{"id":13795109,"url":"https://github.com/kulinacs/cowrie-attack","last_synced_at":"2025-06-14T03:05:56.382Z","repository":{"id":85357162,"uuid":"146951050","full_name":"kulinacs/cowrie-attack","owner":"kulinacs","description":"Mapping the ATT\u0026CK matrix in a Cowrie honeypot","archived":false,"fork":false,"pushed_at":"2018-08-31T23:28:23.000Z","size":51,"stargazers_count":16,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-08T22:41:32.460Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kulinacs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-08-31T23:27:49.000Z","updated_at":"2025-03-22T10:56:44.000Z","dependencies_parsed_at":"2023-03-03T06:00:44.128Z","dependency_job_id":null,"html_url":"https://github.com/kulinacs/cowrie-attack","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kulinacs/cowrie-attack","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kulinacs%2Fcowrie-attack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kulinacs%2Fcowrie-attack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kulinacs%2Fcowrie-attack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kulinacs%2Fcowrie-attack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kulinacs","download_url":"https://codeload.github.com/kulinacs/cowrie-attack/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kulinacs%2Fcowrie-attack/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259752083,"owners_count":22905972,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T23:00:52.223Z","updated_at":"2025-06-14T03:05:56.315Z","avatar_url":"https://github.com/kulinacs.png","language":"Shell","funding_links":[],"categories":["\u003ca id=\"a53d22b9c5d09dc894413453f4755658\"\u003e\u003c/a\u003e未分类"],"sub_categories":[],"readme":"# CS6324 Project\n\nDetecting and classifying attacks in a Linux environment\n\n## Running\n\nCreate the network for the system to run on `sudo docker network create alertnet`\n\nIncrease the max mem count `sudo sysctl -w vm.max_map_count=262144`\n\nStart up the Honeypot and Elastic Stack `sudo docker-compose -f base.yml up` \n\nYou need to generate logs before you can create an index. Do this by logging in to the honepot by: `ssh root@127.0.0.1 -p 2222`\n\nWhen the stack comes up, login to Kibana \u003chttp://127.0.0.1:5601\u003e Username: `elastic` Password: `changeme`\n\nCreate an index `logstash-*`\n\nStart up ElastAlert `sudo docker-compose -f alert.yml up`\n\n## Testing a rule\n\nList containers\n\n`sudo docker ps`\n\nGrab container ID for elast alert\n\nAttach to container\n\n`sudo docker exec -it containerid /bin/sh`\n\nRules found in `/opt/elastalert/rules`\n\nConfig found at `/opt/elastalert/config.yml`\n\nRun rule\n\n`python -m elastalert.test_rule --config config.yaml \u003crule_path\u003e`\n\n## MITRE Attack Matrix\n\nhttps://attack.mitre.org/wiki/Linux_Technique_Matrix\n\n## Rule Alerting\n\nElastAlert will write back alerts to `index: elastalert_status` with the `_type: elastalert` with all information the Alert provides. As such, we created a custom alert, `MITREAttack` to put this information into ElasticSearch.\n\nTo use the `MITREAttack` alert, the following keys should be used.\n\n```\nalert: \"elastalert_modules.custom_alerts.MITREAttack\"\nattack_tactic:\nattack_name: \nattack_id:\n```\n\n## Nick's Straight Forward Rules\n\n### User enumeration\n\ncat /etc/passwd\n\ncat */????wd\n\n### Group enumerate\n\ncat /etc/group\n\n### System Enumeration\n\nuname -a\n\n### User Privilege enumeration\n\nsudo -l\n\n### Miscellaneous Find Commands\n\nSearch for setuid binaries\n\nSearch for writable directories\n\nSee: https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/\n\nFurther reading: WAF bypassing (Nick will look for link)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkulinacs%2Fcowrie-attack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkulinacs%2Fcowrie-attack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkulinacs%2Fcowrie-attack/lists"}