Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Including a test for raw NTLM in SMB

Browse source
This commit is contained in:
Seth Hall 2016-10-26 10:41:08 -04:00
parent 8276c250bd
commit a836ece4e6
3 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
testing/btest/Baseline/scripts.base.protocols.smb.raw-ntlm/.stdout Normal file
View file

@ -0,0 +1 @@
\xebr\x96\x86\xfc\xaa\xcf\xad\xb14\x18\xfaIG`\xde

BIN
testing/btest/Traces/smb/raw_ntlm_in_smb.pcap Normal file
View file

Binary file not shown.

14
testing/btest/scripts/base/protocols/smb/raw-ntlm.test Normal file
View file

@ -0,0 +1,14 @@
#@TEST-EXEC: bro -b -C -r $TRACES/smb/raw_ntlm_in_smb.pcap %INPUT
#@TEST-EXEC: btest-diff .stdout
@load base/protocols/ntlm
@load policy/protocols/smb
# Just verify that the session key is grabbed correctly from NTLM
# carried raw over SMB.
event ntlm_authenticate(c: connection, request: NTLM::Authenticate)
{
if ( request?$session_key )
print request$session_key;
}