mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 20:18:20 +00:00
SMB & NTLM analyzers.
This commit is contained in:
Vlad Grigorescu
parent
3cea6ab1eb
commit
6a34de5dd8
84 changed files with 8133 additions and 1428 deletions
8
scripts/base/protocols/smb/__load__.bro
Normal file
8
scripts/base/protocols/smb/__load__.bro
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
@load ./consts
|
||||
@load ./const-dos-error
|
||||
@load ./const-nt-status
|
||||
@load ./main
|
||||
@load ./pipe
|
||||
@load ./smb1-main
|
||||
@load ./smb2-main
|
||||
@load ./files
|
||||
131
scripts/base/protocols/smb/const-dos-error.bro
Normal file
131
scripts/base/protocols/smb/const-dos-error.bro
Normal file
|
|
@ -0,0 +1,131 @@
|
|||
# DOS error codes.
|
||||
|
||||
module SMB;
|
||||
|
||||
redef SMB::statuses += {
|
||||
[0x00010001] = [$id="badfunc", $desc="Incorrect function."],
|
||||
[0x00010002] = [$id="error", $desc="Incorrect function."],
|
||||
[0x00020001] = [$id="badfile", $desc="The system cannot find the file specified."],
|
||||
[0x00020002] = [$id="badpw", $desc="Bad password."],
|
||||
[0x00030001] = [$id="badpath", $desc="The system cannot find the path specified."],
|
||||
[0x00030002] = [$id="badtype", $desc="reserved"],
|
||||
[0x00040001] = [$id="nofids", $desc="The system cannot open the file."],
|
||||
[0x00040002] = [$id="access", $desc="The client does not have the necessary access rights to perform the requested function."],
|
||||
[0x00050001] = [$id="noaccess", $desc="Access is denied."],
|
||||
[0x00050002] = [$id="invnid", $desc="The TID specified was invalid."],
|
||||
[0x00060001] = [$id="badfid", $desc="The handle is invalid."],
|
||||
[0x00060002] = [$id="invnetname", $desc="The network name cannot be found."],
|
||||
[0x00070001] = [$id="badmcb", $desc="The storage control blocks were destroyed."],
|
||||
[0x00070002] = [$id="invdevice", $desc="The device specified is invalid."],
|
||||
[0x00080001] = [$id="nomem", $desc="Not enough storage is available to process this command."],
|
||||
[0x00090001] = [$id="badmem", $desc="The storage control block address is invalid."],
|
||||
[0x000a0001] = [$id="badenv", $desc="The environment is incorrect."],
|
||||
[0x000c0001] = [$id="badaccess", $desc="The access code is invalid."],
|
||||
[0x000d0001] = [$id="baddata", $desc="The data is invalid."],
|
||||
[0x000e0001] = [$id="res", $desc="reserved"],
|
||||
[0x000f0001] = [$id="baddrive", $desc="The system cannot find the drive specified."],
|
||||
[0x00100001] = [$id="remcd", $desc="The directory cannot be removed."],
|
||||
[0x00110001] = [$id="diffdevice", $desc="The system cannot move the file to a different disk drive."],
|
||||
[0x00120001] = [$id="nofiles", $desc="There are no more files."],
|
||||
[0x00130003] = [$id="nowrite", $desc="The media is write protected."],
|
||||
[0x00140003] = [$id="badunit", $desc="The system cannot find the device specified."],
|
||||
[0x00150003] = [$id="notready", $desc="The device is not ready."],
|
||||
[0x00160002] = [$id="unknownsmb", $desc="The device does not recognize the command."],
|
||||
[0x00160003] = [$id="badcmd", $desc="The device does not recognize the command."],
|
||||
[0x00170003] = [$id="data", $desc="Data error (cyclic redundancy check)."],
|
||||
[0x00180003] = [$id="badreq", $desc="The program issued a command but the command length is incorrect."],
|
||||
[0x00190003] = [$id="seek", $desc="The drive cannot locate a specific area or track on the disk."],
|
||||
[0x001a0003] = [$id="badmedia", $desc="The specified disk or diskette cannot be accessed."],
|
||||
[0x001b0003] = [$id="badsector", $desc="The drive cannot find the sector requested."],
|
||||
[0x001c0003] = [$id="nopaper", $desc="The printer is out of paper."],
|
||||
[0x001d0003] = [$id="write", $desc="The system cannot write to the specified device."],
|
||||
[0x001e0003] = [$id="read", $desc="The system cannot read from the specified device."],
|
||||
[0x001f0001] = [$id="general", $desc="A device attached to the system is not functioning."],
|
||||
[0x001f0003] = [$id="general", $desc="A device attached to the system is not functioning."],
|
||||
[0x00200001] = [$id="badshare", $desc="The process cannot access the file because it is being used by another process."],
|
||||
[0x00200003] = [$id="badshare", $desc="The process cannot access the file because it is being used by another process."],
|
||||
[0x00210001] = [$id="lock", $desc="The process cannot access the file because another process has locked a portion of the file."],
|
||||
[0x00210003] = [$id="lock", $desc="The process cannot access the file because another process has locked a portion of the file."],
|
||||
[0x00220003] = [$id="wrongdisk", $desc="The wrong diskette is in the drive."],
|
||||
[0x00230003] = [$id="FCBunavail", $desc="No FCBs are available to process the request."],
|
||||
[0x00240003] = [$id="sharebufexc", $desc="A sharing buffer has been exceeded."],
|
||||
[0x00270003] = [$id="diskfull", $desc="The disk is full."],
|
||||
[0x00310002] = [$id="qfull", $desc="The print queue is full."],
|
||||
[0x00320001] = [$id="unsup", $desc="The network request is not supported."],
|
||||
[0x00320002] = [$id="qtoobig", $desc="The queued item too big."],
|
||||
[0x00340002] = [$id="invpfid", $desc="The print file FID is invalid."],
|
||||
[0x00340001] = [$id="dupname", $desc="A duplicate name exists on the network."],
|
||||
[0x00400001] = [$id="netnamedel", $desc="The specified network name is no longer available."],
|
||||
[0x00400002] = [$id="smbcmd", $desc="The server did not recognize the command received."],
|
||||
[0x00410002] = [$id="srverror", $desc="The server encountered an internal error."],
|
||||
[0x00420001] = [$id="noipc", $desc="The network resource type is not correct."],
|
||||
[0x00430001] = [$id="nosuchshare", $desc="The network name cannot be found."],
|
||||
[0x00430002] = [$id="filespecs", $desc="The specified FID and pathname combination is invalid."],
|
||||
[0x00440002] = [$id="badlink", $desc="reserved"],
|
||||
[0x00450002] = [$id="badpermits", $desc="The access permissions specified for a file or directory are not a valid combination."],
|
||||
[0x00460002] = [$id="badpid", $desc="reserved"],
|
||||
[0x00470001] = [$id="nomoreconn", $desc="nomoreconn."],
|
||||
[0x00470002] = [$id="setattrmode", $desc="The attribute mode specified is invalid."],
|
||||
[0x00500001] = [$id="filexists", $desc="The file exists."],
|
||||
[0x00510002] = [$id="paused", $desc="The message server is paused."],
|
||||
[0x00520002] = [$id="msgoff", $desc="Not receiving messages."],
|
||||
[0x00530002] = [$id="noroom", $desc="No room to buffer message."],
|
||||
[0x00570001] = [$id="invalidparam", $desc="The parameter is incorrect."],
|
||||
[0x00570002] = [$id="rmuns", $desc="Too many remote usernames."],
|
||||
[0x00580002] = [$id="timeout", $desc="Operation timed out."],
|
||||
[0x00590002] = [$id="noresource", $desc="No resources currently available for request."],
|
||||
[0x005a0002] = [$id="toomanyuids", $desc="Too many Uids active on this session."],
|
||||
[0x005b0002] = [$id="baduid", $desc="The Uid is not known as a valid user identifier on this session."],
|
||||
[0x006d0001] = [$id="brokenpipe", $desc="The pipe has been ended."],
|
||||
[0x006e0001] = [$id="cannotopen", $desc="The system cannot open the device or file specified."],
|
||||
[0x007a0001] = [$id="insufficientbuffer", $desc="The data area passed to a system call is too small."],
|
||||
[0x007b0001] = [$id="invalidname", $desc="The filename, directory name, or volume label syntax is incorrect."],
|
||||
[0x007c0001] = [$id="unknownlevel", $desc="The system call level is not correct."],
|
||||
[0x00910001] = [$id="notempty", $desc="The directory is not empty."],
|
||||
[0x009e0001] = [$id="notlocked", $desc="The segment is already unlocked."],
|
||||
[0x00b70001] = [$id="rename", $desc="Cannot create a file when that file already exists."],
|
||||
[0x00e60001] = [$id="badpipe", $desc="The pipe state is invalid."],
|
||||
[0x00e70001] = [$id="pipebusy", $desc="All pipe instances are busy."],
|
||||
[0x00e80001] = [$id="pipeclosing", $desc="The pipe is being closed."],
|
||||
[0x00e90001] = [$id="notconnected", $desc="No process is on the other end of the pipe."],
|
||||
[0x00ea0001] = [$id="moredata", $desc="More data is available."],
|
||||
[0x00fa0002] = [$id="usempx", $desc="Temporarily unable to support Raw, use Mpx mode."],
|
||||
[0x00fb0002] = [$id="usestd", $desc="Temporarily unable to support Raw, use standard read/write."],
|
||||
[0x00fc0002] = [$id="contmpx", $desc="Continue in MPX mode."],
|
||||
[0x00fe0002] = [$id="badPassword", $desc="reserved"],
|
||||
[0x01030001] = [$id="nomoreitems", $desc="No more data is available."],
|
||||
[0x010b0001] = [$id="baddirectory", $desc="The directory name is invalid."],
|
||||
[0x011a0001] = [$id="easnotsupported", $desc="The mounted file system does not support extended attributes."],
|
||||
[0x04000002] = [$id="_NOTIFY_ENUM_DIR", $desc="Too many files have changed since the last time an NT_TRANSACT_NOTIFY_CHANGE was issued."],
|
||||
[0x052e0001] = [$id="logonfailure", $desc="Logon failure: unknown user name or bad password."],
|
||||
[0x07030001] = [$id="driveralreadyinstalled", $desc="The specified printer driver is already installed."],
|
||||
[0x07040001] = [$id="unknownprinterport", $desc="The specified port is unknown."],
|
||||
[0x07050001] = [$id="unknownprinterdriver", $desc="The printer driver is unknown."],
|
||||
[0x07060001] = [$id="unknownprintprocessor", $desc="The print processor is unknown."],
|
||||
[0x07070001] = [$id="invalidseparatorfile", $desc="The specified separator file is invalid."],
|
||||
[0x07080001] = [$id="invalidjobpriority", $desc="The specified priority is invalid."],
|
||||
[0x07090001] = [$id="invalidprintername", $desc="The printer name is invalid."],
|
||||
[0x070a0001] = [$id="printeralreadyexists", $desc="The printer already exists."],
|
||||
[0x070b0001] = [$id="invalidprintercommand", $desc="The printer command is invalid."],
|
||||
[0x070c0001] = [$id="invaliddatatype", $desc="The specified datatype is invalid."],
|
||||
[0x070d0001] = [$id="invalidenvironment", $desc="The Environment specified is invalid."],
|
||||
[0x084b0001] = [$id="buftoosmall", $desc="The API return buffer is too small."],
|
||||
[0x085e0001] = [$id="unknownipc", $desc="The requested API is not supported on the remote server."],
|
||||
[0x08670001] = [$id="nosuchprintjob", $desc="The print job does not exist."],
|
||||
[0x08bf0002] = [$id="accountExpired", $desc="This user account has expired."],
|
||||
[0x08c00002] = [$id="badClient", $desc="The user is not allowed to log on from this workstation."],
|
||||
[0x08c10002] = [$id="badLogonTime", $desc="The user is not allowed to log on at this time."],
|
||||
[0x08c20002] = [$id="passwordExpired", $desc="The password of this user has expired."],
|
||||
[0x09970001] = [$id="invgroup", $desc="invgroup"],
|
||||
[0x0bb80001] = [$id="unknownprintmonitor", $desc="The specified print monitor is unknown."],
|
||||
[0x0bb90001] = [$id="printerdriverinuse", $desc="The specified printer driver is currently in use."],
|
||||
[0x0bba0001] = [$id="spoolfilenotfound", $desc="The spool file was not found."],
|
||||
[0x0bbb0001] = [$id="nostartdoc", $desc="A StartDocPrinter call was not issued."],
|
||||
[0x0bbc0001] = [$id="noaddjob", $desc="An AddJob call was not issued."],
|
||||
[0x0bbd0001] = [$id="printprocessoralreadyinstalled", $desc="The specified print processor has already been installed."],
|
||||
[0x0bbe0001] = [$id="printmonitoralreadyinstalled", $desc="The specified print monitor has already been installed."],
|
||||
[0x0bbf0001] = [$id="invalidprintmonitor", $desc="The specified print monitor does not have the required functions."],
|
||||
[0x0bc00001] = [$id="printmonitorinuse", $desc="The specified print monitor is currently in use."],
|
||||
[0x0bc10001] = [$id="printerhasjobsqueued", $desc="The requested operation is not allowed when there are jobs queued to the printer."],
|
||||
[0xffff0002] = [$id="nosupport", $desc="Function not supported."],
|
||||
};
|
||||
1792
scripts/base/protocols/smb/const-nt-status.bro
Normal file
1792
scripts/base/protocols/smb/const-nt-status.bro
Normal file
File diff suppressed because it is too large
Load diff
130
scripts/base/protocols/smb/consts.bro
Normal file
130
scripts/base/protocols/smb/consts.bro
Normal file
|
|
@ -0,0 +1,130 @@
|
|||
module SMB;
|
||||
|
||||
export {
|
||||
type StatusCode: record {
|
||||
id: string;
|
||||
desc: string;
|
||||
};
|
||||
|
||||
const statuses: table[count] of StatusCode = {
|
||||
[0x00000000] = [$id="SUCCESS", $desc="The operation completed successfully."],
|
||||
} &redef &default=function(i: count):StatusCode { local unknown=fmt("unknown-%d", i); return [$id=unknown, $desc=unknown]; };
|
||||
}
|
||||
|
||||
module SMB1;
|
||||
|
||||
export {
|
||||
const commands: table[count] of string = {
|
||||
[0x00] = "CREATE_DIRECTORY",
|
||||
[0x01] = "DELETE_DIRECTORY",
|
||||
[0x02] = "OPEN",
|
||||
[0x03] = "CREATE",
|
||||
[0x04] = "CLOSE",
|
||||
[0x05] = "FLUSH",
|
||||
[0x06] = "DELETE",
|
||||
[0x07] = "RENAME",
|
||||
[0x08] = "QUERY_INFORMATION",
|
||||
[0x09] = "SET_INFORMATION",
|
||||
[0x0A] = "READ",
|
||||
[0x0B] = "WRITE",
|
||||
[0x0C] = "LOCK_BYTE_RANGE",
|
||||
[0x0D] = "UNLOCK_BYTE_RANGE",
|
||||
[0x0E] = "CREATE_TEMPORARY",
|
||||
[0x0F] = "CREATE_NEW",
|
||||
[0x10] = "CHECK_DIRECTORY",
|
||||
[0x11] = "PROCESS_EXIT",
|
||||
[0x12] = "SEEK",
|
||||
[0x13] = "LOCK_AND_READ",
|
||||
[0x14] = "WRITE_AND_UNLOCK",
|
||||
[0x1A] = "READ_RAW",
|
||||
[0x1B] = "READ_MPX",
|
||||
[0x1C] = "READ_MPX_SECONDARY",
|
||||
[0x1D] = "WRITE_RAW",
|
||||
[0x1E] = "WRITE_MPX",
|
||||
[0x1F] = "WRITE_MPX_SECONDARY",
|
||||
[0x20] = "WRITE_COMPLETE",
|
||||
[0x21] = "QUERY_SERVER",
|
||||
[0x22] = "SET_INFORMATION2",
|
||||
[0x23] = "QUERY_INFORMATION2",
|
||||
[0x24] = "LOCKING_ANDX",
|
||||
[0x25] = "TRANSACTION",
|
||||
[0x26] = "TRANSACTION_SECONDARY",
|
||||
[0x27] = "IOCTL",
|
||||
[0x28] = "IOCTL_SECONDARY",
|
||||
[0x29] = "COPY",
|
||||
[0x2A] = "MOVE",
|
||||
[0x2B] = "ECHO",
|
||||
[0x2C] = "WRITE_AND_CLOSE",
|
||||
[0x2D] = "OPEN_ANDX",
|
||||
[0x2E] = "READ_ANDX",
|
||||
[0x2F] = "WRITE_ANDX",
|
||||
[0x30] = "NEW_FILE_SIZE",
|
||||
[0x31] = "CLOSE_AND_TREE_DISC",
|
||||
[0x32] = "TRANSACTION2",
|
||||
[0x33] = "TRANSACTION2_SECONDARY",
|
||||
[0x34] = "FIND_CLOSE2",
|
||||
[0x35] = "FIND_NOTIFY_CLOSE",
|
||||
[0x70] = "TREE_CONNECT",
|
||||
[0x71] = "TREE_DISCONNECT",
|
||||
[0x72] = "NEGOTIATE",
|
||||
[0x73] = "SESSION_SETUP_ANDX",
|
||||
[0x74] = "LOGOFF_ANDX",
|
||||
[0x75] = "TREE_CONNECT_ANDX",
|
||||
[0x80] = "QUERY_INFORMATION_DISK",
|
||||
[0x81] = "SEARCH",
|
||||
[0x82] = "FIND",
|
||||
[0x83] = "FIND_UNIQUE",
|
||||
[0x84] = "FIND_CLOSE",
|
||||
[0xA0] = "NT_TRANSACT",
|
||||
[0xA1] = "NT_TRANSACT_SECONDARY",
|
||||
[0xA2] = "NT_CREATE_ANDX",
|
||||
[0xA4] = "NT_CANCEL",
|
||||
[0xA5] = "NT_RENAME",
|
||||
[0xC0] = "OPEN_PRINT_FILE",
|
||||
[0xC1] = "WRITE_PRINT_FILE",
|
||||
[0xC2] = "CLOSE_PRINT_FILE",
|
||||
[0xC3] = "GET_PRINT_QUEUE",
|
||||
[0xD8] = "READ_BULK",
|
||||
[0xD9] = "WRITE_BULK",
|
||||
[0xDA] = "WRITE_BULK_DATA",
|
||||
} &default=function(i: count):string { return fmt("unknown-%d", i); };
|
||||
}
|
||||
|
||||
module SMB2;
|
||||
|
||||
export {
|
||||
const commands: table[count] of string = {
|
||||
[0] = "NEGOTIATE_PROTOCOL",
|
||||
[1] = "SESSION_SETUP",
|
||||
[2] = "LOGOFF",
|
||||
[3] = "TREE_CONNECT",
|
||||
[4] = "TREE_DISCONNECT",
|
||||
[5] = "CREATE",
|
||||
[6] = "CLOSE",
|
||||
[7] = "FLUSH",
|
||||
[8] = "READ",
|
||||
[9] = "WRITE",
|
||||
[10] = "LOCK",
|
||||
[11] = "IOCTL",
|
||||
[12] = "CANCEL",
|
||||
[13] = "ECHO",
|
||||
[14] = "QUERY_DIRECTORY",
|
||||
[15] = "CHANGE_NOTIFY",
|
||||
[16] = "QUERY_INFO",
|
||||
[17] = "SET_INFO",
|
||||
[18] = "OPLOCK_BREAK"
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
|
||||
const dialects: table[count] of string = {
|
||||
[0x0202] = "2.002",
|
||||
[0x0210] = "2.1",
|
||||
[0x0300] = "3.0",
|
||||
[0x0302] = "3.02",
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
|
||||
const share_types: table[count] of string = {
|
||||
[1] = "DISK",
|
||||
[2] = "PIPE",
|
||||
[3] = "PRINT",
|
||||
} &default=function(i: count): string { return fmt("unknown-%d", i); };
|
||||
}
|
||||
63
scripts/base/protocols/smb/files.bro
Normal file
63
scripts/base/protocols/smb/files.bro
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
@load base/frameworks/files
|
||||
|
||||
module SMB;
|
||||
|
||||
export {
|
||||
## Default file handle provider for SMB.
|
||||
global get_file_handle: function(c: connection, is_orig: bool): string;
|
||||
|
||||
## Default file describer for SMB.
|
||||
global describe_file: function(f: fa_file): string;
|
||||
}
|
||||
|
||||
function get_file_handle(c: connection, is_orig: bool): string
|
||||
{
|
||||
if ( ! (c$smb?$current_file &&
|
||||
((c$smb$current_file?$name && c$smb$current_file$name !in pipe_names) ||
|
||||
c$smb$current_file?$path)) )
|
||||
{
|
||||
# TODO: figure out what are the cases where this happens.
|
||||
return "";
|
||||
}
|
||||
|
||||
local current_file = c$smb$current_file;
|
||||
local path_name = current_file?$path ? current_file$path : "";
|
||||
local file_name = current_file?$name ? current_file$name : "";
|
||||
# Include last_mod time if available because if a file has been modified it
|
||||
# should be considered a new file.
|
||||
local last_mod = current_file?$times ? current_file$times$modified : double_to_time(0.0);
|
||||
return cat(Analyzer::ANALYZER_SMB, c$id$orig_h, c$id$resp_h, path_name, file_name, last_mod);
|
||||
}
|
||||
|
||||
function describe_file(f: fa_file): string
|
||||
{
|
||||
# This shouldn't be needed, but just in case...
|
||||
if ( f$source != "SMB" )
|
||||
return "";
|
||||
|
||||
for ( cid in f$conns )
|
||||
{
|
||||
local info = f$conns[cid];
|
||||
if ( info?$smb && info$smb?$current_file && info$smb$current_file?$name )
|
||||
return info$smb$current_file$name;
|
||||
}
|
||||
return "";
|
||||
}
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Files::register_protocol(Analyzer::ANALYZER_SMB,
|
||||
[$get_file_handle = SMB::get_file_handle,
|
||||
$describe = SMB::describe_file]);
|
||||
}
|
||||
|
||||
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
|
||||
{
|
||||
if ( c?$smb && c$smb?$current_file )
|
||||
{
|
||||
c$smb$current_file$fuid = f$id;
|
||||
|
||||
if ( c$smb$current_file?$name )
|
||||
f$info$filename = c$smb$current_file$name;
|
||||
}
|
||||
}
|
||||
199
scripts/base/protocols/smb/main.bro
Normal file
199
scripts/base/protocols/smb/main.bro
Normal file
|
|
@ -0,0 +1,199 @@
|
|||
module SMB;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += {
|
||||
CMD_LOG,
|
||||
MAPPING_LOG,
|
||||
FILES_LOG
|
||||
};
|
||||
|
||||
## Abstracted actions for SMB file actions.
|
||||
type FileAction: enum {
|
||||
FILE_READ,
|
||||
FILE_WRITE,
|
||||
FILE_OPEN,
|
||||
FILE_CLOSE,
|
||||
FILE_UNKNOWN,
|
||||
};
|
||||
|
||||
const logged_file_actions: set[FileAction] = {
|
||||
FILE_OPEN,
|
||||
FILE_READ,
|
||||
FILE_WRITE,
|
||||
};
|
||||
|
||||
## These are files names that are used for special
|
||||
## cases by the file system and would not be
|
||||
## considered "normal" files.
|
||||
const pipe_names: set[string] = {
|
||||
"\\netdfs",
|
||||
"\\spoolss",
|
||||
"\\NETLOGON",
|
||||
"\\winreg",
|
||||
"\\lsarpc",
|
||||
"\\samr",
|
||||
"\\srvsvc",
|
||||
"srvsvc",
|
||||
"MsFteWds",
|
||||
"\\wkssvc",
|
||||
};
|
||||
|
||||
type FileInfo: record {
|
||||
## Time when the file was first discovered.
|
||||
ts : time &log;
|
||||
uid : string &log;
|
||||
id : conn_id &log;
|
||||
fuid : string &log;
|
||||
|
||||
## Action this log record represents.
|
||||
action : FileAction &log &default=FILE_UNKNOWN;
|
||||
|
||||
## Path pulled from the tree this file was transferred to or from.
|
||||
path : string &log &optional;
|
||||
## Filename if one was seen.
|
||||
name : string &log &optional;
|
||||
|
||||
## Total size of the file.
|
||||
size : count &log &default=0;
|
||||
## Last time this file was modified.
|
||||
times : SMB::MACTimes &log &optional;
|
||||
};
|
||||
|
||||
type TreeInfo: record {
|
||||
## Time when the tree was mapped.
|
||||
ts : time &log &optional;
|
||||
|
||||
uid : string &log;
|
||||
id : conn_id &log;
|
||||
|
||||
## Name of the tree path.
|
||||
path : string &log &optional;
|
||||
service : string &log &optional;
|
||||
native_file_system : string &log &optional;
|
||||
|
||||
## If this is SMB2, a share type will be included.
|
||||
share_type : string &log &optional;
|
||||
};
|
||||
|
||||
type CmdInfo: record {
|
||||
## The command.
|
||||
command : string &optional;
|
||||
|
||||
## If the command referenced a file, store it here.
|
||||
referenced_file : FileInfo &optional;
|
||||
## If the command referenced a tree, store it here.
|
||||
referenced_tree : TreeInfo &optional;
|
||||
};
|
||||
|
||||
type Info: record {
|
||||
ts: time &log;
|
||||
uid: string &log;
|
||||
id: conn_id &log;
|
||||
|
||||
## Version of SMB for the command.
|
||||
version: string &log;
|
||||
|
||||
## Command sent by the client.
|
||||
command: string &log &optional;
|
||||
|
||||
## Server reply to the client's command
|
||||
status: string &log &optional;
|
||||
|
||||
## If this is related to a tree, this is the tree
|
||||
## that was used for the current command.
|
||||
tree: string &log &optional;
|
||||
|
||||
## The negotiated dialect for the connection.
|
||||
dialect: string &log &optional;
|
||||
|
||||
## Round trip time from the request to the response.
|
||||
rtt: interval &log &optional;
|
||||
|
||||
## A reference to the current command.
|
||||
current_cmd : CmdInfo &optional;
|
||||
|
||||
## A reference to the current file.
|
||||
current_file : FileInfo &optional;
|
||||
|
||||
## A reference to the current tree.
|
||||
current_tree : TreeInfo &optional;
|
||||
|
||||
## Indexed on MID to map responses to requests.
|
||||
pending_cmds : table[count] of CmdInfo &optional;
|
||||
## File map to retrieve file information based on the file ID.
|
||||
fid_map : table[count] of FileInfo &optional;
|
||||
## Tree map to retrieve tree information based on the tree ID.
|
||||
tid_map : table[count] of TreeInfo &optional;
|
||||
};
|
||||
|
||||
redef record connection += {
|
||||
smb : Info &optional;
|
||||
};
|
||||
|
||||
## This is an internally used function.
|
||||
const set_current_file: function(smb: Info, file_id: count) &redef;
|
||||
|
||||
## This is an internally used function.
|
||||
const write_file_log: function(f: FileInfo) &redef;
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
smb_pending_cmds : table[count, count] of Info &default=table();
|
||||
};
|
||||
|
||||
redef record FileInfo += {
|
||||
## ID referencing this file.
|
||||
fid : count &optional;
|
||||
|
||||
## Maintain a reference to the file record.
|
||||
f : fa_file &optional;
|
||||
};
|
||||
|
||||
const ports = { 139/tcp, 445/tcp };
|
||||
redef likely_server_ports += { ports };
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(CMD_LOG, [$columns=SMB::Info]);
|
||||
Log::create_stream(FILES_LOG, [$columns=SMB::FileInfo]);
|
||||
Log::create_stream(MAPPING_LOG, [$columns=SMB::TreeInfo]);
|
||||
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_SMB, ports);
|
||||
}
|
||||
|
||||
function set_current_file(smb: Info, file_id: count)
|
||||
{
|
||||
if ( file_id !in smb$fid_map )
|
||||
{
|
||||
smb$fid_map[file_id] = smb$current_cmd$referenced_file;
|
||||
smb$fid_map[file_id]$fid = file_id;
|
||||
}
|
||||
|
||||
smb$current_file = smb$fid_map[file_id];
|
||||
}
|
||||
|
||||
function write_file_log(f: FileInfo)
|
||||
{
|
||||
if ( f?$name &&
|
||||
f$name !in pipe_names &&
|
||||
f$action in logged_file_actions )
|
||||
{
|
||||
Log::write(FILES_LOG, f);
|
||||
}
|
||||
}
|
||||
|
||||
event file_state_remove(f: fa_file) &priority=-5
|
||||
{
|
||||
if ( f$source != "SMB" )
|
||||
return;
|
||||
|
||||
for ( id in f$conns )
|
||||
{
|
||||
local c = f$conns[id];
|
||||
if ( c?$smb && c$smb?$current_file)
|
||||
{
|
||||
write_file_log(c$smb$current_file);
|
||||
}
|
||||
return;
|
||||
}
|
||||
}
|
||||
59
scripts/base/protocols/smb/pipe.bro
Normal file
59
scripts/base/protocols/smb/pipe.bro
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
module SMB;
|
||||
|
||||
export {
|
||||
redef enum Log::ID += {
|
||||
ATSVC_LOG,
|
||||
};
|
||||
|
||||
type ATSvcInfo: record {
|
||||
## Time of the request
|
||||
ts : time &log;
|
||||
## UID of the connection
|
||||
uid : string &log;
|
||||
## Connection info
|
||||
id : conn_id &log;
|
||||
## Command (add, enum, delete, etc.)
|
||||
command : string &log;
|
||||
## Argument
|
||||
arg : string &log;
|
||||
## Server the command was issued to
|
||||
server : string &log;
|
||||
## Result of the command
|
||||
result : string &log &optional;
|
||||
};
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
smb_atsvc: ATSvcInfo &optional;
|
||||
};
|
||||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(ATSVC_LOG, [$columns=ATSvcInfo]);
|
||||
}
|
||||
|
||||
event smb_atsvc_job_add(c: connection, server: string, job: string)
|
||||
{
|
||||
local info: ATSvcInfo;
|
||||
info$ts = network_time();
|
||||
info$uid = c$uid;
|
||||
info$id = c$id;
|
||||
info$command = "Add job";
|
||||
info$arg = job;
|
||||
info$server = server;
|
||||
|
||||
c$smb_atsvc = info;
|
||||
}
|
||||
|
||||
event smb_atsvc_job_id(c: connection, id: count, status: count)
|
||||
{
|
||||
if ( !c?$smb_atsvc )
|
||||
return;
|
||||
if ( status == 0 )
|
||||
c$smb_atsvc$result = "success";
|
||||
else
|
||||
c$smb_atsvc$result = "failed";
|
||||
|
||||
Log::write(ATSVC_LOG, c$smb_atsvc);
|
||||
delete c$smb_atsvc;
|
||||
}
|
||||
194
scripts/base/protocols/smb/smb1-main.bro
Normal file
194
scripts/base/protocols/smb/smb1-main.bro
Normal file
|
|
@ -0,0 +1,194 @@
|
|||
module SMB1;
|
||||
|
||||
redef record SMB::Info += {
|
||||
smb1_offered_dialects: string_vec &optional;
|
||||
};
|
||||
|
||||
event smb1_message(c: connection, hdr: SMB1::Header, is_orig: bool) &priority=5
|
||||
{
|
||||
if ( ! c?$smb )
|
||||
{
|
||||
local info: SMB::Info = [$ts=network_time(), $uid=c$uid, $id=c$id, $version="SMB1"];
|
||||
info$fid_map = table();
|
||||
info$tid_map = table();
|
||||
info$pending_cmds = table();
|
||||
c$smb = info;
|
||||
}
|
||||
|
||||
local smb = c$smb;
|
||||
local tid = hdr$tid;
|
||||
local pid = hdr$pid;
|
||||
local uid = hdr$uid;
|
||||
local mid = hdr$mid;
|
||||
|
||||
if ( tid !in smb$tid_map )
|
||||
{
|
||||
local tmp_tree: SMB::TreeInfo = [$uid=c$uid, $id=c$id];
|
||||
smb$tid_map[tid] = tmp_tree;
|
||||
}
|
||||
smb$current_tree = smb$tid_map[tid];
|
||||
|
||||
if ( mid !in smb$pending_cmds )
|
||||
{
|
||||
local tmp_cmd: SMB::CmdInfo;
|
||||
tmp_cmd$command = SMB1::commands[hdr$command];
|
||||
|
||||
local tmp_file: SMB::FileInfo;
|
||||
tmp_file$ts = network_time();
|
||||
tmp_file$id = c$id;
|
||||
tmp_file$uid = c$uid;
|
||||
tmp_cmd$referenced_file = tmp_file;
|
||||
tmp_cmd$referenced_tree = smb$current_tree;
|
||||
|
||||
smb$pending_cmds[mid] = tmp_cmd;
|
||||
}
|
||||
|
||||
smb$current_cmd = smb$pending_cmds[mid];
|
||||
smb$command = smb$current_cmd$command;
|
||||
|
||||
if ( is_orig )
|
||||
{
|
||||
smb$ts = network_time();
|
||||
}
|
||||
else
|
||||
{
|
||||
smb$rtt = network_time() - smb$ts;
|
||||
smb$status = SMB::statuses[hdr$status]$id;
|
||||
}
|
||||
}
|
||||
|
||||
event smb1_message(c: connection, hdr: SMB1::Header, is_orig: bool) &priority=-5
|
||||
{
|
||||
if ( !is_orig )
|
||||
# This is a response and the command is no longer pending
|
||||
# so let's get rid of it.
|
||||
delete c$smb$pending_cmds[hdr$mid];
|
||||
|
||||
if ( c?$smb )
|
||||
Log::write(SMB::CMD_LOG, c$smb);
|
||||
}
|
||||
|
||||
|
||||
event smb1_negotiate_request(c: connection, hdr: SMB1::Header, dialects: string_vec) &priority=5
|
||||
{
|
||||
c$smb$smb1_offered_dialects = dialects;
|
||||
}
|
||||
|
||||
event smb1_negotiate_response(c: connection, hdr: SMB1::Header, response: SMB1::NegotiateResponse) &priority=5
|
||||
{
|
||||
if ( c$smb?$smb1_offered_dialects )
|
||||
{
|
||||
if ( response?$ntlm )
|
||||
c$smb$dialect = c$smb$smb1_offered_dialects[response$ntlm$dialect_index];
|
||||
delete c$smb$smb1_offered_dialects;
|
||||
}
|
||||
}
|
||||
|
||||
event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: string, service: string) &priority=5
|
||||
{
|
||||
c$smb$current_cmd$referenced_tree$path = path;
|
||||
c$smb$current_cmd$referenced_tree$service = service;
|
||||
c$smb$current_tree$ts=network_time();
|
||||
}
|
||||
|
||||
event smb1_tree_connect_andx_response(c: connection, hdr: SMB1::Header, service: string, native_file_system: string) &priority=5
|
||||
{
|
||||
c$smb$current_cmd$referenced_tree$native_file_system = native_file_system;
|
||||
c$smb$current_tree = c$smb$current_cmd$referenced_tree;
|
||||
c$smb$tid_map[hdr$tid] = c$smb$current_tree;
|
||||
}
|
||||
|
||||
event smb1_tree_connect_andx_response(c: connection, hdr: SMB1::Header, service: string, native_file_system: string) &priority=-5
|
||||
{
|
||||
Log::write(SMB::MAPPING_LOG, c$smb$current_tree);
|
||||
}
|
||||
|
||||
event smb1_nt_create_andx_request(c: connection, hdr: SMB1::Header, name: string) &priority=5
|
||||
{
|
||||
c$smb$current_cmd$referenced_file$name = name;
|
||||
c$smb$current_file = c$smb$current_cmd$referenced_file;
|
||||
c$smb$current_file$action = SMB::FILE_OPEN;
|
||||
}
|
||||
|
||||
event smb1_nt_create_andx_response(c: connection, hdr: SMB1::Header, file_id: count, file_size: count, times: SMB::MACTimes) &priority=5
|
||||
{
|
||||
if ( ! c$smb?$current_file )
|
||||
{
|
||||
c$smb$current_file = c$smb$current_cmd$referenced_file;
|
||||
c$smb$current_file$action = SMB::FILE_OPEN;
|
||||
}
|
||||
c$smb$current_file$fid = file_id;
|
||||
c$smb$current_file$size = file_size;
|
||||
|
||||
# I'm seeing negative data from IPC tree transfers
|
||||
if ( time_to_double(times$modified) > 0.0 )
|
||||
c$smb$current_file$times = times;
|
||||
|
||||
# We can identify the file by its file id now so let's stick it
|
||||
# in the file map.
|
||||
c$smb$fid_map[file_id] = c$smb$current_file;
|
||||
|
||||
SMB::write_file_log(c$smb$current_file);
|
||||
}
|
||||
|
||||
event smb1_read_andx_request(c: connection, hdr: SMB1::Header, file_id: count, offset: count, length: count) &priority=5
|
||||
{
|
||||
SMB::set_current_file(c$smb, file_id);
|
||||
c$smb$current_file$action = SMB::FILE_READ;
|
||||
|
||||
if ( c$smb$current_tree?$path && !c$smb$current_file?$path )
|
||||
c$smb$current_file$path = c$smb$current_tree$path;
|
||||
|
||||
#write_file_log(c$smb$current_file);
|
||||
}
|
||||
|
||||
event smb1_read_andx_response(c: connection, hdr: SMB1::Header, data_len: count) &priority=5
|
||||
{
|
||||
#print "read andx response!";
|
||||
}
|
||||
|
||||
event smb1_write_andx_request(c: connection, hdr: SMB1::Header, file_id: count, offset: count, data_len: count) &priority=5
|
||||
{
|
||||
SMB::set_current_file(c$smb, file_id);
|
||||
c$smb$current_file$action = SMB::FILE_WRITE;
|
||||
}
|
||||
|
||||
event smb1_write_andx_request(c: connection, hdr: SMB1::Header, file_id: count, offset: count, data_len: count) &priority=-5
|
||||
{
|
||||
if ( c$smb$current_tree?$path && !c$smb$current_file?$path )
|
||||
c$smb$current_file$path = c$smb$current_tree$path;
|
||||
|
||||
#write_file_log(c$smb$current_file);
|
||||
}
|
||||
|
||||
#event smb1_write_andx_response(c: connection, hdr: SMB1::Header, written_bytes: count) &priority=5
|
||||
# {
|
||||
# # Do i really need to do anything here? Maybe do a weird if the number of bytes written is odd?
|
||||
# }
|
||||
|
||||
event smb1_close_request(c: connection, hdr: SMB1::Header, file_id: count) &priority=5
|
||||
{
|
||||
SMB::set_current_file(c$smb, file_id);
|
||||
c$smb$current_file$action = SMB::FILE_CLOSE;
|
||||
}
|
||||
|
||||
event smb1_close_request(c: connection, hdr: SMB1::Header, file_id: count) &priority=-5
|
||||
{
|
||||
if ( file_id in c$smb$fid_map )
|
||||
{
|
||||
local fl = c$smb$fid_map[file_id];
|
||||
fl$uid = c$uid;
|
||||
fl$id = c$id;
|
||||
# Need to check for existence of path in case tree connect message wasn't seen.
|
||||
if ( c$smb$current_tree?$path )
|
||||
fl$path = c$smb$current_tree$path;
|
||||
delete c$smb$fid_map[file_id];
|
||||
|
||||
SMB::write_file_log(fl);
|
||||
}
|
||||
else
|
||||
{
|
||||
# A reporter message is not right...
|
||||
#Reporter::warning("attempting to close an unknown file!");
|
||||
}
|
||||
}
|
||||
183
scripts/base/protocols/smb/smb2-main.bro
Normal file
183
scripts/base/protocols/smb/smb2-main.bro
Normal file
|
|
@ -0,0 +1,183 @@
|
|||
module SMB2;
|
||||
|
||||
redef record SMB::Info += {
|
||||
smb2_offered_dialects: index_vec &optional;
|
||||
};
|
||||
|
||||
event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=5
|
||||
{
|
||||
if ( ! c?$smb )
|
||||
{
|
||||
local info: SMB::Info = [$ts=network_time(), $uid=c$uid, $id=c$id, $version="SMB2"];
|
||||
info$fid_map = table();
|
||||
info$tid_map = table();
|
||||
info$pending_cmds = table();
|
||||
c$smb = info;
|
||||
}
|
||||
|
||||
local smb = c$smb;
|
||||
local tid = hdr$tree_id;
|
||||
local pid = hdr$process_id;
|
||||
local mid = hdr$message_id;
|
||||
local sid = hdr$session_id;
|
||||
|
||||
if ( tid !in smb$tid_map )
|
||||
{
|
||||
local tmp_tree: SMB::TreeInfo = [$uid=c$uid, $id=c$id];
|
||||
smb$tid_map[tid] = tmp_tree;
|
||||
}
|
||||
smb$current_tree = smb$tid_map[tid];
|
||||
|
||||
if ( mid !in smb$pending_cmds )
|
||||
{
|
||||
local tmp_cmd: SMB::CmdInfo;
|
||||
tmp_cmd$command = SMB2::commands[hdr$command];
|
||||
|
||||
local tmp_file: SMB::FileInfo;
|
||||
tmp_file$ts = network_time();
|
||||
tmp_file$id = c$id;
|
||||
tmp_file$uid = c$uid;
|
||||
tmp_cmd$referenced_file = tmp_file;
|
||||
tmp_cmd$referenced_tree = smb$current_tree;
|
||||
|
||||
smb$pending_cmds[mid] = tmp_cmd;
|
||||
}
|
||||
|
||||
smb$current_cmd = smb$pending_cmds[mid];
|
||||
smb$command = smb$current_cmd$command;
|
||||
|
||||
if ( is_orig )
|
||||
{
|
||||
smb$ts = network_time();
|
||||
}
|
||||
else
|
||||
{
|
||||
smb$rtt = network_time() - smb$ts;
|
||||
smb$status = SMB::statuses[hdr$status]$id;
|
||||
}
|
||||
}
|
||||
|
||||
event smb2_message(c: connection, hdr: SMB2::Header, is_orig: bool) &priority=-5
|
||||
{
|
||||
if ( !is_orig )
|
||||
# This is a response and the command is no longer pending
|
||||
# so let's get rid of it.
|
||||
delete c$smb$pending_cmds[hdr$message_id];
|
||||
|
||||
if ( c?$smb )
|
||||
Log::write(SMB::CMD_LOG, c$smb);
|
||||
}
|
||||
|
||||
event smb2_negotiate_request(c: connection, hdr: SMB2::Header, dialects: index_vec) &priority=5
|
||||
{
|
||||
c$smb$smb2_offered_dialects = dialects;
|
||||
}
|
||||
|
||||
event smb2_negotiate_response(c: connection, hdr: SMB2::Header, response: SMB2::NegotiateResponse)
|
||||
{
|
||||
if ( c$smb?$smb2_offered_dialects )
|
||||
{
|
||||
for ( i in c$smb$smb2_offered_dialects )
|
||||
{
|
||||
if ( response$dialect_revision == c$smb$smb2_offered_dialects[i] )
|
||||
{
|
||||
c$smb$dialect = SMB2::dialects[response$dialect_revision];
|
||||
break;
|
||||
}
|
||||
}
|
||||
delete c$smb$smb2_offered_dialects;
|
||||
}
|
||||
}
|
||||
|
||||
event smb2_tree_connect_request(c: connection, hdr: SMB2::Header, path: string) &priority=5
|
||||
{
|
||||
c$smb$current_cmd$referenced_tree$path = path;
|
||||
c$smb$current_tree$ts=network_time();
|
||||
}
|
||||
|
||||
event smb2_tree_connect_response(c: connection, hdr: SMB2::Header, response: SMB2::TreeConnectResponse) &priority=5
|
||||
{
|
||||
c$smb$current_tree = c$smb$current_cmd$referenced_tree;
|
||||
c$smb$current_tree$share_type = SMB2::share_types[response$share_type];
|
||||
c$smb$tid_map[hdr$tree_id] = c$smb$current_tree;
|
||||
}
|
||||
|
||||
event smb2_tree_connect_response(c: connection, hdr: SMB2::Header, response: SMB2::TreeConnectResponse) &priority=-5
|
||||
{
|
||||
Log::write(SMB::MAPPING_LOG, c$smb$current_tree);
|
||||
}
|
||||
|
||||
event smb2_create_request(c: connection, hdr: SMB2::Header, name: string) &priority=5
|
||||
{
|
||||
c$smb$current_cmd$referenced_file$name = name;
|
||||
c$smb$current_file = c$smb$current_cmd$referenced_file;
|
||||
c$smb$current_file$action = SMB::FILE_OPEN;
|
||||
}
|
||||
|
||||
event smb2_create_response(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, file_size: count, times: SMB::MACTimes, attrs: SMB2::FileAttrs) &priority=5
|
||||
{
|
||||
if ( ! c$smb?$current_file )
|
||||
{
|
||||
c$smb$current_file = c$smb$current_cmd$referenced_file;
|
||||
c$smb$current_file$action = SMB::FILE_OPEN;
|
||||
}
|
||||
c$smb$current_file$fid = file_id$persistent+file_id$volatile;
|
||||
c$smb$current_file$size = file_size;
|
||||
|
||||
# I'm seeing negative data from IPC tree transfers
|
||||
if ( time_to_double(times$modified) > 0.0 )
|
||||
c$smb$current_file$times = times;
|
||||
|
||||
# We can identify the file by its file id now so let's stick it
|
||||
# in the file map.
|
||||
c$smb$fid_map[file_id$persistent+file_id$volatile] = c$smb$current_file;
|
||||
|
||||
SMB::write_file_log(c$smb$current_file);
|
||||
}
|
||||
|
||||
event smb2_read_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, length: count) &priority=5
|
||||
{
|
||||
SMB::set_current_file(c$smb, file_id$persistent+file_id$volatile);
|
||||
c$smb$current_file$action = SMB::FILE_READ;
|
||||
|
||||
if ( c$smb$current_tree?$path && !c$smb$current_file?$path )
|
||||
c$smb$current_file$path = c$smb$current_tree$path;
|
||||
|
||||
#write_file_log(c$smb$current_file);
|
||||
}
|
||||
|
||||
event smb2_write_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID, offset: count, length: count) &priority=5
|
||||
{
|
||||
SMB::set_current_file(c$smb, file_id$persistent+file_id$volatile);
|
||||
c$smb$current_file$action = SMB::FILE_WRITE;
|
||||
|
||||
if ( c$smb$current_tree?$path && ! c$smb$current_file?$path )
|
||||
c$smb$current_file$path = c$smb$current_tree$path;
|
||||
}
|
||||
|
||||
event smb2_close_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID) &priority=5
|
||||
{
|
||||
SMB::set_current_file(c$smb, file_id$persistent+file_id$volatile);
|
||||
c$smb$current_file$action = SMB::FILE_CLOSE;
|
||||
}
|
||||
|
||||
event smb2_close_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID) &priority=-5
|
||||
{
|
||||
if ( file_id$persistent+file_id$volatile in c$smb$fid_map )
|
||||
{
|
||||
local fl = c$smb$fid_map[file_id$persistent+file_id$volatile];
|
||||
fl$uid = c$uid;
|
||||
fl$id = c$id;
|
||||
# Need to check for existence of path in case tree connect message wasn't seen.
|
||||
if ( c$smb$current_tree?$path )
|
||||
fl$path = c$smb$current_tree$path;
|
||||
delete c$smb$fid_map[file_id$persistent+file_id$volatile];
|
||||
|
||||
SMB::write_file_log(fl);
|
||||
}
|
||||
else
|
||||
{
|
||||
# A reporter message is not right...
|
||||
#Reporter::warning("attempting to close an unknown file!");
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue