Changeset 1120
- Timestamp:
- 01/24/07 23:51:38 (2 years ago)
- Files:
-
- honeytrap/trunk/src/attack.c (modified) (3 diffs)
- honeytrap/trunk/src/modules/htm_ftpDownload.c (modified) (3 diffs)
- honeytrap/trunk/src/modules/htm_ftpDownload.h (modified) (1 diff)
- honeytrap/trunk/src/proxy.c (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
honeytrap/trunk/src/attack.c
r1117 r1120 41 41 42 42 /* store attack connection data in attack record */ 43 a->a_conn.l_addr = l_addr;44 a->a_conn.r_addr = r_addr;43 memcpy(&(a->a_conn.l_addr), &l_addr, sizeof(uint32_t)); 44 memcpy(&(a->a_conn.r_addr), &r_addr, sizeof(uint32_t)); 45 45 a->a_conn.l_port = l_port; 46 46 a->a_conn.r_port = r_port; … … 55 55 /* process attack - call plugins registered for hook 'process_attack' */ 56 56 int process_data(u_char *a_data, uint32_t a_size, u_char *p_data, uint32_t p_size, uint16_t port, Attack *a) { 57 struct in_addr *addr = NULL; 57 58 58 59 if (a == NULL) { … … 84 85 85 86 if (!a_size) { 87 addr = (struct in_addr *) &(a->a_conn.r_addr); 86 88 logmsg(LOG_NOTICE, 1, " * %u\t No bytes received from %s:%u.\n", 87 (uint16_t) a->a_conn.l_port, inet_ntoa( a->a_conn.r_addr), a->a_conn.r_port);89 (uint16_t) a->a_conn.l_port, inet_ntoa(*addr), a->a_conn.r_port); 88 90 } else { 91 addr = (struct in_addr *) &(a->a_conn.r_addr); 89 92 logmsg(LOG_NOTICE, 1, " * %u\t %d bytes attack string from %s:%u.\n", 90 (uint16_t) a->a_conn.l_port, a_size, inet_ntoa( a->a_conn.r_addr), a->a_conn.r_port);93 (uint16_t) a->a_conn.l_port, a_size, inet_ntoa(*addr), a->a_conn.r_port); 91 94 } 92 95 honeytrap/trunk/src/modules/htm_ftpDownload.c
r1119 r1120 55 55 int i=0; 56 56 char *string_for_processing; 57 struct in_addr *addr = NULL; 57 58 58 59 logmsg(LOG_DEBUG, 1, "Parsing attack string (%d bytes) for ftp commands.\n", attack->a_conn.payload.size); … … 68 69 69 70 /* do ftp download */ 70 return(get_ftpcmd(string_for_processing, attack->a_conn.payload.size, (struct in_addr) attack->a_conn.l_addr)); 71 addr = (struct in_addr *) &(attack->a_conn.l_addr); 72 return(get_ftpcmd(string_for_processing, attack->a_conn.payload.size, *addr)); 71 73 } 72 74 } … … 75 77 } 76 78 77 int get_ftpcmd(char *attack_string, int string_size, struct in_addr lhost) {79 int get_ftpcmd(char *attack_string, uint32_t string_size, struct in_addr lhost) { 78 80 char *parse_string=NULL, port[6], *user=NULL, *pass=NULL, *file=NULL; 79 81 struct hostent *host=NULL; honeytrap/trunk/src/modules/htm_ftpDownload.h
r1105 r1120 28 28 int ftp_quit(int control_sock_fd, int data_sock_fd, int dumpfile_fd); 29 29 int get_ftp_ressource(const char *user, const char* pass, struct in_addr *lhost, struct in_addr *rhost, const int port, const char *save_file); 30 int get_ftpcmd(char *attack_string, int string_size, struct in_addr lhost);30 int get_ftpcmd(char *attack_string, uint32_t string_size, struct in_addr lhost); 31 31 32 32 #endif honeytrap/trunk/src/proxy.c
r1117 r1120 158 158 return(-1); 159 159 } 160 } else if (proto == UDP) { 161 fprintf(stdout, "---> connecting.\n"); 162 if ((retval = connect(proxy_sock_fd, (struct sockaddr *) &proxy_socket, sizeof(proxy_socket))) <0) { 163 if (errno != EINPROGRESS) { 164 logmsg(LOG_DEBUG, 1, 165 "%s %u\t Error - Unable to establish mirror connection to %s:%d.\n", 166 logpre, l_port, inet_ntoa(ipaddr), port); 167 return(-1); 160 } else if (proto == UDP) { 161 if ((retval = connect(proxy_sock_fd, 162 (struct sockaddr *) &proxy_socket, sizeof(proxy_socket))) <0) { 163 if (errno != EINPROGRESS) { 164 logmsg(LOG_DEBUG, 1, 165 "%s %u\t Error - Unable to establish mirror connection to %s:%d.\n", 166 logpre, l_port, inet_ntoa(ipaddr), port); 167 return(-1); 168 } 168 169 } 169 170 } 170 fprintf(stdout, "---> connected.\n");171 }172 171 } 173 172 … … 178 177 return(-1); 179 178 } 180 attack->p_conn.l_addr = local_socket.sin_addr;181 attack->p_conn.r_addr = proxy_socket.sin_addr;179 memcpy(&(attack->p_conn.l_addr), &local_socket.sin_addr, sizeof(uint32_t)); 180 memcpy(&(attack->p_conn.r_addr), &proxy_socket.sin_addr, sizeof(uint32_t)); 182 181 attack->p_conn.l_port = local_socket.sin_port; 183 182 attack->p_conn.r_port = proxy_socket.sin_port; 184 183 } 185 //fprintf(stdout, "---> writing test pattern.\n");186 //write(proxy_sock_fd, "back\n", 5);187 //fprintf(stdout, "---> done.\n");188 184 return(proxy_sock_fd); 189 185 }
