mirror of https://github.com/OISF/suricata
smb: session setup improvements
Improve ntlmssp version extraction and logging, make its data structures optional. Extract native os/lm from smb1 ssn setup. Move session setup handling into their own files. Only log auth data for the session setup tx.pull/3281/head
Victor Julien
8 years ago
parent
75d7c9d64a
commit
8bef120898
@ -0,0 +1,75 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
use log::*;
|
||||
|
||||
use smb::smb::*;
|
||||
use smb::smb1_session::*;
|
||||
use smb::auth::*;
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct SMBTransactionSessionSetup {
|
||||
pub request_host: Option<SessionSetupRequest>,
|
||||
pub response_host: Option<SessionSetupResponse>,
|
||||
pub ntlmssp: Option<NtlmsspData>,
|
||||
pub krb_ticket: Option<Kerberos5Ticket>,
|
||||
}
|
||||
|
||||
impl SMBTransactionSessionSetup {
|
||||
pub fn new() -> SMBTransactionSessionSetup {
|
||||
return SMBTransactionSessionSetup {
|
||||
request_host: None,
|
||||
response_host: None,
|
||||
ntlmssp: None,
|
||||
krb_ticket: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl SMBState {
|
||||
pub fn new_sessionsetup_tx(&mut self, hdr: SMBCommonHdr)
|
||||
-> (&mut SMBTransaction)
|
||||
{
|
||||
let mut tx = self.new_tx();
|
||||
|
||||
tx.hdr = hdr;
|
||||
tx.type_data = Some(SMBTransactionTypeData::SESSIONSETUP(
|
||||
SMBTransactionSessionSetup::new()));
|
||||
tx.request_done = true;
|
||||
tx.response_done = self.tc_trunc; // no response expected if tc is truncated
|
||||
|
||||
SCLogDebug!("SMB: TX SESSIONSETUP created: ID {}", tx.id);
|
||||
self.transactions.push(tx);
|
||||
let tx_ref = self.transactions.last_mut();
|
||||
return tx_ref.unwrap();
|
||||
}
|
||||
|
||||
pub fn get_sessionsetup_tx(&mut self, hdr: SMBCommonHdr)
|
||||
-> Option<&mut SMBTransaction>
|
||||
{
|
||||
for tx in &mut self.transactions {
|
||||
let hit = tx.hdr == hdr && match tx.type_data {
|
||||
Some(SMBTransactionTypeData::SESSIONSETUP(_)) => { true },
|
||||
_ => { false },
|
||||
};
|
||||
if hit {
|
||||
return Some(tx);
|
||||
}
|
||||
}
|
||||
return None;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,234 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
use nom::{IResult, ErrorKind};
|
||||
|
||||
use log::*;
|
||||
|
||||
use smb::smb1_records::*;
|
||||
use smb::smb::*;
|
||||
use smb::events::*;
|
||||
use smb::auth::*;
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct SessionSetupRequest {
|
||||
pub native_os: Vec<u8>,
|
||||
pub native_lm: Vec<u8>,
|
||||
pub primary_domain: Vec<u8>,
|
||||
}
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct SessionSetupResponse {
|
||||
pub native_os: Vec<u8>,
|
||||
pub native_lm: Vec<u8>,
|
||||
}
|
||||
|
||||
fn get_unicode_string(blob: &[u8]) -> IResult<&[u8], Vec<u8>>
|
||||
{
|
||||
SCLogDebug!("get_unicode_string: blob {} {:?}", blob.len(), blob);
|
||||
let mut name : Vec<u8> = Vec::new();
|
||||
let mut c = blob;
|
||||
while c.len() >= 1 {
|
||||
if c.len() == 1 && c[0] == 0 {
|
||||
let rem = &c[1..];
|
||||
SCLogDebug!("get_unicode_string: name {:?}", name);
|
||||
return IResult::Done(rem, name)
|
||||
} else if c.len() == 1 {
|
||||
break;
|
||||
} else if c[0] == 0 && c[1] == 0 {
|
||||
let rem = &c[2..];
|
||||
SCLogDebug!("get_unicode_string: name {:?}", name);
|
||||
return IResult::Done(rem, name)
|
||||
}
|
||||
name.push(c[0]);
|
||||
c = &c[2..];
|
||||
//SCLogNotice!("get_unicode_string: c {:?}", c);
|
||||
}
|
||||
IResult::Error(error_code!(ErrorKind::Custom(130)))
|
||||
}
|
||||
|
||||
named!(pub get_nullterm_string<Vec<u8>>,
|
||||
do_parse!(
|
||||
s: take_until_and_consume!("\x00")
|
||||
>> ( s.to_vec() )
|
||||
));
|
||||
|
||||
pub fn smb1_session_setup_request_host_info(r: &SmbRecord, blob: &[u8]) -> SessionSetupRequest
|
||||
{
|
||||
if blob.len() > 1 && r.flags2 & 0x8000_u16 != 0 {
|
||||
let offset = r.data.len() - blob.len();
|
||||
let blob = if offset % 2 == 1 { &blob[1..] } else { blob };
|
||||
let (native_os, native_lm, primary_domain) = match get_unicode_string(blob) {
|
||||
IResult::Done(rem, n1) => {
|
||||
match get_unicode_string(rem) {
|
||||
IResult::Done(rem, n2) => {
|
||||
match get_unicode_string(rem) {
|
||||
IResult::Done(_, n3) => { (n1, n2, n3) },
|
||||
_ => { (n1, n2, Vec::new()) },
|
||||
}
|
||||
},
|
||||
_ => { (n1, Vec::new(), Vec::new()) },
|
||||
}
|
||||
},
|
||||
_ => { (Vec::new(), Vec::new(), Vec::new()) },
|
||||
};
|
||||
|
||||
SCLogDebug!("name1 {:?} name2 {:?} name3 {:?}", native_os,native_lm,primary_domain);
|
||||
SessionSetupRequest {
|
||||
native_os:native_os,
|
||||
native_lm:native_lm,
|
||||
primary_domain:primary_domain,
|
||||
}
|
||||
} else {
|
||||
let (native_os, native_lm, primary_domain) = match get_nullterm_string(blob) {
|
||||
IResult::Done(rem, n1) => {
|
||||
match get_nullterm_string(rem) {
|
||||
IResult::Done(rem, n2) => {
|
||||
match get_nullterm_string(rem) {
|
||||
IResult::Done(_, n3) => { (n1, n2, n3) },
|
||||
_ => { (n1, n2, Vec::new()) },
|
||||
}
|
||||
},
|
||||
_ => { (n1, Vec::new(), Vec::new()) },
|
||||
}
|
||||
},
|
||||
_ => { (Vec::new(), Vec::new(), Vec::new()) },
|
||||
};
|
||||
|
||||
SCLogDebug!("session_setup_request_host_info: not unicode");
|
||||
SessionSetupRequest {
|
||||
native_os: native_os,
|
||||
native_lm: native_lm,
|
||||
primary_domain: primary_domain,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn smb1_session_setup_response_host_info(r: &SmbRecord, blob: &[u8]) -> SessionSetupResponse
|
||||
{
|
||||
if blob.len() > 1 && r.flags2 & 0x8000_u16 != 0 {
|
||||
let offset = r.data.len() - blob.len();
|
||||
let blob = if offset % 2 == 1 { &blob[1..] } else { blob };
|
||||
let (native_os, native_lm) = match get_unicode_string(blob) {
|
||||
IResult::Done(rem, n1) => {
|
||||
match get_unicode_string(rem) {
|
||||
IResult::Done(_, n2) => {
|
||||
(n1, n2)
|
||||
},
|
||||
_ => { (n1, Vec::new()) },
|
||||
}
|
||||
},
|
||||
_ => { (Vec::new(), Vec::new()) },
|
||||
};
|
||||
|
||||
SCLogDebug!("name1 {:?} name2 {:?}", native_os,native_lm);
|
||||
SessionSetupResponse {
|
||||
native_os:native_os,
|
||||
native_lm:native_lm,
|
||||
}
|
||||
} else {
|
||||
SCLogDebug!("session_setup_response_host_info: not unicode");
|
||||
let (native_os, native_lm) = match get_nullterm_string(blob) {
|
||||
IResult::Done(rem, n1) => {
|
||||
match get_nullterm_string(rem) {
|
||||
IResult::Done(_, n2) => {
|
||||
(n1, n2)
|
||||
},
|
||||
_ => { (n1, Vec::new()) },
|
||||
}
|
||||
},
|
||||
_ => { (Vec::new(), Vec::new()) },
|
||||
};
|
||||
SessionSetupResponse {
|
||||
native_os: native_os,
|
||||
native_lm: native_lm,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn smb1_session_setup_request(state: &mut SMBState, r: &SmbRecord)
|
||||
{
|
||||
SCLogDebug!("SMB1_COMMAND_SESSION_SETUP_ANDX user_id {}", r.user_id);
|
||||
match parse_smb_setup_andx_record(r.data) {
|
||||
IResult::Done(rem, setup) => {
|
||||
let hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER);
|
||||
let tx = state.new_sessionsetup_tx(hdr);
|
||||
tx.vercmd.set_smb1_cmd(r.command);
|
||||
|
||||
if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
|
||||
match parse_secblob(setup.sec_blob) {
|
||||
Some(s) => {
|
||||
td.ntlmssp = s.ntlmssp;
|
||||
td.krb_ticket = s.krb;
|
||||
},
|
||||
None => { },
|
||||
}
|
||||
td.request_host = Some(smb1_session_setup_request_host_info(r, rem));
|
||||
}
|
||||
},
|
||||
_ => {
|
||||
// events.push(SMBEvent::MalformedData);
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
fn smb1_session_setup_update_tx(tx: &mut SMBTransaction, r: &SmbRecord)
|
||||
{
|
||||
match parse_smb_response_setup_andx_record(r.data) {
|
||||
IResult::Done(rem, _setup) => {
|
||||
if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
|
||||
td.response_host = Some(smb1_session_setup_response_host_info(r, rem));
|
||||
}
|
||||
},
|
||||
_ => {
|
||||
tx.set_event(SMBEvent::MalformedData);
|
||||
},
|
||||
}
|
||||
// update tx even if we can't parse the response
|
||||
tx.hdr = SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER); // to overwrite ssn_id 0
|
||||
tx.set_status(r.nt_status, r.is_dos_error);
|
||||
tx.response_done = true;
|
||||
}
|
||||
|
||||
pub fn smb1_session_setup_response(state: &mut SMBState, r: &SmbRecord)
|
||||
{
|
||||
// try exact match with session id already set (e.g. NTLMSSP AUTH phase)
|
||||
let found = r.ssn_id != 0 && match state.get_sessionsetup_tx(
|
||||
SMBCommonHdr::from1(r, SMBHDR_TYPE_HEADER))
|
||||
{
|
||||
Some(tx) => {
|
||||
smb1_session_setup_update_tx(tx, r);
|
||||
SCLogDebug!("smb1_session_setup_response: tx {:?}", tx);
|
||||
true
|
||||
},
|
||||
None => { false },
|
||||
};
|
||||
// otherwise try match with ssn id 0 (e.g. NTLMSSP_NEGOTIATE)
|
||||
if !found {
|
||||
match state.get_sessionsetup_tx(
|
||||
SMBCommonHdr::new(SMBHDR_TYPE_HEADER, 0, 0, r.multiplex_id as u64))
|
||||
{
|
||||
Some(tx) => {
|
||||
smb1_session_setup_update_tx(tx, r);
|
||||
SCLogDebug!("smb1_session_setup_response: tx {:?}", tx);
|
||||
},
|
||||
None => {
|
||||
SCLogNotice!("smb1_session_setup_response: tx not found for {:?}", r);
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,83 @@
|
||||
/* Copyright (C) 2018 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
use nom::{IResult};
|
||||
|
||||
use log::*;
|
||||
|
||||
use smb::smb2_records::*;
|
||||
use smb::smb::*;
|
||||
//use smb::events::*;
|
||||
use smb::auth::*;
|
||||
|
||||
pub fn smb2_session_setup_request(state: &mut SMBState, r: &Smb2Record)
|
||||
{
|
||||
SCLogDebug!("SMB2_COMMAND_SESSION_SETUP: r.data.len() {}", r.data.len());
|
||||
match parse_smb2_request_session_setup(r.data) {
|
||||
IResult::Done(_, setup) => {
|
||||
let hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER);
|
||||
let tx = state.new_sessionsetup_tx(hdr);
|
||||
tx.vercmd.set_smb2_cmd(r.command);
|
||||
|
||||
if let Some(SMBTransactionTypeData::SESSIONSETUP(ref mut td)) = tx.type_data {
|
||||
if let Some(s) = parse_secblob(setup.data) {
|
||||
td.ntlmssp = s.ntlmssp;
|
||||
td.krb_ticket = s.krb;
|
||||
}
|
||||
}
|
||||
},
|
||||
_ => {
|
||||
// events.push(SMBEvent::MalformedData);
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
fn smb2_session_setup_update_tx(tx: &mut SMBTransaction, r: &Smb2Record)
|
||||
{
|
||||
tx.hdr = SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER); // to overwrite ssn_id 0
|
||||
tx.set_status(r.nt_status, false);
|
||||
tx.response_done = true;
|
||||
}
|
||||
|
||||
pub fn smb2_session_setup_response(state: &mut SMBState, r: &Smb2Record)
|
||||
{
|
||||
// try exact match with session id already set (e.g. NTLMSSP AUTH phase)
|
||||
let found = r.session_id != 0 && match state.get_sessionsetup_tx(
|
||||
SMBCommonHdr::from2(r, SMBHDR_TYPE_HEADER))
|
||||
{
|
||||
Some(tx) => {
|
||||
smb2_session_setup_update_tx(tx, r);
|
||||
SCLogDebug!("smb2_session_setup_response: tx {:?}", tx);
|
||||
true
|
||||
},
|
||||
None => { false },
|
||||
};
|
||||
// otherwise try match with ssn id 0 (e.g. NTLMSSP_NEGOTIATE)
|
||||
if !found {
|
||||
match state.get_sessionsetup_tx(
|
||||
SMBCommonHdr::new(SMBHDR_TYPE_HEADER, 0, 0, r.message_id))
|
||||
{
|
||||
Some(tx) => {
|
||||
smb2_session_setup_update_tx(tx, r);
|
||||
SCLogDebug!("smb2_session_setup_response: tx {:?}", tx);
|
||||
},
|
||||
None => {
|
||||
SCLogNotice!("smb2_session_setup_response: tx not found for {:?}", r);
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue