From 382245b226851e27c421106b4d69f14b21ad8d3b Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Thu, 13 Jan 2022 11:28:54 +0100 Subject: [PATCH] detect/smb: add smb.ntlmssp_user keyword Feature #5411. --- rust/src/smb/detect.rs | 23 +++++++++ src/Makefile.am | 2 + src/detect-engine-register.c | 2 + src/detect-engine-register.h | 1 + src/detect-smb-ntlmssp.c | 90 ++++++++++++++++++++++++++++++++++++ src/detect-smb-ntlmssp.h | 29 ++++++++++++ 6 files changed, 147 insertions(+) create mode 100644 src/detect-smb-ntlmssp.c create mode 100644 src/detect-smb-ntlmssp.h diff --git a/rust/src/smb/detect.rs b/rust/src/smb/detect.rs index 97ab525d9f55..26b05d642042 100644 --- a/rust/src/smb/detect.rs +++ b/rust/src/smb/detect.rs @@ -170,3 +170,26 @@ pub extern "C" fn rs_smb_tx_get_dce_iface(state: &mut SMBState, } return 0; } + +#[no_mangle] +pub unsafe extern "C" fn rs_smb_tx_get_ntlmssp_user(tx: &mut SMBTransaction, + buffer: *mut *const u8, + buffer_len: *mut u32) + -> u8 +{ + match tx.type_data { + Some(SMBTransactionTypeData::SESSIONSETUP(ref x)) => { + if let Some(ref ntlmssp) = x.ntlmssp { + *buffer = ntlmssp.user.as_ptr(); + *buffer_len = ntlmssp.user.len() as u32; + return 1; + } + } + _ => { + } + } + + *buffer = ptr::null(); + *buffer_len = 0; + return 0; +} diff --git a/src/Makefile.am b/src/Makefile.am index e5a855486b17..83c2d640f55f 100755 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -291,6 +291,7 @@ noinst_HEADERS = \ detect-sip-stat-code.h \ detect-sip-stat-msg.h \ detect-sip-uri.h \ + detect-smb-ntlmssp.h \ detect-smb-share.h \ detect-snmp-community.h \ detect-snmp-pdu_type.h \ @@ -893,6 +894,7 @@ libsuricata_c_a_SOURCES = \ detect-sip-stat-code.c \ detect-sip-stat-msg.c \ detect-sip-uri.c \ + detect-smb-ntlmssp.c \ detect-smb-share.c \ detect-snmp-community.c \ detect-snmp-pdu_type.c \ diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c index ca1221ed7423..95ea173faf05 100644 --- a/src/detect-engine-register.c +++ b/src/detect-engine-register.c @@ -21,6 +21,7 @@ * \author Victor Julien */ +#include "detect-smb-ntlmssp.h" #include "suricata-common.h" #include "suricata.h" #include "detect.h" @@ -591,6 +592,7 @@ void SigTableSetup(void) DetectDceStubDataRegister(); DetectSmbNamedPipeRegister(); DetectSmbShareRegister(); + DetectSmbNtlmsspUserRegister(); DetectTlsRegister(); DetectTlsValidityRegister(); DetectTlsVersionRegister(); diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index 2918b1cca817..cfb892d97ffc 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -192,6 +192,7 @@ enum DetectKeywordId { DETECT_DCE_STUB_DATA, DETECT_SMB_NAMED_PIPE, DETECT_SMB_SHARE, + DETECT_SMB_NTLMSSP_USER, DETECT_ASN1, diff --git a/src/detect-smb-ntlmssp.c b/src/detect-smb-ntlmssp.c new file mode 100644 index 000000000000..a0afde89ae45 --- /dev/null +++ b/src/detect-smb-ntlmssp.c @@ -0,0 +1,90 @@ +/* Copyright (C) 2022 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Eric Leblond + * + */ + +#include "suricata-common.h" + +#include "detect.h" +#include "detect-parse.h" + +#include "detect-engine.h" +#include "detect-engine-mpm.h" +#include "detect-engine-state.h" +#include "detect-engine-prefilter.h" +#include "detect-engine-content-inspection.h" + +#include "detect-smb-ntlmssp.h" +#include "rust.h" + +#define BUFFER_NAME "smb_ntlmssp_user" +#define KEYWORD_NAME "smb.ntlmssp_user" +#define KEYWORD_ID DETECT_SMB_NTLMSSP_USER + +static int g_smb_nltmssp_user_buffer_id = 0; + +static int DetectSmbNtlmsspUserSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg) +{ + if (DetectBufferSetActiveList(s, g_smb_nltmssp_user_buffer_id) < 0) + return -1; + + if (DetectSignatureSetAppProto(s, ALPROTO_SMB) < 0) + return -1; + + return 0; +} + +static InspectionBuffer *GetNtlmsspUserData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv, + const int list_id) +{ + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + uint32_t b_len = 0; + const uint8_t *b = NULL; + + if (rs_smb_tx_get_ntlmssp_user(txv, &b, &b_len) != 1) + return NULL; + if (b == NULL || b_len == 0) + return NULL; + + InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + return buffer; +} + +void DetectSmbNtlmsspUserRegister(void) +{ + sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME; + sigmatch_table[KEYWORD_ID].Setup = DetectSmbNtlmsspUserSetup; + sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER; + sigmatch_table[KEYWORD_ID].desc = "sticky buffer to match on SMB ntlmssp user in session setup"; + + DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, + GetNtlmsspUserData, ALPROTO_SMB, 1); + + DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_SMB, SIG_FLAG_TOSERVER, 0, + DetectEngineInspectBufferGeneric, GetNtlmsspUserData); + + g_smb_nltmssp_user_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); +} diff --git a/src/detect-smb-ntlmssp.h b/src/detect-smb-ntlmssp.h new file mode 100644 index 000000000000..054f0ae9be87 --- /dev/null +++ b/src/detect-smb-ntlmssp.h @@ -0,0 +1,29 @@ +/* Copyright (C) 2022 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \file + * + * \author Eric Leblond + */ + +#ifndef __DETECT_SMB_NTLMSSP_H__ +#define __DETECT_SMB_NTLMSSP_H__ + +void DetectSmbNtlmsspUserRegister(void); + +#endif /* __DETECT_SMB_NTLMSSP_H__ */