From 832f6d34b4beb7548ef56a97b02f5f427da75f0c Mon Sep 17 00:00:00 2001 From: "John E. Rollinson" Date: Sun, 29 Jan 2017 09:39:12 +0900 Subject: [PATCH] Add ciphertext to ticket data structures --- scripts/base/init-bare.bro | 2 ++ src/analyzer/protocol/krb/krb-types.pac | 1 + 2 files changed, 3 insertions(+) diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index ffee527bb7..b5bf5d298d 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -3955,6 +3955,8 @@ export { service_name : string; ## Cipher the ticket was encrypted with cipher : count; + ## Cipher text of the ticket + ciphertext : string &optional; }; type KRB::Ticket_Vector: vector of KRB::Ticket; diff --git a/src/analyzer/protocol/krb/krb-types.pac b/src/analyzer/protocol/krb/krb-types.pac index a5b2eb1041..bb2bfba3e8 100644 --- a/src/analyzer/protocol/krb/krb-types.pac +++ b/src/analyzer/protocol/krb/krb-types.pac @@ -95,6 +95,7 @@ RecordVal* proc_ticket(const KRB_Ticket* ticket) rv->Assign(1, bytestring_to_val(ticket->realm()->data()->content())); rv->Assign(2, GetStringFromPrincipalName(ticket->sname())); rv->Assign(3, asn1_integer_to_val(ticket->enc_part()->data()->etype()->data(), TYPE_COUNT)); + rv->Assign(4, bytestring_to_val(ticket->enc_part()->data()->ciphertext())); return rv; }