Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

smb2: Raise smb2_file_delete for CREATE with FILE_DELETE_ON_CLOSE

Browse source 
When a CREATE request contains the FILE_DELETE_ON_CLOSE option and
the subsequent CREATE response indicates success, we now raise the
smb2_file_delete event to log a delete action in smb_files.log and
also give users a way to handle this scenario.

The provided pcap was generated locally by recording a smbtorture run
of the smb2.delete-on-close-perms test case.

Placed the create_options into the CmdInfo record for potential
exposure in smb_cmd.log (wasn't sure how that would look so left it
for the future).

Fixes #2276.
This commit is contained in:
Arne Welzel 2022-07-15 15:13:40 +02:00
parent 1d2c12e980
commit 3dae8ab086
5 changed files with 70 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/protocols/smb/smb2-main.zeek
View file

@ -5,6 +5,10 @@ module SMB2;
redef record SMB::CmdInfo += {
## Dialects offered by the client.
smb2_offered_dialects: index_vec &optional;
## Keep the create_options in the command for
## referencing later.
smb2_create_options: count &default=0;
};
event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
@ -127,6 +131,7 @@ event smb2_create_request(c: connection, hdr: SMB2::Header, request: SMB2::Creat
request$filename = "<share_root>";
c$smb_state$current_file$name = request$filename;
c$smb_state$current_cmd$smb2_create_options = request$create_options;
switch ( c$smb_state$current_tree$share_type )
{
@ -164,6 +169,11 @@ event smb2_create_response(c: connection, hdr: SMB2::Header, response: SMB2::Cre
c$smb_state$fid_map[response$file_id$persistent+response$file_id$volatile] = c$smb_state$current_file;
c$smb_state$current_file = c$smb_state$fid_map[response$file_id$persistent+response$file_id$volatile];
# If the create request for this file had FILE_DELETE_ON_CLOSE set and
# the response status was success, raise a smb2_file_delete event.
if ( hdr$status == 0 && (c$smb_state$current_cmd$smb2_create_options & 0x00001000) != 0 )
event smb2_file_delete(c, hdr, response$file_id, T);
}
event smb2_create_response(c: connection, hdr: SMB2::Header, response: SMB2::CreateResponse) &priority=-5

34
testing/btest/Baseline/scripts.base.protocols.smb.smb2-create-delete-on-close/smb_cmd.log Normal file
View file

@ -0,0 +1,34 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path smb_cmd
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p command sub_command argument status rtt version username tree tree_service referenced_file.ts referenced_file.uid referenced_file.id.orig_h referenced_file.id.orig_p referenced_file.id.resp_h referenced_file.id.resp_p referenced_file.fuid referenced_file.action referenced_file.path referenced_file.name referenced_file.size referenced_file.prev_name referenced_file.times.modified referenced_file.times.accessed referenced_file.times.created referenced_file.times.changed
#types time string addr port addr port string string string string interval string string string string time string addr port addr port string enum string string count string time time time time
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 NEGOTIATE_PROTOCOL - - SUCCESS 0.002119 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 SESSION_SETUP - - SUCCESS 0.001559 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 TREE_CONNECT - - SUCCESS 0.005032 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000430 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_INFO - - SUCCESS 0.000131 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 SET_INFO - - SUCCESS 0.000298 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000112 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - FILE_IS_A_DIRECTORY 0.000163 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000159 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_DIRECTORY - - SUCCESS 0.000135 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000227 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000174 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_DIRECTORY - - NO_MORE_FILES 0.000038 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - OBJECT_NAME_NOT_FOUND 0.000158 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000053 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000246 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000220 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000748 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_INFO - - SUCCESS 0.000151 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 SET_INFO - - SUCCESS 0.000333 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000112 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000622 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000141 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - OBJECT_NAME_NOT_FOUND 0.000181 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
#close XXXX-XX-XX-XX-XX-XX

18
testing/btest/Baseline/scripts.base.protocols.smb.smb2-create-delete-on-close/smb_files.log Normal file
View file

@ -0,0 +1,18 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path smb_files
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid action path name size prev_name times.modified times.accessed times.created times.changed
#types time string addr port addr port string enum string string count string time time time time
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_DELETE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_DELETE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_DELETE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/smb/smb2.delete-on-close-perms-delete-existing.pcap Normal file
View file

Binary file not shown.

8
testing/btest/scripts/base/protocols/smb/smb2-create-delete-on-close.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: zeek -C -r $TRACES/smb/smb2.delete-on-close-perms-delete-existing.pcap policy/protocols/smb/log-cmds
# @TEST-EXEC: btest-diff smb_files.log
# @TEST-EXEC: btest-diff smb_cmd.log
@load base/protocols/smb
redef SMB::logged_file_actions += { SMB::FILE_READ, SMB::FILE_WRITE };