Changeset 1241

Timestamp:

04/26/07 17:37:01 (1 year ago)

Author:

till

Message:

aSaveFile also takes care for storing malware on disc now

Files:

• honeytrap/trunk/configure.in (modified) (1 diff)
• honeytrap/trunk/src/modules/htm_aSaveFile.c (modified) (3 diffs)
• honeytrap/trunk/src/modules/htm_aSaveFile.h (modified) (1 diff)
• honeytrap/trunk/src/modules/htm_aSavePostgres.c (modified) (3 diffs)
• honeytrap/trunk/src/modules/htm_ftpDownload.c (modified) (2 diffs)

honeytrap/trunk/configure.in

@@ -447 +447 @@
-if test $with_ipq_mon != "yes" -a $with_nfq_mon != "yes" -a $with_ipfw_mon != "yes" -a $with_pcap_mon != "yes"; then
-  echo
-
+, --with-nfq-mon 
-  echo
-  exit 1

honeytrap/trunk/src/modules/htm_aSaveFile.c

@@ -1 +1 @@
-/* htm_aSaveFile.c
-
+-2007
- *
- * This file is free software; as a special exception the author gives
@@ -14 +14 @@
- *   This honeytrap module dumps incoming traffic from incoming
- *   connections to a file.
+ *   Also, all malware/sample entries attached to an attack record
+ *   are dumped into a download directory.
- */
-
@@ -112 +114 @@
-
-        /* save malware */
-1; i<=
+0; i<
-                /* save file */
-                /* we need the length of directory + "/" + filename plus md5 checksum */
-                mwfilename = (char *) malloc(strlen(dlsave_dir)+strlen(filename)+35);
-mwfilename) + 
-mw
+filename)+
+attack->download[i].
-                logmsg(LOG_DEBUG, 1, "Malware sample dump - File name is %s\n", mwfilename);
-                if (((dumpfile_fd = open(mwfilename, O_WRONLY | O_CREAT | O_EXCL)) < 0) ||

honeytrap/trunk/src/modules/htm_aSaveFile.h

@@ -19 +19 @@
-
-const char module_name[]="htm_aSaveFile";
-1.2
+2.0
-
-void plugin_init(void);

honeytrap/trunk/src/modules/htm_aSavePostgres.c

@@ -156 +156 @@
-                        return(-1);
-                }
+
+                /* check if sample already exists */
-                memset(query, 0, MAX_SQL_BUFFER + 1);
+                if (snprintf(query, MAX_SQL_BUFFER, "SELECT malware.sensor_exists_sample('%s')", 
+                        mem_sha512sum(attack->download->dl_payload.data, attack->download->dl_payload.size)) >= MAX_SQL_BUFFER) {
+                        logmsg(LOG_ERR, 1, "Postgres client error - Could not check if sample exists: SQL query exceeds maximum size (increase MAX_SQL_BUFFER and recompile).\n");
+                        free(query);
+                        return(-1);
+                }
+
+/*
+                if (PQresultStatus(res = PQexec(db_connection, query)) != PGRES_TUPLES_OK) {
+                        printf("---> malware exists.\n");
+                } else printf("---> malware does not exist.\n");
+                        logmsg(LOG_ERR, 1, "Postgres client error - Malware submission failed: %s.\n", PQerrorMessage(db_connection));
+                        PQclear(res);
+                        db_disconnect();
+                        free(query);
+                        return(-1);
+                }
+*/
-
-                /* escape byte data to prevent sql injection */
@@ -180 +200 @@
-                        return(-1);
-                }
+                memset(query, 0, MAX_SQL_BUFFER + 1);
-                if (snprintf(query, MAX_SQL_BUFFER, "SELECT attacks.sensor_honeytrap_add_sample('%s', '%s', '%s', '%s', '%s', '%s', %d, %d, '%s')",
-                        mem_sha512sum(attack->download->dl_payload.data, attack->download->dl_payload.size),
@@ -190 +211 @@
-                        attack->download->r_port,
-                        esc_bytea) >= MAX_SQL_BUFFER) {
-attack
-       
-       
-       
-       
+malware
+
+
+
+
-                free(uri);
-

honeytrap/trunk/src/modules/htm_ftpDownload.c

@@ -259 +259 @@
-                uint16_t first_half:8, second_half:8;
-        } ftp_port;
-, *dumpfile_name
+
-        struct timeval r_timeout;
-        fd_set rfds;
@@ -568 +568 @@
-                logmsg(LOG_NOISY, 1, "FTP download - Successfully downloaded %s.\n", save_file);
-                ftp_quit(control_sock_fd, data_sock_fd, dumpfile_fd);
-
+
+
-                if(total_bytes) {
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-                        add_download("ftp", 6, rhost->s_addr, port, user, pass, (const char *) save_file, binary_stream, total_bytes, attack);
-
-save
+attached to attack recor
-                } else logmsg(LOG_NOISY, 1, "FTP download - No data received.\n");
-