You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm seeing a lot of attack scripts disconnecting from the system after executing: which ls followed by ls -lh $(which ls)
In the Cowrie shell, the output of which ls is: /bin/ls
and the output of ls -lh $(which ls) is: -rwxr-xr-x 1 root root 112700 2013-04-05 11:52 ls
In a real bash shell, the output of ls -lh $(which ls) is: -rwxr-xr-x 1 root root 144K Sep 24 2020 /usr/bin/ls
Is Cowrie not handling ls -lh $(which ls) correctly?
It would seem that the attacking script is comparing the output of the two commands, realising it's in a honeypot and aborting.
How do I get Cowrie to output -rwxr-xr-x 1 root root 144K Sep 24 2020 /usr/bin/ls when running ls -lh $(which ls)?
The text was updated successfully, but these errors were encountered:
I'm seeing a lot of attack scripts disconnecting from the system after executing:
which ls
followed byls -lh $(which ls)
In the Cowrie shell, the output of
which ls
is:/bin/ls
and the output of
ls -lh $(which ls)
is:-rwxr-xr-x 1 root root 112700 2013-04-05 11:52 ls
In a real bash shell, the output of
ls -lh $(which ls)
is:-rwxr-xr-x 1 root root 144K Sep 24 2020 /usr/bin/ls
Is Cowrie not handling
ls -lh $(which ls)
correctly?It would seem that the attacking script is comparing the output of the two commands, realising it's in a honeypot and aborting.
How do I get Cowrie to output
-rwxr-xr-x 1 root root 144K Sep 24 2020 /usr/bin/ls
when runningls -lh $(which ls)
?The text was updated successfully, but these errors were encountered: