Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

SSH: Misc. updates to the new analyzer.

Browse source
This commit is contained in:
Vlad Grigorescu 2014-09-02 00:15:32 -04:00
parent 0a50688afc
commit 51373b0592
4 changed files with 128 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

101
scripts/base/protocols/ssh/main.bro
View file

@ -1,7 +1,5 @@
##! Implements base functionality for SSH analysis. Generates the ssh.log file.
# Generated by binpac_quickstart
module SSH;
export {
@ -14,20 +12,33 @@ export {
uid: string &log;
## The connection's 4-tuple of endpoint addresses/ports.
id: conn_id &log;
## Auth result
result: string &log &optional;
## Auth method (password, pubkey, etc.)
method: string &log &optional;
## Direction of the connection. If the client was a local host
## logging into an external host, this would be OUTBOUND. INBOUND
## would be set for the opposite situation.
## TODO: handle local-local and remote-remote better.
direction: Direction &log &optional;
## The client's version string
client: string &log &optional;
## The server's version string
server: string &log &optional;
## The server's key fingerprint
host_key: string &log &optional;
## Auth result
result: string &log &optional;
## Auth method (password, pubkey, etc.)
method: string &log &optional;
## This connection has been logged (internal use)
logged: bool &default=F;
};
## If true, we tell the event engine to not look at further data
## packets after the initial SSH handshake. Helps with performance
## (especially with large file transfers) but precludes some
## kinds of analyses.
const skip_processing_after_detection = F &redef;
## Event that can be handled to access the SSH record as it is sent on
## to the loggin framework.
## to the logging framework.
global log_ssh: event(rec: Info);
}
@ -43,6 +54,24 @@ event bro_init() &priority=5
Analyzer::register_for_ports(Analyzer::ANALYZER_SSH, ports);
}
function determine_auth_method(middle_pkt_len: int, first_pkt_len: int): string
{
# This is still being tested.
# Based on "Analysis for Identifying User Authentication Methods on SSH Connections"
# by Satoh, Nakamura, Ikenaga.
if ( middle_pkt_len == 96 )
return "password";
if ( middle_pkt_len == 16 )
return "gssapi";
if ( ( middle_pkt_len == 32 ) && ( first_pkt_len == 0 || first_pkt_len == 48 ) )
return "challenge-response";
if ( middle_pkt_len < 256 )
return fmt("unknown (mid=%d, first=%d)", middle_pkt_len, first_pkt_len);
if ( first_pkt_len == 16 )
return "host-based";
return fmt("pubkey (~%d bits)", (first_pkt_len - 16)*8);
}
event ssh_server_version(c: connection, version: string)
{
@ -70,46 +99,74 @@ event ssh_client_version(c: connection, version: string)
c$ssh$client = version;
}
function determine_auth_method(middle_pkt_len: int, first_pkt_len: int): string
{
if ( middle_pkt_len == 96 )
return "password";
if ( ( middle_pkt_len == 32 ) && ( first_pkt_len == 0 || first_pkt_len == 48 ) )
return "challenge-response";
if ( ( first_pkt_len >= 112 ) && ( first_pkt_len <= 432 ) )
return "pubkey";
if ( first_pkt_len == 16 )
return "host-based";
return fmt("unknown (mid=%d, first=%d)", middle_pkt_len, first_pkt_len);
}
event ssh_auth_successful(c: connection, middle_pkt_len: int, first_pkt_len: int)
{
print "ssh_auth_successful";
if ( !c?$ssh || ( c$ssh?$result && c$ssh$result == "success" ) )
return;
c$ssh$result = "success";
c$ssh$method = determine_auth_method(middle_pkt_len, first_pkt_len);
}
event ssh_auth_successful(c: connection, middle_pkt_len: int, first_pkt_len: int) &priority=-5
{
c$ssh$logged = T;
Log::write(SSH::LOG, c$ssh);
}
event ssh_auth_failed(c: connection, middle_pkt_len: int, first_pkt_len: int)
{
print "ssh_auth_failed";
if ( !c?$ssh || ( c$ssh?$result && c$ssh$result == "success" ) )
return;
c$ssh$result = "failure";
c$ssh$method = determine_auth_method(middle_pkt_len, first_pkt_len);
}
event ssh_auth_failed(c: connection, middle_pkt_len: int, first_pkt_len: int) &priority=-5
{
c$ssh$logged = T;
Log::write(SSH::LOG, c$ssh);
}
event connection_closed(c: connection)
event connection_state_remove(c: connection)
{
if ( c?$ssh && !c$ssh?$result )
{
c$ssh$result = "unknown";
Log::write(SSH::LOG, c$ssh);
}
}
event ssh_server_capabilities(c: connection, kex_algorithms: string, server_host_key_algorithms: string, encryption_algorithms_client_to_server: string, encryption_algorithms_server_to_client: string, mac_algorithms_client_to_server: string, mac_algorithms_server_to_client: string, compression_algorithms_client_to_server: string, compression_algorithms_server_to_client: string, languages_client_to_server: string, languages_server_to_client: string)
{
# print "kex_algorithms", kex_algorithms;
# print "";
# print "server_host_key_algorithms", server_host_key_algorithms;
# print "";
# print "encryption_algorithms_client_to_server", encryption_algorithms_client_to_server;
# print "";
# print "encryption_algorithms_server_to_client", encryption_algorithms_server_to_client;
# print "";
# print "mac_algorithms_client_to_server", mac_algorithms_client_to_server;
# print "";
# print "mac_algorithms_server_to_client", mac_algorithms_server_to_client;
# print "";
# print "compression_algorithms_client_to_server", compression_algorithms_client_to_server;
# print "";
# print "compression_algorithms_server_to_client", compression_algorithms_server_to_client;
# print "";
# print "languages_client_to_server", languages_client_to_server;
# print "";
# print "languages_server_to_client", languages_server_to_client;
# print "";
}
event connection_state_remove(c: connection) &priority=-5
{
if ( c?$ssh && !c$ssh$logged )
Log::write(SSH::LOG, c$ssh);
}
event ssh_server_host_key(c: connection, key: string)
{
if ( !c?$ssh )

17
src/analyzer/protocol/ssh/SSH.cc
View file

@ -91,12 +91,12 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
relative_len = len - initial_client_packet_size;
else
relative_len = len - initial_server_packet_size;
if ( num_encrypted_packets_seen >= 4 )
if ( num_encrypted_packets_seen >= 6 )
{
int auth_result = AuthResult(relative_len, orig);
if ( auth_result > 0 )
{
num_encrypted_packets_seen = 1;
if ( auth_result == 1 )
BifEvent::generate_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(),
packet_n_1_size, packet_n_2_size);
@ -105,25 +105,32 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
packet_n_1_size, packet_n_2_size);
}
}
if ( num_encrypted_packets_seen >= 2 )
if ( ( num_encrypted_packets_seen >= 2 ) &&
( orig != packet_n_1_is_orig ) )
{
packet_n_2_is_orig = packet_n_1_is_orig;
packet_n_2_size = packet_n_1_size;
}
if ( orig == packet_n_1_is_orig )
packet_n_1_size += len;
else
{
packet_n_1_is_orig = orig;
packet_n_1_size = relative_len;
num_encrypted_packets_seen++;
}
}
int SSH_Analyzer::AuthResult(int len, bool orig)
{
if ( !orig && packet_n_1_is_orig && !packet_n_2_is_orig )
{
printf("Auth result = %d\n", len);
if ( len == -16 )
return 1;
else if ( len >= 16 &&
len <= 32 )
else if ( len >= 16 && len <= 32 )
return 2;
return 0;
}

4
src/analyzer/protocol/ssh/ssh-analyzer.pac
View file

@ -60,10 +60,6 @@ refine typeattr SSH_DH_GEX_REPLY += &let {
proc: bool = $context.flow.proc_ssh_server_host_key(k_s.val);
};
refine typeattr SSH_DH_GEX_GROUP += &let {
proc: bool = $context.flow.proc_ssh_server_host_key(p.val);
};
refine typeattr SSH_Message += &let {
proc_newkeys: bool = $context.flow.proc_newkeys() &if(msg_type == SSH_MSG_NEWKEYS);
};