Repository: cowrie/cowrie

Issue:
Unable to curl or wget URL with hostname
If you try to download anything via curl or wget and url contains hostname not ip address it crashes.

I am pretty sure it is because of https://github.com/cowrie/cowrie/pull/1557/commits/0b3b257e0ecf10b5b4d381d724cf4c3e23f0ed81 and https://github.com/cowrie/cowrie/pull/1557/commits/ff6bfdcdb75fefbc35ac19fad7c98c0f69da48b7

Line:         # TODO: need to do full name resolution.


Example:

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@czbrqobpvmssd01:~# wget notino.czConnection to czbrqobpvmssd01 closed by remote host.
Connection to czbrqobpvmssd01 closed.




2021-05-28T14:13:00.312387Z [HoneyPotSSHTransport,9,172.16.23.9] Unhandled Error
	Traceback (most recent call last):
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/log.py", line 101, in callWithLogger
	    return callWithContext({"system": lp}, func, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/log.py", line 85, in callWithContext
	    return context.call({ILogContext: newCtx}, func, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/context.py", line 118, in callWithContext
	    return self.currentContext().callWithContext(ctx, func, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/context.py", line 83, in callWithContext
	    return func(*args, **kw)
	--- <exception caught here> ---
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/internet/posixbase.py", line 687, in _doReadOrWrite
	    why = selectable.doRead()
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/internet/tcp.py", line 246, in doRead
	    return self._dataReceived(data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/internet/tcp.py", line 251, in _dataReceived
	    rval = self.protocol.dataReceived(data)
	  File "/home/cowrie/cowrie/src/cowrie/ssh/transport.py", line 141, in dataReceived
	    self.dispatchMessage(messageNum, packet[1:])
	  File "/home/cowrie/cowrie/src/cowrie/ssh/transport.py", line 145, in dispatchMessage
	    transport.SSHServerTransport.dispatchMessage(self, message_num, payload)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/transport.py", line 747, in dispatchMessage
	    self.service.packetReceived(messageNum, payload)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/service.py", line 47, in packetReceived
	    return f(packet)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/connection.py", line 265, in ssh_CHANNEL_DATA
	    channel.dataReceived(data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/session.py", line 174, in dataReceived
	    self.client.transport.write(data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/session.py", line 230, in write
	    self.proto.dataReceived(data)
	  File "/home/cowrie/cowrie/src/cowrie/insults/insults.py", line 125, in dataReceived
	    insults.ServerProtocol.dataReceived(self, data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/insults/insults.py", line 520, in dataReceived
	    self.terminalProtocol.keystrokeReceived(ch, None)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/recvline.py", line 436, in keystrokeReceived
	    m()
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 328, in handle_RETURN
	    return recvline.RecvLine.handle_RETURN(self)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/recvline.py", line 494, in handle_RETURN
	    self.lineReceived(line)
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 189, in lineReceived
	    self.cmdstack[-1].lineReceived(line)
	  File "/home/cowrie/cowrie/src/cowrie/shell/honeypot.py", line 116, in lineReceived
	    self.runCommand()
	  File "/home/cowrie/cowrie/src/cowrie/shell/honeypot.py", line 325, in runCommand
	    self.protocol.call_command(pp, cmdclass, *cmd_array[0]["rargs"])
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 309, in call_command
	    HoneyPotBaseProtocol.call_command(self, pp, cmd, *args)
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 198, in call_command
	    obj.start()
	  File "/home/cowrie/cowrie/src/cowrie/commands/wget.py", line 122, in start
	    self.deferred = self.download(self.url, self.outfile)
	  File "/home/cowrie/cowrie/src/cowrie/commands/wget.py", line 157, in download
	    if ipaddress.ip_address(host).is_private:
	  File "/usr/lib64/python3.6/ipaddress.py", line 54, in ip_address
	    address)
	builtins.ValueError: 'notino.cz' does not appear to be an IPv4 or IPv6 address

Unable to curl or wget URL with hostname
If you try to download anything via curl or wget and url contains hostname not ip address it crashes.

I am pretty sure it is because of https://github.com/cowrie/cowrie/pull/1557/commits/0b3b257e0ecf10b5b4d381d724cf4c3e23f0ed81 and https://github.com/cowrie/cowrie/pull/1557/commits/ff6bfdcdb75fefbc35ac19fad7c98c0f69da48b7

Line:         # TODO: need to do full name resolution.


Example:

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@czbrqobpvmssd01:~# wget notino.czConnection to czbrqobpvmssd01 closed by remote host.
Connection to czbrqobpvmssd01 closed.




2021-05-28T14:13:00.312387Z [HoneyPotSSHTransport,9,172.16.23.9] Unhandled Error
	Traceback (most recent call last):
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/log.py", line 101, in callWithLogger
	    return callWithContext({"system": lp}, func, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/log.py", line 85, in callWithContext
	    return context.call({ILogContext: newCtx}, func, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/context.py", line 118, in callWithContext
	    return self.currentContext().callWithContext(ctx, func, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/python/context.py", line 83, in callWithContext
	    return func(*args, **kw)
	--- <exception caught here> ---
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/internet/posixbase.py", line 687, in _doReadOrWrite
	    why = selectable.doRead()
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/internet/tcp.py", line 246, in doRead
	    return self._dataReceived(data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/internet/tcp.py", line 251, in _dataReceived
	    rval = self.protocol.dataReceived(data)
	  File "/home/cowrie/cowrie/src/cowrie/ssh/transport.py", line 141, in dataReceived
	    self.dispatchMessage(messageNum, packet[1:])
	  File "/home/cowrie/cowrie/src/cowrie/ssh/transport.py", line 145, in dispatchMessage
	    transport.SSHServerTransport.dispatchMessage(self, message_num, payload)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/transport.py", line 747, in dispatchMessage
	    self.service.packetReceived(messageNum, payload)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/service.py", line 47, in packetReceived
	    return f(packet)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/connection.py", line 265, in ssh_CHANNEL_DATA
	    channel.dataReceived(data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/session.py", line 174, in dataReceived
	    self.client.transport.write(data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/ssh/session.py", line 230, in write
	    self.proto.dataReceived(data)
	  File "/home/cowrie/cowrie/src/cowrie/insults/insults.py", line 125, in dataReceived
	    insults.ServerProtocol.dataReceived(self, data)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/insults/insults.py", line 520, in dataReceived
	    self.terminalProtocol.keystrokeReceived(ch, None)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/recvline.py", line 436, in keystrokeReceived
	    m()
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 328, in handle_RETURN
	    return recvline.RecvLine.handle_RETURN(self)
	  File "/home/cowrie/cowrie/cowrie-env/lib64/python3.6/site-packages/twisted/conch/recvline.py", line 494, in handle_RETURN
	    self.lineReceived(line)
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 189, in lineReceived
	    self.cmdstack[-1].lineReceived(line)
	  File "/home/cowrie/cowrie/src/cowrie/shell/honeypot.py", line 116, in lineReceived
	    self.runCommand()
	  File "/home/cowrie/cowrie/src/cowrie/shell/honeypot.py", line 325, in runCommand
	    self.protocol.call_command(pp, cmdclass, *cmd_array[0]["rargs"])
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 309, in call_command
	    HoneyPotBaseProtocol.call_command(self, pp, cmd, *args)
	  File "/home/cowrie/cowrie/src/cowrie/shell/protocol.py", line 198, in call_command
	    obj.start()
	  File "/home/cowrie/cowrie/src/cowrie/commands/wget.py", line 122, in start
	    self.deferred = self.download(self.url, self.outfile)
	  File "/home/cowrie/cowrie/src/cowrie/commands/wget.py", line 157, in download
	    if ipaddress.ip_address(host).is_private:
	  File "/usr/lib64/python3.6/ipaddress.py", line 54, in ip_address
	    address)
	builtins.ValueError: 'notino.cz' does not appear to be an IPv4 or IPv6 address



Discussion:

Resolving patch:
diff --git a/src/cowrie/commands/curl.py b/src/cowrie/commands/curl.py
--- a/src/cowrie/commands/curl.py
+++ b/src/cowrie/commands/curl.py
@@ -268,10 +268,13 @@ def download(self, url, fakeoutfile, outputfile, *args, **kwargs):
             self.exit()
             return None
 
-        # TODO: need to do full name resolution.
-        if ipaddress.ip_address(host).is_private:
-            self.errorWrite("curl: (6) Could not resolve host: {}\n".format(host))
-            return None
+        # TODO: need to do full name resolution in case someon passes DNS name pointing to local address
+        try:
+            if ipaddress.ip_address(host).is_private:
+                self.errorWrite("curl: (6) Could not resolve host: {}\n".format(host))
+                return None
+        except ValueError:
+            pass
 
         factory = HTTPProgressDownloader(
             self, fakeoutfile, url, outputfile, *args, **kwargs
diff --git a/src/cowrie/commands/wget.py b/src/cowrie/commands/wget.py
--- a/src/cowrie/commands/wget.py
+++ b/src/cowrie/commands/wget.py
@@ -154,14 +154,17 @@ def download(self, url, fakeoutfile, *args, **kwargs):
             self.errorWrite("HTTP request sent, awaiting response... ")
 
         # TODO: need to do full name resolution.
-        if ipaddress.ip_address(host).is_private:
-            self.errorWrite(
-                "Resolving {} ({})... failed: nodename nor servname provided, or not known.\n".format(
-                    host, host
+        try:
+            if ipaddress.ip_address(host).is_private:
+                self.errorWrite(
+                    "Resolving {} ({})... failed: nodename nor servname provided, or not known.\n".format(
+                        host, host
+                    )
                 )
-            )
             self.errorWrite("wget: unable to resolve host address ‘{}’\n".format(host))
             return None
+        except ValueError:
+            pass
 
         # File in host's fs that will hold content of the downloaded file
         # HTTPDownloader will close() the file object so need to preserve the name


Test patch: