Cowrie FATAL Exited too Quickly

[xmlx]

When i try to run supervisorctl status i get as above: Cowrie FATAL Exited too quickly. Below are the error log.

--- --- File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/plugin.py", line 171, in getCache provider = pluginModule.load() File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/modules.py", line 392, in load return self.pathEntry.pythonPath.moduleLoader(self.name) File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/reflect.py", line 308, in namedAny topLevelPackage = _importAndCheckStack(trialname) File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/python/reflect.py", line 255, in _importAndCheckStack reraise(excValue, excTraceback) File "/opt/cowrie/src/twisted/plugins/cowrie_plugin.py", line 51, in from cowrie.core.utils import create_endpoint_services, get_endpoints_from_section File "/opt/cowrie/src/cowrie/core/utils.py", line 9, in from twisted.application import internet File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/twisted/application/internet.py", line 54, in from automat import MethodicalMachine File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/automat/init.py", line 2, in from ._methodical import MethodicalMachine File "/opt/cowrie/cowrie-env/local/lib/python2.7/site-packages/automat/_methodical.py", line 7, in from inspect import getfullargspec as getArgsSpec exceptions.ImportError: cannot import name getfullargspec

[wrharding]

I'm able to reproduce this on Ubuntu 18.04 running via Proxmox LXC (also verified the issue exists on my sensor VM). What OS are you running and how?

[xmlx]

VMware Distributor ID: Ubuntu Description: Ubuntu 18.04.6 LTS Release: 18.04 Codename: bionic

[wrharding]

We're in dependency hell.

So the twisted module utilizes the automat module which in turn utilizes the core Python module inspect.

The function that this line calls: from inspect import getfullargspec as getArgsSpec exists only in Python 3.

https://docs.python.org/2.7/library/inspect.html

https://docs.python.org/3.8/library/inspect.html

Here is my full output from within the cowrie python virtual environment:

(cowrie-env) user@sensor:/opt/cowrie$ pip list
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.
Package                       Version
----------------------------- ---------
appdirs                       1.4.4
arrow                         0.17.0
attrs                         21.4.0
Automat                       22.10.0
backports.functools-lru-cache 1.6.6
bcrypt                        3.1.7
certifi                       2021.10.8
cffi                          1.15.1
chardet                       4.0.0
configparser                  4.0.2
constantly                    15.1.0
cryptography                  3.3.2
csirtgsdk                     0.0.0a6
enum34                        1.1.10
hyperlink                     21.0.0
idna                          2.10
incremental                   22.10.0
ipaddress                     1.0.23
packaging                     20.9
pip                           20.3.4
pkg-resources                 0.0.0
prettytable                   1.0.1
pyasn1                        0.5.1
pyasn1-modules                0.3.0
pycparser                     2.21
PyHamcrest                    1.10.1
pyOpenSSL                     21.0.0
pyparsing                     2.4.7
python-dateutil               2.8.2
PyYAML                        3.13
requests                      2.27.1
service-identity              21.1.0
setuptools                    44.1.1
six                           1.16.0
tailer                        0.4.1
tftpy                         0.8.2
Twisted                       20.3.0
typing                        3.10.0.0
urllib3                       1.26.18
wcwidth                       0.2.12
wheel                         0.37.1
zope.interface                5.5.2

Here you can see that Python 2 support was partially, if not fully, dropped from the Automat library: https://github.com/glyph/automat/compare/v20.2.0...v22.10.0#diff-1d8b94589bfcb9d53a8fe73dc3988f9da778895b7bd928eb35d4ed98d927c423L11

I suppose we can attempt to pin the Automat module to 20.2.0 by adding a line here: https://github.com/pwnlandia/mhn/blob/be58cbf8c726c29c4c0f993023688fdbd026ee05/scripts/deploy_cowrie.sh#L38

That may introduce other dependency issues. Since the version of Cowrie that the project deploys is 4 years old, perhaps our time would be better spent getting a more up to date version of Cowrie running.

https://github.com/cowrie/cowrie/releases/tag/v2.1.0