Can not upload file (permission denied) when run Cowrie as a docker

[true-zk]

Can not upload file (permission denied) when run Cowrie as a docker

[micheloosterhof]

hi! check the container logs. user docker log .... to see.
Also, please copy and paste text rather than pasting images.

[true-zk]

oh. ok, I try to put a file again, and copy the docker logs here. But I can not find abnormal things. it logs "SFTP openFile: b'/root/mirai.bot'", and seems nothing wrong.

2024-02-07T02:05:14+0000 [cowrie.ssh.factory.CowrieSSHFactory] No moduli, no diffie-hellman-group-exchange-sha1
2024-02-07T02:05:14+0000 [cowrie.ssh.factory.CowrieSSHFactory] No moduli, no diffie-hellman-group-exchange-sha256
2024-02-07T02:05:14+0000 [cowrie.ssh.factory.CowrieSSHFactory] New connection: 192.168.1.5:57540 (172.17.0.2:2222) [session: ea272156b0de]
2024-02-07T02:05:15+0000 [HoneyPotSSHTransport,15,192.168.1.5] Remote SSH version: SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u1
2024-02-07T02:05:15+0000 [HoneyPotSSHTransport,15,192.168.1.5] SSH client hassh fingerprint: 78c05d999799066a2b4554ce7b1585a6
2024-02-07T02:05:15+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] kex alg=b'curve25519-sha256' key alg=b'ssh-ed25519'
2024-02-07T02:05:15+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] outgoing: b'aes128-ctr' b'hmac-sha2-256' b'none'
2024-02-07T02:05:15+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] incoming: b'aes128-ctr' b'hmac-sha2-256' b'none'
2024-02-07T02:05:15+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] NEW KEYS
2024-02-07T02:05:15+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] starting service b'ssh-userauth'
2024-02-07T02:05:15+0000 [cowrie.ssh.userauth.HoneyPotSSHUserAuthServer#debug] b'root' trying auth b'none'
2024-02-07T02:05:18+0000 [cowrie.ssh.userauth.HoneyPotSSHUserAuthServer#debug] b'root' trying auth b'password'
2024-02-07T02:05:18+0000 [HoneyPotSSHTransport,15,192.168.1.5] Could not read etc/userdb.txt, default database activated
2024-02-07T02:05:18+0000 [HoneyPotSSHTransport,15,192.168.1.5] login attempt [b'root'/b'123'] succeeded
2024-02-07T02:05:18+0000 [HoneyPotSSHTransport,15,192.168.1.5] Initialized emulated server as architecture: linux-x64-lsb
2024-02-07T02:05:18+0000 [cowrie.ssh.userauth.HoneyPotSSHUserAuthServer#debug] b'root' authenticated with b'password'
2024-02-07T02:05:18+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#debug] starting service b'ssh-connection'
2024-02-07T02:05:18+0000 [cowrie.ssh.connection.CowrieSSHConnection#debug] got channel b'session' request
2024-02-07T02:05:18+0000 [cowrie.ssh.session.HoneyPotSSHSession#info] channel open
2024-02-07T02:05:18+0000 [cowrie.ssh.connection.CowrieSSHConnection#debug] got global b'[email protected]' request
2024-02-07T02:05:18+0000 [SSHChannel session (0) on SSHService b'ssh-connection' on HoneyPotSSHTransport,15,192.168.1.5] request_env: LANG=en_GB.UTF-8
2024-02-07T02:05:18+0000 [twisted.conch.ssh.session#info] Asking for subsystem "b'sftp'"
2024-02-07T02:05:18+0000 [cowrie.shell.avatar.CowrieUser#debug] Subsystem lookup: {b'sftp': <class 'twisted.conch.ssh.filetransfer.FileTransferServer'>}
2024-02-07T02:05:19+0000 [twisted.conch.ssh.filetransfer.FileTransferServer#info] dispatching: INIT requestId=3
2024-02-07T02:05:19+0000 [twisted.conch.ssh.filetransfer.FileTransferServer#info] dispatching: REALPATH requestId=1
2024-02-07T02:05:27+0000 [twisted.conch.ssh.filetransfer.FileTransferServer#info] dispatching: OPEN requestId=2
2024-02-07T02:05:27+0000 [HoneyPotSSHTransport,15,192.168.1.5] **SFTP openFile: b'/root/mirai.bot'**
2024-02-07T02:06:09+0000 [twisted.conch.ssh.filetransfer.FileTransferServer#info] dispatching: OPEN requestId=3
2024-02-07T02:06:09+0000 [HoneyPotSSHTransport,15,192.168.1.5] SFTP openFile: b'/root/mirai.bot'
2024-02-07T02:06:13+0000 [cowrie.ssh.connection.CowrieSSHConnection#info] sending close 0
2024-02-07T02:06:13+0000 [cowrie.ssh.session.HoneyPotSSHSession#info] remote close
2024-02-07T02:06:13+0000 [HoneyPotSSHTransport,15,192.168.1.5] Got remote error, code 11 reason: b'disconnected by user'
2024-02-07T02:06:13+0000 [HoneyPotSSHTransport,15,192.168.1.5] avatar root logging out
2024-02-07T02:06:13+0000 [cowrie.ssh.transport.HoneyPotSSHTransport#info] connection lost
2024-02-07T02:06:13+0000 [HoneyPotSSHTransport,15,192.168.1.5] Connection lost after 58 seconds

[micheloosterhof]

somethign is wrong. I would expect

2024-02-07T14:08:19.795997Z [twisted.conch.ssh.filetransfer.FileTransferServer#info] dispatching: WRITE requestId=4
2024-02-07T14:08:19.797623Z [twisted.conch.ssh.filetransfer.FileTransferServer#info] dispatching: CLOSE requestId=3

after the OpenFile

[true-zk]

hi, it is the Spring Festival recently. So I did not reply in time.
I setup Cowrie without docker, and it works. I mean I can upload files now.

So I guess the docker edition of Cowrie has some problems.
Anyway, my Cowrie works now. And, thanks! :p