diff --git a/cowrie/wardenfiler.py b/cowrie/wardenfiler.py index 8b9f6c567d4dad2434af5b9a7e0256dcdbcd33da..342f1de6b804f7f476a52b147b09d630080ca9fb 100644 --- a/cowrie/wardenfiler.py +++ b/cowrie/wardenfiler.py @@ -200,6 +200,7 @@ class Output(cowrie.core.output.Output): ) entry["loggedin"] = False + entry["credentials"] = [] # AID - aggregation ID entry["aid"] = aid = ','.join((entry["src_ip"], entry["dst_ip"])) self.sessions[entry["session"]] = entry @@ -247,19 +248,15 @@ class Output(cowrie.core.output.Output): u, p = entry["username"], entry["password"] s = entry["session"] if s in self.sessions: - aid = self.sessions[s]["aid"] - self.sessions[s]["credentials"] = self.attackers_creds.get(aid, []) - self.sessions[s]["credentials"].append({"Username": u, "Password": p, "Accepted": True}) self.sessions[s]["input"] = [] self.sessions[s]["loggedin"] = True - self.attackers_creds[aid] = [] + self.sessions[s]["credentials"].append({"Username": u, "Password": p, "Accepted": True}) elif entry["eventid"] == "cowrie.login.failed": u, p = entry["username"], entry["password"] s = entry["session"] if s in self.sessions: - aid = self.sessions[s]["aid"] - self.attackers_creds[aid].append({"Username": u, "Password": p}) + self.sessions[s]["credentials"].append({"Username": u, "Password": p}) elif entry["eventid"] == 'cowrie.command.input': s = entry["session"] @@ -405,4 +402,10 @@ class Output(cowrie.core.output.Output): if self.sessions[s]["credentials"]: event["Credentials"] = self.sessions[s]["credentials"] self.save_event(event) + + if s in self.sessions: + # Store attempted credentials (all) to the aggregation cache + aid = self.sessions[s]["aid"] + self.attackers_creds[aid].extend(self.sessions[s]["credentials"]) + # Discard the session self.sessions.pop(s, None)