blob: 0518df635b53f11cf954836a01d2eeead54bfe3b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
import json
import sys
import random
import os
if not 0 <= 1 < len(sys.argv):
print("Provide a path to a Cowrie JSON log file")
exit()
filepath = sys.argv[1]
entries = []
sessions = []
session_ips = {}
with open(filepath, "r") as logfile:
for line in logfile:
entry = json.loads(line)
entries.append(entry)
session = entry['session']
if(session not in sessions):
sessions.append(session)
session_ips.update({session: entry['src_ip']})
filter_ip = ""
if 0 <= 2 < len(sys.argv):
filter_ip = sys.argv[2]
cc_session = ""
cc_ip = ""
cc_reset = ""
outpipe = os.isatty(1)
for session in sessions:
ip = session_ips[session]
if(ip == filter_ip or not filter_ip):
if(outpipe):
random.seed(session)
sr = random.randrange(50, 256)
sg = random.randrange(50, 256)
sb = random.randrange(50, 256)
random.seed(ip)
ir = random.randrange(50, 256)
ig = random.randrange(50, 256)
ib = random.randrange(50, 256)
cc_reset = "\x1b[0m"
cc_session = "\x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb)
cc_ip = "\x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib)
print("\n--- Session " + cc_session + session + cc_reset + " from " + cc_ip + session_ips[session] + cc_reset +" ---")
for entry in entries:
if(entry['session'] == session):
if(entry['message']):
eventid = entry['eventid']
print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message'])
else:
print(entry["timestamp"] + " > " + entry['eventid'])
|
