Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
zeek/testing/btest/Baseline/scripts.base.protocols.smb.smb2-create-delete-on-close/smb_cmd.log
Arne Welzel 3dae8ab086 smb2: Raise smb2_file_delete for CREATE with FILE_DELETE_ON_CLOSE 
When a CREATE request contains the FILE_DELETE_ON_CLOSE option and
the subsequent CREATE response indicates success, we now raise the
smb2_file_delete event to log a delete action in smb_files.log and
also give users a way to handle this scenario.

The provided pcap was generated locally by recording a smbtorture run
of the smb2.delete-on-close-perms test case.

Placed the create_options into the CmdInfo record for potential
exposure in smb_cmd.log (wasn't sure how that would look so left it
for the future).

Fixes #2276.
2022-07-16 17:14:13 +02:00

34 lines
6.4 KiB
Text
Raw Blame History

### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path smb_cmd
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p command sub_command argument status rtt version username tree tree_service referenced_file.ts referenced_file.uid referenced_file.id.orig_h referenced_file.id.orig_p referenced_file.id.resp_h referenced_file.id.resp_p referenced_file.fuid referenced_file.action referenced_file.path referenced_file.name referenced_file.size referenced_file.prev_name referenced_file.times.modified referenced_file.times.accessed referenced_file.times.created referenced_file.times.changed
#types time string addr port addr port string string string string interval string string string string time string addr port addr port string enum string string count string time time time time
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 NEGOTIATE_PROTOCOL - - SUCCESS 0.002119 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 SESSION_SETUP - - SUCCESS 0.001559 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 TREE_CONNECT - - SUCCESS 0.005032 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000430 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_INFO - - SUCCESS 0.000131 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 SET_INFO - - SUCCESS 0.000298 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000112 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - FILE_IS_A_DIRECTORY 0.000163 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000159 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_DIRECTORY - - SUCCESS 0.000135 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000227 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000174 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_DIRECTORY - - NO_MORE_FILES 0.000038 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - OBJECT_NAME_NOT_FOUND 0.000158 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000053 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000246 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000220 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000748 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 QUERY_INFO - - SUCCESS 0.000151 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 SET_INFO - - SUCCESS 0.000333 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - - - - 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000112 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - SUCCESS 0.000622 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CLOSE - - SUCCESS 0.000141 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_CLOSE \\\\127.0.0.1\\tmp test_dir\\test_create.dat 0 - XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 CREATE - - OBJECT_NAME_NOT_FOUND 0.000181 SMB2 - - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 54268 127.0.0.1 445 - SMB::FILE_OPEN - test_dir\\test_create.dat 0 - - - - -
#close XXXX-XX-XX-XX-XX-XX
Reference in a new issue View git blame Copy permalink