 callersMethodgetpwuid

Get passwd entry for uid

src/cowrie/shell/pwd.py:99

↓ 4 callersFunctionint_to_hex

(value: int)

src/cowrie/ssh_proxy/util.py:22

↓ 4 callersFunctionis_directory

Returns whether or not the file at 'path' is a directory :param fs: :param path: :return:

src/cowrie/scripts/fsctl.py:86

↓ 4 callersFunctionkernel_name

()

src/cowrie/commands/uname.py:22

↓ 4 callersMethodno_permission

(self)

src/cowrie/commands/iptables.py:443

↓ 4 callersMethodoutput

This is the cat output, with optional line numbering

src/cowrie/commands/cat.py:73

↓ 4 callersMethodoutput

This is the awk output.

src/cowrie/commands/awk.py:107

↓ 4 callersMethodparse_num_packet

(self, parent: str, message_num: int, payload: bytes)

src/cowrie/ssh_proxy/protocols/ssh.py:91

↓ 4 callersMethodprint_usage_error

Print usage error message

src/cowrie/commands/nc.py:72

↓ 4 callersMethodprocessEnded

(self, reason=None)

src/cowrie/llm/telnet.py:114

↓ 4 callersFunctionread_honeyfs_bytes

Read a honeyfs file with operator-override cascade. Resolution: 1. If [honeypot] contents_path is set and <contents_path>/<relpath>

src/cowrie/shell/honeyfs.py:123

↓ 4 callersFunctionread_pid

Read the PID from the PID file, return None if not found or invalid.

src/cowrie/scripts/cowrie.py:59

↓ 4 callersFunctionrun

()

src/cowrie/scripts/fsctl.py:874

↓ 4 callersMethodsavevars

Save the user vars to json file

src/cowrie/core/auth.py:180

↓ 4 callersMethodscanfile

Check file scan report for a hash Argument is full event so we can access full file later on

src/cowrie/output/virustotal.py:221

↓ 4 callersMethodupdate_size

(self, filename: str, size: int)

src/cowrie/shell/fs.py:627

↓ 4 callersMethoduptime

Uptime

src/cowrie/llm/protocol.py:247

↓ 4 callersMethoduser_is_root

(self)

src/cowrie/commands/iptables.py:56

↓ 4 callersMethodwrite

(self, data)

src/cowrie/telnet_proxy/client_transport.py:60

↓ 3 callersFunction_find_in

Walk to entry at path. Test helper, asserts found.

src/cowrie/test/test_fsctl.py:32

↓ 3 callersMethod_handleNegotiationError

(self, f, func, option)

src/cowrie/telnet/transport.py:151

↓ 3 callersMethod_init_collection

Resolve the collection id: look up an existing collection with this name and reuse it, otherwise create one. Called during start() if

src/cowrie/output/virustotal.py:562

↓ 3 callersMethod_process

(self, data: bytes)

src/cowrie/commands/cut.py:113

↓ 3 callersMethod_report_syntax_error

Write the message bash prints for a syntax error and set $? to 2.

src/cowrie/shell/honeypot.py:210

↓ 3 callersMethod_send

(self, message: str)

src/cowrie/output/signal.py:50

↓ 3 callersMethod_show_prompt

Display the appropriate command prompt to the user.

src/cowrie/llm/protocol.py:235

↓ 3 callersMethod_tokens

(self, line: str)

src/cowrie/test/test_bashparse.py:289

↓ 3 callersMethod_var_name

Return (name, special) for a dollar_var/dollar_brace node.

src/cowrie/shell/bashparse.py:911

↓ 3 callersFunctionbin_string_to_hex

(message: bytes)

src/cowrie/ssh_proxy/util.py:17

↓ 3 callersMethodcalculate_packets

(byte_count: int)

src/cowrie/commands/ifconfig.py:32

↓ 3 callersMethodcall_command

(self, pp, cmd, *args)

src/cowrie/shell/protocol.py:249

↓ 3 callersMethodcan_rereport

(self, ip_key, current_time)

src/cowrie/output/abuseipdb.py:237

↓ 3 callersMethodcleanup_and_dump_state

(self, mode=0)

src/cowrie/output/abuseipdb.py:258

↓ 3 callersMethodconnectionLost

Called when the connection is shut down. Clear any circular references here, and any external references to this Protocol. Th

src/cowrie/shell/protocol.py:140

↓ 3 callersMethodconnectionMade

(self)

src/cowrie/shell/protocol.py:88

↓ 3 callersMethodconnectionMade

(self)

src/cowrie/llm/protocol.py:70

↓ 3 callersMethodconnectionMade

(self)

src/cowrie/test/test_telnet_transport.py:131

↓ 3 callersMethodconvert_bytes_to_mx

(bytes_eth0: int)

src/cowrie/commands/ifconfig.py:36

← previous next →101–200 of 2,302, ranked by callers