{"action":"closed","issue":{"url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/245","repository_url":"https://api.github.com/repos/micheloosterhof/cowrie","labels_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/245/labels{/name}","comments_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/245/comments","events_url":"https://api.github.com/repos/micheloosterhof/cowrie/issues/245/events","html_url":"https://github.com/micheloosterhof/cowrie/issues/245","id":174962589,"number":245,"title":"Error after trying to cat into file","user":{"login":"sandysandipanc","id":21956116,"avatar_url":"https://avatars.githubusercontent.com/u/21956116?v=3","gravatar_id":"","url":"https://api.github.com/users/sandysandipanc","html_url":"https://github.com/sandysandipanc","followers_url":"https://api.github.com/users/sandysandipanc/followers","following_url":"https://api.github.com/users/sandysandipanc/following{/other_user}","gists_url":"https://api.github.com/users/sandysandipanc/gists{/gist_id}","starred_url":"https://api.github.com/users/sandysandipanc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sandysandipanc/subscriptions","organizations_url":"https://api.github.com/users/sandysandipanc/orgs","repos_url":"https://api.github.com/users/sandysandipanc/repos","events_url":"https://api.github.com/users/sandysandipanc/events{/privacy}","received_events_url":"https://api.github.com/users/sandysandipanc/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/micheloosterhof/cowrie/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-04T18:27:03Z","updated_at":"2016-09-05T18:00:35Z","closed_at":"2016-09-05T18:00:35Z","body":"Displaying the following error after attacker tried to cat a file. \r\n\r\n\r\n\r\n2016-09-04 22:16:48+0530 [SSHService ssh-connection on HoneyPotTransport,40,115.226.229.20] got channel session request\r\n2016-09-04 22:16:48+0530 [SSHChannel session (1) on SSHService ssh-connection on HoneyPotTransport,40,115.226.229.20] channel open\r\n2016-09-04 22:16:48+0530 [SSHChannel session (1) on SSHService ssh-connection on HoneyPotTransport,40,115.226.229.20] executing command \"cat >/tmp/.xs/daemon.armv4l.mod\"\r\n2016-09-04 22:16:48+0530 [SSHChannel session (1) on SSHService ssh-connection on HoneyPotTransport,40,115.226.229.20] Opening TTY Log: log/tty/20160904-221648-31b2ddac-1e.log\r\n2016-09-04 22:16:48+0530 [SSHChannel session (1) on SSHService ssh-connection on HoneyPotTransport,40,115.226.229.20] CMD: cat >/tmp/.xs/daemon.armv4l.mod\r\n2016-09-04 22:16:48+0530 [SSHChannel session (1) on SSHService ssh-connection on HoneyPotTransport,40,115.226.229.20] Command found: cat  > /tmp/.xs/daemon.armv4l.mod\r\n2016-09-04 22:16:48+0530 [SSHChannel session (1) on SSHService ssh-connection on HoneyPotTransport,40,115.226.229.20] Unhandled Error\r\n\tTraceback (most recent call last):\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/python/log.py\", line 84, in callWithContext\r\n\t    return context.call({ILogContext: newCtx}, func, *args, **kw)\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/python/context.py\", line 118, in callWithContext\r\n\t    return self.currentContext().callWithContext(ctx, func, *args, **kw)\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/python/context.py\", line 81, in callWithContext\r\n\t    return func(*args,**kw)\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/conch/ssh/channel.py\", line 143, in requestReceived\r\n\t    return f(data)\r\n\t--- <exception caught here> ---\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/conch/ssh/session.py\", line 70, in request_exec\r\n\t    self.session.execCommand(pp, f)\r\n\t  File \"/home/cowrie/cowrie/ssh/session.py\", line 143, in execCommand\r\n\t    self.protocol.makeConnection(processprotocol)\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/internet/protocol.py\", line 494, in makeConnection\r\n\t    self.connectionMade()\r\n\t  File \"/home/cowrie/cowrie/insults/insults.py\", line 68, in connectionMade\r\n\t    insults.ServerProtocol.connectionMade(self)\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/conch/insults/insults.py\", line 427, in connectionMade\r\n\t    self.terminalProtocol.makeConnection(self)\r\n\t  File \"/usr/lib/python2.7/dist-packages/twisted/conch/insults/insults.py\", line 59, in makeConnection\r\n\t    self.connectionMade()\r\n\t  File \"/home/cowrie/cowrie/core/protocol.py\", line 215, in connectionMade\r\n\t    self.cmdstack[0].lineReceived(self.execcmd)\r\n\t  File \"/home/cowrie/cowrie/core/honeypot.py\", line 213, in lineReceived\r\n\t    self.runCommand()\r\n\t  File \"/home/cowrie/cowrie/core/honeypot.py\", line 320, in runCommand\r\n\t    self.protocol.call_command(pp, cmdclass, *cmd_array[0]['rargs'])\r\n\t  File \"/home/cowrie/cowrie/core/protocol.py\", line 181, in call_command\r\n\t    obj = cmd(self, *args)\r\n\t  File \"/home/cowrie/cowrie/core/honeypot.py\", line 49, in __init__\r\n\t    with open(self.safeoutfile, 'a'):\r\n\texceptions.IOError: [Errno 13] Permission denied: 'dl/20160904-221648-31b2ddac-1-redir__tmp__xs_daemon_armv4l_mod'\r\n"}}
{"actor":{"display_login":"micheloosterhof"}}