Repository: cowrie/cowrie

Issue:
MalShare uploader not working
**Describe the bug**
In my config I have
```
[output_malshare]
enabled = true
```

and in my logs I have
```
[stdout#info] Sending file to MalShare
[stdout#info] Submited to MalShare
```

but when I check on MalShare I can't find any the binaries that have been caught in my honeypot.

**To Reproduce**
Steps to reproduce the behavior:
1. Enable MalShare submission in your config
2. Wait for a bot to drop a binary in your honeypot
3. Try to find the binary on malshare (search by md5)
4. Observe that the binary is not there

**Expected behavior**
The binary should be uploaded successfully to MalShare

**Server (please complete the following information):**
 - OS: [e.g. RedHat Linux 7.1, output of uname -a] Ubuntu 20.04, Linux 5.4.0
 - Python: 3.8.5

**Additional context**
Based on [MalShare's API docs](https://malshare.com/doc.php) it seems that uploading files now requires an API key and a slightly different POST path than the one [defined in cowrie](https://github.com/cowrie/cowrie/blob/b848ec261554ee9128640601eb9a6734b2bffefe/src/cowrie/output/malshare.py#L90). Probably adding an API key option to the config and updating the uploader with the new path and to use the API key will solve this.



Discussion:

Resolving patch:
diff --git a/src/cowrie/output/malshare.py b/src/cowrie/output/malshare.py
--- a/src/cowrie/output/malshare.py
+++ b/src/cowrie/output/malshare.py
@@ -41,7 +41,10 @@
     from urlparse import urlparse
 import requests
 
+from twisted.python import log
+
 import cowrie.core.output
+from cowrie.core.config import CowrieConfig
 
 
 class Output(cowrie.core.output.Output):
@@ -54,7 +57,7 @@ def start(self):
         """
         Start output plugin
         """
-        pass
+        self.apiKey = CowrieConfig().get('output_malshare', 'api_key')
 
     def stop(self):
         """
@@ -64,7 +67,6 @@ def stop(self):
 
     def write(self, entry):
         if entry["eventid"] == "cowrie.session.file_download":
-            print("Sending file to MalShare")
             p = urlparse(entry["url"]).path
             if p == "":
                 fileName = entry["shasum"]
@@ -78,7 +80,6 @@ def write(self, entry):
             self.postfile(entry["outfile"], fileName)
 
         elif entry["eventid"] == "cowrie.session.file_upload":
-            print("Sending file to MalShare")
             self.postfile(entry["outfile"], entry["filename"])
 
     def postfile(self, artifact, fileName):
@@ -87,12 +88,12 @@ def postfile(self, artifact, fileName):
         """
         try:
             res = requests.post(
-                "https://malshare.com/api.php?mode=cli",
-                files={fileName: open(artifact, "rb")}
+                "https://malshare.com/api.php?api_key="+self.apiKey+"&action=upload",
+                files={"upload": open(artifact, "rb")}
             )
             if res and res.ok:
-                print("Submited to MalShare")
+                log.msg("Submitted to MalShare")
             else:
-                print("MalShare Request failed: {}".format(res.status_code))
+                log.msg("MalShare Request failed: {}".format(res.status_code))
         except Exception as e:
-            print("MalShare Request failed: {}".format(e))
+            log.msg("MalShare Request failed: {}".format(e))


Test patch: