Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 13:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SMB: Init lanman time and set TZ correctly before calling mktime

Browse source 
This makes a change to the record for smb1-negotiate-response as well.
Times and dates are two 2-byte sections, not three. Switch the parsing
to just use two uint16s, and pass those into the lanman time conversion
function.
This commit is contained in:
Tim Wojtulewicz 2025-09-05 15:39:17 -07:00
parent 3c16ee9667
commit 8efddf87d9
6 changed files with 55 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/smb/smb1-com-negotiate.pac
View file

@ -181,8 +181,8 @@ type SMB1_negotiate_lanman_response(header: SMB_Header) = record {
max_number_vcs : uint16;
raw_mode : uint16; # expanded in &let
session_key : uint32;
server_time : SMB_time;
server_date : SMB_date;
server_time : uint16;
server_date : uint16;
server_tz : uint16;
encryption_key_length : uint16;
reserved : uint16; # must be zero