mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
c92060a8ca
* origin/topic/seth/smb-auth-fixes: Disable SMB2 error data parsing. Removed some files that aren't being used. Fix SMB tree connect handling. Fix a small issue where DCE_RPC commands were improperly being logged. SMB fixes and cleanup. Including a test for raw NTLM in SMB Updates for SMB auth handling from Martin van Hensbergen. BIT-1721 #merged
14 lines
376 B
Text
14 lines
376 B
Text
#@TEST-EXEC: bro -b -C -r $TRACES/smb/raw_ntlm_in_smb.pcap %INPUT
|
|
#@TEST-EXEC: btest-diff .stdout
|
|
|
|
@load base/protocols/ntlm
|
|
@load policy/protocols/smb
|
|
|
|
# Just verify that the session key is grabbed correctly from NTLM
|
|
# carried raw over SMB.
|
|
|
|
event ntlm_authenticate(c: connection, request: NTLM::Authenticate)
|
|
{
|
|
if ( request?$session_key )
|
|
print request$session_key;
|
|
}
|