Drop a single pair of surrounding quotes from a case pattern so a quoted literal like ``'x86_64'`` matches; glob metacharacters in an

Change message to be like OpenSSH

Change message to be like OpenSSH

The pre-2026 DShield API took a base64-encoded auth_key and decoded it before computing the HMAC. The current submitapi uses the key

Replicate the wiring SSHSessionForCowrieUser.openShell sets up.

Add standard tags to all events

All arguments are bytes @param login: user id @type login: bytes @param passwd: password @type passwd: bytes

search for awk execution patterns, either direct {} code or only executed for a certain regex { } /regex/ { }

This is the awk `print` command that operates on a single line only

Print bad argument and exit

This function ensures that the right mapping is set up to convert source ip (src_ip) into geo data.

This function aims to set at least a geoip pipeline to map IP to geo locations

This function check whether the index exists.

Check if running as root and exit if so.

Sends exit to the Telnet server and closes connection. Fires the deferred with the command's output.

this gets called once collection is complete

Build the error a real shell prints when a command cannot be run. For a path-like command (one starting with "." or "/") match bash's

This seems to be the only reliable place of catching lost connection

Fires on pre-authentication disconnects

Finalize the session: hash and store any captured stdin, redirected files, and the TTY log, then drop references to the terminal.

This converts a nested dictionary with bytes in it to string

Force stop the Cowrie service.

Set up the current directory as a cowrie state directory. Writes ./etc/cowrie.cfg from the bundled template and creates the var/ skeleton (lo

Restart the Cowrie service.

Launch a shell (mainly for Docker use).

Print the current status of Cowrie.

Crash report

Returns an unready domain and its snapshot information. Guarantee that the IP is free with the ip_tester function.

Generates a UUID Version 1 (time-based). Returns: A uuid.UUID object.

Check if file already was analyzed by cuckoo

Twisted's Telnet.dataReceived() raises ValueError on an unrecognised byte following IAC (e.g. a scanner sending IAC 0x01 outside a WI

convert decimal dotted quad string to long integer this will throw builtins.OSError on failure

Walk local_root and embed each regular file's bytes into the matching pickle entry's A_CONTENTS. A file maps to the pickle entry at "/"

This is the main emit() hook that gets called by the the Twisted logging To make this work with Cowrie, the event dictionary needs t

fields is a sequence of (name, value) elements for regular form fields. files is a sequence of (name, filename, value) elements for data to b

Redirect EOF to emulated shell. If shell is gone, then disconnect

Execute a single command as the target user.

Display first-time use message (cwd-relative log path).

Download `url` via FTP

Async FTP download using Twisted FTPClient

Get the free stats from /proc

Get a MAC and IP that are not being used by any guest.

Return ``$?`` -- the last command's exit status, as a string.

Handle DATA packet

Handle ERROR packet