yet more verbosity levels

Level 0: Default. Everything boring gets one line.
         Print abridged event log if something not
         pre-defined as boring happens
Level 1: Event list is printed for all logins
         where the client did anything after login
Level 2: Print timestamp, type, and message for
         every event
Level 3: Basically just group the log by session
         and dump it as pretty-printed JSON

1 files changed, 63 insertions, 22 deletions

diff --git a/cowrieder.py b/cowrieder.py
index dfc1e58..1a623db 100644
--- a/cowrieder.py
+++ b/cowrieder.py
@@ -11,9 +11,18 @@ def ccgen(seed=""): # Color code generator
     return "\x1b[38;2;{r};{g};{b}m".format(r=random.randrange(50, 256), g=random.randrange(50, 256), b=random.randrange(50, 256))
   return "\x1b[0m"
 
+def ttylog(mystring): #mystring
+  if(os.isatty(1)):
+    print(mystring)
+
+def ppip(addr, spacing = True): # Pretty-print an address with colour and, if it's IPv4, a consistent width
+  if(len(addr) <= 16 and spacing):
+    return ccgen(addr) + addr + ccgen() + (" " * (15 - len(addr)))
+  return ccgen(addr) + addr + ccgen()
+
 if not 0 <= 1 < len(sys.argv): # TODO: integrate argparse
   print("Provide a path to a Cowrie JSON log file")
-  exit()
+  exit(1)
 filepath = sys.argv[1]
 
 verbosity = 0
@@ -59,11 +68,11 @@ filter_ip = ""
 if 0 <= 2 < len(sys.argv):
   filter_ip = sys.argv[2]
 
-if(verbosity == 1): # Verbose mode: print timestamp, event type and message (if applicable) for every event. I could probably do better but I'm lazy
+if(verbosity == 2): # High verbosity mode: print timestamp, event type and message (if applicable) for every event. I could probably do better but I'm lazy
   for session_id in sessions:
-    ip = session_ips[session]
+    ip = session_ips[session_id]
     if(ip == filter_ip or not filter_ip):        
-      print("\n--- Session " + ccgen(session_id) + session_id + ccgen() + " from " + ccgen(ip) + session_ips[session_id] + ccgen() +" ---")
+      print("\n--- Session " + ccgen(session_id) + session_id + ccgen() + " from " + ppip(ip, False) +" ---")
       for entry in sessions[session_id]:
         if(entry['message']):
           eventid = entry['eventid']
@@ -71,15 +80,18 @@ if(verbosity == 1): # Verbose mode: print timestamp, event type and message (if
         else:
           print(entry["timestamp"] + " > " + entry['eventid'])
 
-elif(verbosity == 2): # Maximum verbosity: basically just pretty print the now-sorted-by-session logs
+elif(verbosity == 3): # Maximum verbosity: literally just pretty print the now-sorted-by-session logs
   print(json.dumps(sessions, indent=4))
 
-else: # Default verbosity: just the good stuff
+else: # Default (low) verbosity: just the good stuff
   for session_id in sessions:
+
     ip = session_ips[session_id]
     timestamp = session_timestamps[session_id][:22].replace("T", " ")
+
     if(session_id not in session_successful_login):
-      print(timestamp + " > Ping from " + ccgen(ip) + ip + ccgen() + " lasting " + session_durations[session_id] + "s")
+      print(timestamp + " > " + ppip(ip) + " > Empty ping lasting " + session_durations[session_id] + "s")
+
     elif(not session_successful_login[session_id]):
       cred_combos = []
       for entry in sessions[session_id]:
@@ -88,24 +100,53 @@ else: # Default verbosity: just the good stuff
           if("password" in entry):
             pw = entry["password"]
           cred_combos.append((entry["username"], pw))
-      print(timestamp + " > Failed login attempt from " + ccgen(ip) + ip + ccgen() + " with credentials " + str(cred_combos))
+      print(timestamp + " > " + ppip(ip) + " > Failed login: " + str(cred_combos))
+
     elif(session_id in session_ran_command):
-      print(timestamp + " > Session from " + ccgen(ip) + ip + ccgen() + ":")
-      for entry in sessions[session_id]:
-        match(entry["eventid"]):
-          case "cowrie.login.failed":
-            pw = []
-            if("password" in entry):
-              pw = entry["password"]
-            print(" | Failed login attempt: " + entry["username"] + "/" + str(pw))
-          case "cowrie.login.success":
-            print(" | Successful login: " + entry["username"] + "/" + entry["password"])
-          case "cowrie.command.input":
-            print(" | CMD: " + entry["input"])
-      print(" *- Disconnected after " + session_durations[session_id] + "s")
+      collapse_cmdping = False
+      pingcmds = []
+      if(verbosity != 1):
+        for entry in sessions[session_id]:
+          if(entry["eventid"] == "cowrie.command.input"):
+            argv0 = entry["input"]
+            if(" " in argv0):
+              argv0 = entry["input"][:entry["input"].index(" ")]
+            if(argv0 in ['uname', 'nproc', 'echo']):
+              pingcmds.append(argv0)
+              collapse_cmdping = True
+
+      if(collapse_cmdping):
+        cred_combos = []
+        for entry in sessions[session_id]:
+          if(entry["eventid"] == "cowrie.login.failed" or entry["eventid"] == "cowrie.login.success"):
+            cred_combos.append((entry["username"], entry["password"]))
+        print(timestamp + " > " + ppip(ip) + " > Command ping: " + str(cred_combos) + " > " + str(pingcmds))
+
+      else:
+        print(timestamp + " > " + ppip(ip) + " > Session:")
+        for entry in sessions[session_id]:
+          match(entry["eventid"]):
+            case "cowrie.login.failed":
+              pw = []
+              if("password" in entry):
+                pw = entry["password"]
+              print(" | Failed login: " + entry["username"] + "/" + str(pw))
+            case "cowrie.login.success":
+              print(" | Successful login: " + entry["username"] + "/" + entry["password"])
+            case "cowrie.command.input":
+              print(" | CMD: " + entry["input"])
+            case "cowrie.session.file_download":
+              df = ""
+              if("url" in entry):
+                df = entry["url"]
+              elif("destfile" in entry):
+                df = entry["destfile"]
+              print(" | Saved file " + df + " to " + entry["outfile"][:40])
+        print(" X Disconnected after " + session_durations[session_id] + "s")
+        
     else:
       cred_combos = []
       for entry in sessions[session_id]:
         if(entry["eventid"] == "cowrie.login.failed" or entry["eventid"] == "cowrie.login.success"):
           cred_combos.append((entry["username"], entry["password"]))
-      print(timestamp + " > Successful login from " + ccgen(ip) + ip + ccgen() + " with credentials " + str(cred_combos))
+      print(timestamp + ppip(ip) + " > Successful login: " + str(cred_combos))