cowrieder.py


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

import json
import sys
import random

if not 0 <= 1 < len(sys.argv):
  print("Provide a path to a Cowrie JSON log file")
  exit()
filepath = sys.argv[1]
entries = []
sessions = []
session_ips = {}

with open(filepath, "r") as logfile:
  for line in logfile:
    entry = json.loads(line)
    entries.append(entry)
    session = entry['session']
    if(session not in sessions):
      sessions.append(session)
      session_ips.update({session: entry['src_ip']})

filter_ip = ""
if 0 <= 2 < len(sys.argv):
  filter_ip = sys.argv[2]

for session in sessions:
  ip = session_ips[session]
  if(ip == filter_ip or not filter_ip):
    random.seed(session)
    sr = random.randrange(50, 256)
    sg = random.randrange(50, 256)
    sb = random.randrange(50, 256)
    random.seed(ip)
    ir = random.randrange(50, 256)
    ig = random.randrange(50, 256)
    ib = random.randrange(50, 256)
    print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + session_ips[session] + "\x1b[0m ---")
    for entry in entries:
      if(entry['session'] == session):
        if(entry['message']):
          eventid = entry['eventid']
          print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message'])
        else:
          print(entry["timestamp"] + " > " + entry['eventid'])