Changeset 440

Show
Ignore:
Timestamp:
03/27/06 20:35:31 (3 years ago)
Author:
common
Message:

Makefile.am
- copy the shellcode-signatures.sc file to /cache/nepenthes/signatures on make install

shellcode-signatures
- load signatures from /cache/nepenthes/signatures/shellcode-signatures.sc instead of /tmp/
- removed some debug printf that flooded the console on startup with the pcre patterns

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • nepenthes/trunk/Makefile.am

    r380 r440  
    5050        $(mkinstalldirs) $(DESTDIR)$(localstatedir)/cache/nepenthes 
    5151        $(mkinstalldirs) $(DESTDIR)$(localstatedir)/cache/nepenthes/geolocation 
     52        $(mkinstalldirs) $(DESTDIR)$(localstatedir)/cache/nepenthes/signatures 
     53 
     54        $(INSTALL_DATA) modules/shellcode-signatures/shellcode-signatures.sc $(DESTDIR)$(localstatedir)/cache/nepenthes/signatures 
     55         
    5256        $(mkinstalldirs) $(DESTDIR)$(localstatedir)/spool 
    5357        $(mkinstalldirs) $(DESTDIR)$(localstatedir)/spool/nepenthes 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_base64.cpp

    r436 r440  
    7979        } 
    8080 
    81       printf("%s\n",m_Shellcode->pattern); 
     81//    printf("%s\n",m_Shellcode->pattern); 
    8282//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    8383        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_bindfiletransfer.cpp

    r433 r440  
    8282        } 
    8383 
    84       printf("%s\n",m_Shellcode->pattern); 
     84//    printf("%s\n",m_Shellcode->pattern); 
    8585//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    8686        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_bindshell.cpp

    r430 r440  
    8080        } 
    8181 
    82       printf("%s\n",m_Shellcode->pattern); 
     82//    printf("%s\n",m_Shellcode->pattern); 
    8383//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    8484        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_connectbackfiletransfer.cpp

    r432 r440  
    8282        } 
    8383 
    84       printf("%s\n",m_Shellcode->pattern); 
     84//    printf("%s\n",m_Shellcode->pattern); 
    8585//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    8686        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_connectbackshell.cpp

    r430 r440  
    8282        } 
    8383 
    84       printf("%s\n",m_Shellcode->pattern); 
     84//    printf("%s\n",m_Shellcode->pattern); 
    8585//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    8686        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_execute.cpp

    r429 r440  
    7777        } 
    7878 
    79       printf("%s\n",m_Shellcode->pattern); 
     79//    printf("%s\n",m_Shellcode->pattern); 
    8080//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    8181        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_konstanzxor.cpp

    r436 r440  
    7474        } 
    7575 
    76       printf("%s\n",m_Shellcode->pattern); 
     76//    printf("%s\n",m_Shellcode->pattern); 
    7777//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    7878        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_linkxor.cpp

    r432 r440  
    7474        } 
    7575 
    76       printf("%s\n",m_Shellcode->pattern); 
     76//    printf("%s\n",m_Shellcode->pattern); 
    7777//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    7878        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_url.cpp

    r429 r440  
    7979        } 
    8080 
    81       printf("%s\n",m_Shellcode->pattern); 
     81//    printf("%s\n",m_Shellcode->pattern); 
    8282//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    8383        return true; 

  • nepenthes/trunk/modules/shellcode-signatures/sch_namespace_xor.cpp

    r430 r440  
    7474        } 
    7575 
    76       printf("%s\n",m_Shellcode->pattern); 
     76//    printf("%s\n",m_Shellcode->pattern); 
    7777//      g_Nepenthes->getUtilities()->hexdump((byte *)m_Shellcode->pattern,m_Shellcode->pattern_size); 
    7878        return true; 
    …… 
    240240                                logWarn("codeSize*4 (%i) > postSize (%i), maybe broken xor?\n",codeSize*4,postSize); 
    241241 
    242                         for ( uint32_t j = 0; j < codeSize && (j)*4 < postSize; j++ ) 
     242                        for ( uint32_t j = 0; j < codeSize && (j+1)*4 < postSize; j++ ) 
    243243                                *(uint32_t *)(decodedMessage+(j*4) ) ^= intKey; 
    244244                        break; 

  • nepenthes/trunk/modules/shellcode-signatures/shellcode-signatures.cpp

    r436 r440  
    8989 
    9090g_Nepenthes->getShellcodeMgr()->registerShellcodeHandler(new EngineUnicode()); 
    91         return loadSignaturesFromFile(string("/tmp/shellcode-signatures.sc")); 
     91        return loadSignaturesFromFile(string("var/cache/nepenthes/signatures/shellcode-signatures.sc")); 
    9292} 
    9393 
    …… 
    109109bool SignatureShellcodeHandler::loadSignaturesFromFile(string path) 
    110110{ 
    111  
     111        logInfo("Loading signatures from file %s\n",path.c_str()); 
    112112        sc_shellcode *sc,*sc_free; 
    113113        bool load_success = true;