Changeset 1580

Timestamp:

02/28/08 22:57:06 (6 months ago)

Author:

till

Message:

honeytrap
- working submit-mwserv module

Files:

• honeytrap/trunk/src/logging.h (modified) (1 diff)
• honeytrap/trunk/src/modules/htm_submitMWserv.c (modified) (10 diffs)

honeytrap/trunk/src/logging.h

@@ -42 +42 @@
-*/
-
-256
+4069
-
-#define DEBUG_FPRINTF   if (log_level == LOG_DEBUG) fprintf

honeytrap/trunk/src/modules/htm_submitMWserv.c

@@ -15 +15 @@
- */
- 
-#define C(); { printf("%s:%u\n", __PRETTY_FUNCTION__, __LINE__); fflush(stdout); }
- 
-
-#define _GNU_SOURCE 1
@@ -43 +41 @@
-#include <plughook.h>
-#include <readconf.h>
+#include <sha512.h>
-#include <signals.h>
-#include <tcpip.h>
@@ -145 +144 @@
-        logmsg(LOG_DEBUG, 1, "SavePostgres - Building generic malware resource URI.\n");
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -181 +190 @@
-        switch(response_code(response)) {
-        case TSS_OK:
-                C();
-                logmsg(LOG_NOISY, 1, "SubmitMWServ - Server returned transfer status OK.\n");
-                return(TSS_OK);
-        case TSS_UNKNOWN:
-                C();
-                logmsg(LOG_WARN, 1, "SubmitMWServ - Server returned status UNKNOWN.\n");
-                return(TSS_UNKNOWN);
@@ -258 +265 @@
-                                                if(message->data.result)
-                                                {
-
+HTTP failure: 
-                                                        return TSS_ERROR;
-                                                }
@@ -273 +280 @@
-
-struct curl_httppost *init_handle(CURLM **multihandle, CURL **curlhandle,
-u_char *data, const u_int32_t len
+Attack *attack, const struct s_download *download
-                const char* uri, const bstr *response, const u_char type) {
-
-
+, rv
-        struct curl_httppost    *pinfo;
-        struct curl_httppost    *pinfo_last;
+        char                    saddr[16], daddr[16], sport[6], dport[6];
+
+
+        if (type != ST_HASHTEST && type != ST_SUBMIT) return(NULL);
+        if (!download) return(NULL);
-
-        pinfo = pinfo_last = NULL;
+        memset(saddr, 0, 16);
+        memset(daddr, 0, 16);
+        memset(sport, 0, 6);
+        memset(dport, 0, 6);
-
-        logmsg(LOG_DEBUG, 1, "SubmitMWServ - Creating easy handle.\n");
@@ -291 +307 @@
-        logmsg(LOG_NOISY, 1, "SubmitMWServ - Constructing HTTP form for request type %d.\n", type);
-        
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        if (uri) {
-i
+l
-                        CURLFORM_PTRCONTENTS, uri, CURLFORM_CONTENTSLENGTH, strlen(uri), CURLFORM_END);
-        }
-        
-
-
-
-
+
+
+
+
+
-
-        // attack: cli:port->srv:port, mode
@@ -351 +392 @@
-        /* save malware */
-        for (i=0; i<attack->dl_count; i++) {
+                if (!attack->download[i].dl_payload.sha512sum) continue;
+
-                // test hash
-                logmsg(LOG_INFO, 1, "SubmitMWServ - Checking SHA512 hash at %s.\n", mwserv_url);
-                memset(&response, 0, sizeof(bstr));
-
+
-                if (build_uri(&uri, attack->download[i]) == -1) {
-                        logmsg(LOG_ERR, 1, "SubmitMWServ Error - Unable to create URI: %m.\n");
@@ -360 +403 @@
-                }
-                
-
-
-
+
+
-                        free(response.data);
-                        return(0);
@@ -390 +432 @@
-                memset(&response, 0, sizeof(bstr));
-                
-
-
-
+
+
-                        free(uri);
-                        free(response.data);