mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 03:28:19 +00:00
Complete breakout of SMB, GSSAPI, and NTLM
- Looser coupling between these analyzers. - New ntlm.log (still pretty early) - Improved string handling for NTLM (convert UTF16 to UTF8) - SMB2 analyzer now supports GSSAPI. - Improved abstraction of DCE_RPC operations (still not finished) - Lots of whitespace cleanup.
This commit is contained in:
Seth Hall
parent
ff3437d157
commit
5b5589e167
22 changed files with 446 additions and 926 deletions
|
|
@ -47,11 +47,10 @@ refine connection SMB_Conn += {
|
|||
request->Assign(5, smb_string2stringval(${val.ntlm_extended_security.native_os}));
|
||||
request->Assign(6, smb_string2stringval(${val.ntlm_extended_security.native_lanman}));
|
||||
|
||||
//request->Assign(12, bytestring_to_val(${val.ntlm_extended_security.security_blob}));
|
||||
request->Assign(13, capabilities);
|
||||
break;
|
||||
|
||||
case 13: // NT LM 0.12 without extended security
|
||||
case 13: // NT LM 0.12 without extended security
|
||||
capabilities = new RecordVal(BifType::Record::SMB1::SessionSetupAndXCapabilities);
|
||||
capabilities->Assign(0, new Val(${val.ntlm_nonextended_security.capabilities.unicode}, TYPE_BOOL));
|
||||
capabilities->Assign(1, new Val(${val.ntlm_nonextended_security.capabilities.large_files}, TYPE_BOOL));
|
||||
|
|
@ -90,24 +89,27 @@ refine connection SMB_Conn += {
|
|||
response->Assign(0, new Val(${val.word_count}, TYPE_COUNT));
|
||||
switch ( ${val.word_count} )
|
||||
{
|
||||
case 3: // pre NT LM 0.12
|
||||
case 3: // pre NT LM 0.12
|
||||
response->Assign(1, new Val(${val.lanman.is_guest}, TYPE_BOOL));
|
||||
response->Assign(2, smb_string2stringval(${val.lanman.native_os}));
|
||||
response->Assign(3, smb_string2stringval(${val.lanman.native_lanman}));
|
||||
response->Assign(4, smb_string2stringval(${val.lanman.primary_domain}));
|
||||
break;
|
||||
case 4: // NT LM 0.12
|
||||
case 4: // NT LM 0.12
|
||||
response->Assign(1, new Val(${val.ntlm.is_guest}, TYPE_BOOL));
|
||||
response->Assign(2, smb_string2stringval(${val.ntlm.native_os}));
|
||||
response->Assign(3, smb_string2stringval(${val.ntlm.native_lanman}));
|
||||
response->Assign(4, smb_string2stringval(${val.ntlm.primary_domain}));
|
||||
//response->Assign(5, bytestring_to_val(${val.ntlm.security_blob}));
|
||||
break;
|
||||
default: // Error!
|
||||
default: // Error!
|
||||
break;
|
||||
}
|
||||
|
||||
BifEvent::generate_smb1_session_setup_andx_response(bro_analyzer(), bro_analyzer()->Conn(), BuildHeaderVal(header), response);
|
||||
BifEvent::generate_smb1_session_setup_andx_response(bro_analyzer(),
|
||||
bro_analyzer()->Conn(),
|
||||
BuildHeaderVal(header),
|
||||
response);
|
||||
}
|
||||
|
||||
return true;
|
||||
|
|
@ -118,17 +120,17 @@ refine connection SMB_Conn += {
|
|||
type SMB1_session_setup_andx_request(header: SMB_Header) = record {
|
||||
word_count : uint8;
|
||||
lanman_or_ntlm : case word_count of {
|
||||
0x0a -> lanman: SMB1_session_setup_andx_request_lanman(header);
|
||||
0x0c -> ntlm_extended_security: SMB1_session_setup_andx_request_ntlm_extended_security(header);
|
||||
0x0d -> ntlm_nonextended_security: SMB1_session_setup_andx_request_ntlm_nonextended_security(header);
|
||||
0x0a -> lanman : SMB1_session_setup_andx_request_lanman(header);
|
||||
0x0c -> ntlm_extended_security : SMB1_session_setup_andx_request_ntlm_extended_security(header);
|
||||
0x0d -> ntlm_nonextended_security : SMB1_session_setup_andx_request_ntlm_nonextended_security(header);
|
||||
};
|
||||
} &let {
|
||||
proc: bool = $context.connection.proc_smb1_session_setup_andx_request(header, this);
|
||||
};
|
||||
|
||||
type SMB1_session_setup_andx_response(header: SMB_Header) = record {
|
||||
word_count : uint8;
|
||||
lanman_or_ntlm : case word_count of {
|
||||
word_count : uint8;
|
||||
lanman_or_ntlm : case word_count of {
|
||||
0x03 -> lanman: SMB1_session_setup_andx_response_lanman(header);
|
||||
0x04 -> ntlm: SMB1_session_setup_andx_response_ntlm(header);
|
||||
default -> error: uint16;
|
||||
|
|
@ -138,25 +140,25 @@ type SMB1_session_setup_andx_response(header: SMB_Header) = record {
|
|||
};
|
||||
|
||||
type SMB1_session_setup_andx_request_lanman(header: SMB_Header) = record {
|
||||
andx : SMB_andx;
|
||||
max_buffer_size : uint16;
|
||||
max_mpx_count : uint16;
|
||||
vc_number : uint16;
|
||||
session_key : uint32;
|
||||
password_length : uint16;
|
||||
reserved : uint32;
|
||||
byte_count : uint16;
|
||||
andx : SMB_andx;
|
||||
max_buffer_size : uint16;
|
||||
max_mpx_count : uint16;
|
||||
vc_number : uint16;
|
||||
session_key : uint32;
|
||||
password_length : uint16;
|
||||
reserved : uint32;
|
||||
byte_count : uint16;
|
||||
account_password : bytestring &length=password_length;
|
||||
# offset + 1 due to word_count in the parent type
|
||||
account_name : SMB_string(header.unicode, offsetof(account_name) + 1);
|
||||
primary_domain : SMB_string(header.unicode, offsetof(primary_domain) + 1);
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
account_name : SMB_string(header.unicode, offsetof(account_name) + 1);
|
||||
primary_domain : SMB_string(header.unicode, offsetof(primary_domain) + 1);
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
};
|
||||
|
||||
type SMB1_session_setup_andx_response_lanman(header: SMB_Header) = record {
|
||||
andx : SMB_andx;
|
||||
action : uint16;
|
||||
andx : SMB_andx;
|
||||
action : uint16;
|
||||
byte_count : uint16;
|
||||
# offset + 1 due to word_count in the parent type
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
|
|
@ -167,63 +169,66 @@ type SMB1_session_setup_andx_response_lanman(header: SMB_Header) = record {
|
|||
};
|
||||
|
||||
type SMB1_session_setup_andx_request_ntlm_capabilities = record {
|
||||
capabilities : uint32;
|
||||
capabilities: uint32;
|
||||
} &let {
|
||||
unicode : bool = ( capabilities & 0x0004 ) > 0;
|
||||
large_files : bool = ( capabilities & 0x0008 ) > 0;
|
||||
nt_smbs : bool = ( capabilities & 0x0010 ) > 0;
|
||||
status32 : bool = ( capabilities & 0x0040 ) > 0;
|
||||
level_2_oplocks : bool = ( capabilities & 0x0080 ) > 0;
|
||||
nt_find : bool = ( capabilities & 0x0200 ) > 0;
|
||||
nt_find : bool = ( capabilities & 0x0200 ) > 0;
|
||||
};
|
||||
|
||||
type SMB1_session_setup_andx_request_ntlm_nonextended_security(header: SMB_Header) = record {
|
||||
andx : SMB_andx;
|
||||
max_buffer_size : uint16;
|
||||
max_mpx_count : uint16;
|
||||
vc_number : uint16;
|
||||
session_key : uint32;
|
||||
andx : SMB_andx;
|
||||
max_buffer_size : uint16;
|
||||
max_mpx_count : uint16;
|
||||
vc_number : uint16;
|
||||
session_key : uint32;
|
||||
case_insensitive_password_length : uint16;
|
||||
case_sensitive_password_length : uint16;
|
||||
reserved : uint32;
|
||||
capabilities : SMB1_session_setup_andx_request_ntlm_capabilities;
|
||||
byte_count : uint16;
|
||||
case_insensitive_password : bytestring &length=case_insensitive_password_length;
|
||||
case_sensitive_password : bytestring &length=case_sensitive_password_length;
|
||||
reserved : uint32;
|
||||
capabilities : SMB1_session_setup_andx_request_ntlm_capabilities;
|
||||
byte_count : uint16;
|
||||
case_insensitive_password : bytestring &length=case_insensitive_password_length;
|
||||
case_sensitive_password : bytestring &length=case_sensitive_password_length;
|
||||
# offset + 1 due to word_count in the parent type
|
||||
account_name : SMB_string(header.unicode, offsetof(account_name) + 1);
|
||||
primary_domain : SMB_string(header.unicode, offsetof(primary_domain) + 1);
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
account_name : SMB_string(header.unicode, offsetof(account_name) + 1);
|
||||
primary_domain : SMB_string(header.unicode, offsetof(primary_domain) + 1);
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
};
|
||||
|
||||
type SMB1_session_setup_andx_request_ntlm_extended_security(header: SMB_Header) = record {
|
||||
andx : SMB_andx;
|
||||
max_buffer_size : uint16;
|
||||
max_mpx_count : uint16;
|
||||
vc_number : uint16;
|
||||
session_key : uint32;
|
||||
security_blob_length : uint16;
|
||||
reserved : uint32;
|
||||
capabilities : SMB1_session_setup_andx_request_ntlm_capabilities;
|
||||
byte_count : uint16;
|
||||
security_blob : SMB_NTLM_SSP(header) &length=security_blob_length;
|
||||
andx : SMB_andx;
|
||||
max_buffer_size : uint16;
|
||||
max_mpx_count : uint16;
|
||||
vc_number : uint16;
|
||||
session_key : uint32;
|
||||
security_blob_length : uint16;
|
||||
reserved : uint32;
|
||||
capabilities : SMB1_session_setup_andx_request_ntlm_capabilities;
|
||||
byte_count : uint16;
|
||||
security_blob : bytestring &length=security_blob_length;
|
||||
# offset + 1 due to word_count in the parent type
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
} &let {
|
||||
pipe_proc : bool = $context.connection.forward_gssapi(security_blob, true);
|
||||
};
|
||||
|
||||
type SMB1_session_setup_andx_response_ntlm(header: SMB_Header) = record {
|
||||
andx : SMB_andx;
|
||||
action : uint16;
|
||||
andx : SMB_andx;
|
||||
action : uint16;
|
||||
security_blob_length : uint16;
|
||||
byte_count : uint16;
|
||||
security_blob : SMB_NTLM_SSP(header) &length=security_blob_length;
|
||||
byte_count : uint16;
|
||||
security_blob : bytestring &length=security_blob_length;
|
||||
# offset + 1 due to word_count in the parent type
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
primary_domain : SMB_string(header.unicode, offsetof(primary_domain) + 1);
|
||||
native_os : SMB_string(header.unicode, offsetof(native_os) + 1);
|
||||
native_lanman : SMB_string(header.unicode, offsetof(native_lanman) + 1);
|
||||
primary_domain : SMB_string(header.unicode, offsetof(primary_domain) + 1);
|
||||
} &let {
|
||||
is_guest: bool = ( action & 0x1 ) > 0;
|
||||
is_guest : bool = ( action & 0x1 ) > 0;
|
||||
gssapi_proc : bool = $context.connection.forward_gssapi(security_blob, false);
|
||||
};
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue