Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 00:58:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Create an smb_auth.log.

Browse source 
- Brings the SMB NTLM support all the way to a log.
 - Only support SMB1 right now.
 - A bit more clean up of logged file actions and code organization.
This commit is contained in:
Seth Hall 2016-03-07 11:17:51 -05:00
parent 481335e5ea
commit ca58dc84d5
2 changed files with 43 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/protocols/smb/main.bro
View file

@ -5,6 +5,7 @@ module SMB;
export { export {
redef enum Log::ID += { redef enum Log::ID += {
CMD_LOG, CMD_LOG,
AUTH_LOG,
MAPPING_LOG, MAPPING_LOG,
FILES_LOG FILES_LOG
}; };
@ -36,8 +37,7 @@ export {
## The file actions which are logged. ## The file actions which are logged.
const logged_file_actions: set[Action] = { const logged_file_actions: set[Action] = {
FILE_OPEN, FILE_OPEN,
FILE_READ, FILE_CLOSE,
FILE_WRITE,
PIPE_OPEN, PIPE_OPEN,
PIPE_CLOSE, PIPE_CLOSE,
@ -95,6 +95,13 @@ export {
share_type : string &log &default="UNKNOWN"; share_type : string &log &default="UNKNOWN";
}; };
type AuthInfo: record {
ts : time &log &optional;
username : string &log &optional;
hostname : string &log &optional;
domainname : string &log &optional;
};
## This record is for the smb_cmd.log ## This record is for the smb_cmd.log
type CmdInfo: record { type CmdInfo: record {
## Timestamp of the command request ## Timestamp of the command request
@ -142,6 +149,8 @@ export {
current_file : FileInfo &optional; current_file : FileInfo &optional;
## A reference to the current tree. ## A reference to the current tree.
current_tree : TreeInfo &optional; current_tree : TreeInfo &optional;
## A reference to the currently authenticated user.
current_auth : AuthInfo &optional;
## Indexed on MID to map responses to requests. ## Indexed on MID to map responses to requests.
pending_cmds : table[count] of CmdInfo &optional; pending_cmds : table[count] of CmdInfo &optional;
@ -202,6 +211,7 @@ redef likely_server_ports += { ports };
event bro_init() &priority=5 event bro_init() &priority=5
{ {
Log::create_stream(CMD_LOG, [$columns=SMB::CmdInfo]); Log::create_stream(CMD_LOG, [$columns=SMB::CmdInfo]);
Log::create_stream(AUTH_LOG, [$columns=SMB::AuthInfo]);
Log::create_stream(FILES_LOG, [$columns=SMB::FileInfo]); Log::create_stream(FILES_LOG, [$columns=SMB::FileInfo]);
Log::create_stream(MAPPING_LOG, [$columns=SMB::TreeInfo]); Log::create_stream(MAPPING_LOG, [$columns=SMB::TreeInfo]);

45
scripts/base/protocols/smb/smb1-main.bro
View file

@ -283,25 +283,18 @@ event smb_ntlm_negotiate(c: connection, hdr: SMB1::Header, request: SMB::NTLMNeg
c$smb_state$current_cmd$sub_command = "NTLMSSP_NEGOTIATE"; c$smb_state$current_cmd$sub_command = "NTLMSSP_NEGOTIATE";
} }
event smb1_error(c: connection, hdr: SMB1::Header, is_orig: bool) event smb_ntlm_authenticate(c: connection, hdr: SMB1::Header, request: SMB::NTLMAuthenticate) &priority=5
{
if ( ! is_orig )
{
# This is for deferred commands only.
# The more specific messages won't fire for errors
if ( SMB::write_cmd_log &&
( c$smb_state$current_cmd$status !in SMB::ignored_command_statuses ) &&
( c$smb_state$current_cmd$command in SMB::deferred_logging_cmds ) )
{
Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
}
}
}
event smb_ntlm_authenticate(c: connection, hdr: SMB1::Header, request: SMB::NTLMAuthenticate)
{ {
c$smb_state$current_cmd$sub_command = "NTLMSSP_AUTHENTICATE"; c$smb_state$current_cmd$sub_command = "NTLMSSP_AUTHENTICATE";
c$smb_state$current_auth = SMB::AuthInfo($ts=network_time());
if ( request?$domain_name )
c$smb_state$current_auth$domainname = request$domain_name;
if ( request?$workstation )
c$smb_state$current_auth$hostname = request$workstation;
if ( request?$user_name )
c$smb_state$current_auth$username = request$user_name;
local user: string = ""; local user: string = "";
if ( ( request?$domain_name && request$domain_name != "" ) && ( request?$user_name && request$user_name != "" ) ) if ( ( request?$domain_name && request$domain_name != "" ) && ( request?$user_name && request$user_name != "" ) )
user = fmt("%s\\%s", request$domain_name, request$user_name); user = fmt("%s\\%s", request$domain_name, request$user_name);
@ -325,6 +318,11 @@ event smb_ntlm_authenticate(c: connection, hdr: SMB1::Header, request: SMB::NTLM
} }
} }
event smb_ntlm_authenticate(c: connection, hdr: SMB1::Header, request: SMB::NTLMAuthenticate) &priority=5
{
Log::write(SMB::AUTH_LOG, c$smb_state$current_auth);
}
event smb1_transaction_request(c: connection, hdr: SMB1::Header, name: string, sub_cmd: count) event smb1_transaction_request(c: connection, hdr: SMB1::Header, name: string, sub_cmd: count)
{ {
c$smb_state$current_cmd$sub_command = SMB1::trans_sub_commands[sub_cmd]; c$smb_state$current_cmd$sub_command = SMB1::trans_sub_commands[sub_cmd];
@ -388,6 +386,21 @@ event smb_pipe_request(c: connection, hdr: SMB1::Header, op_num: count)
c$smb_state$current_cmd$argument = arg; c$smb_state$current_cmd$argument = arg;
} }
event smb1_error(c: connection, hdr: SMB1::Header, is_orig: bool)
{
if ( ! is_orig )
{
# This is for deferred commands only.
# The more specific messages won't fire for errors
if ( SMB::write_cmd_log &&
c$smb_state$current_cmd$status !in SMB::ignored_command_statuses &&
c$smb_state$current_cmd$command in SMB::deferred_logging_cmds )
{
Log::write(SMB::CMD_LOG, c$smb_state$current_cmd);
}
}
}
#event smb1_transaction_setup(c: connection, hdr: SMB1::Header, op_code: count, file_id: count) #event smb1_transaction_setup(c: connection, hdr: SMB1::Header, op_code: count, file_id: count)
# { # {
# local uuid = SMB::rpc_uuids[c$smb_state$pipe_map[file_id]]; # local uuid = SMB::rpc_uuids[c$smb_state$pipe_map[file_id]];