Describe the bug
Hi all, I was analyzing logs from Cowrie and noticed that it wasn't downloading a lot of the Mirai botnet variants out there. They would run the command /bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI and then cowrie would freeze until connection times out.
To Reproduce
Steps to reproduce the behavior:
Connect to cowrie honeypot
Run command /bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI
Cowrie hangs
Expected behavior
Running this in a normal Linux environment produces the results:
# /bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI
BusyBox v1.22.1 (Debian 1:1.22.0-19+b3) multi-call binary.
Usage: wget [-c|--continue] [-s|--spider] [-q|--quiet] [-O|--output-document FILE]
[--header 'header: value'] [-Y|--proxy on/off] [-P DIR]
[-U|--user-agent AGENT] URL...
Retrieve files via HTTP or FTP
-s Spider mode - only check file existence
-c Continue retrieval of aborted transfer
-q Quiet
-P DIR Save to DIR (default .)
-O FILE Save to FILE ('-' for stdout)
-U STR Use STR for User-Agent header
-Y Use proxy ('on' or 'off')
BusyBox v1.22.1 (Debian 1:1.22.0-19+b3) multi-call binary.
Usage: tftp [OPTIONS] HOST [PORT]
Transfer a file from/to tftp server
-l FILE Local FILE
-r FILE Remote FILE
-g Get file
-p Put file
-b SIZE Transfer blocks of SIZE octets
ECCHI: applet not found
Server (please complete the following information):
Describe the bug Hi all, I was analyzing logs from Cowrie and noticed that it wasn't downloading a lot of the Mirai botnet variants out there. They would run the command
/bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI
and then cowrie would freeze until connection times out.To Reproduce Steps to reproduce the behavior:
/bin/busybox wget; /bin/busybox tftp; /bin/busybox ECCHI
Expected behavior Running this in a normal Linux environment produces the results:
Server (please complete the following information):