Changeset 5

Show
Ignore:
Timestamp:
05/12/05 00:36:25 (4 years ago)
Author:
oxff
Message:

added binary upload detection for bagle
(downloading still unimplemented, but now `protects' libcurl)

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • mwcollect2/trunk/src/vuln-bagle/bagle.cpp

    r1 r5  
    102102{ 
    103103        { // parse signatures 
     104          // this is obsolete now, since we differnciate between signature and data on packet level (most mw supports this) 
     105           
    104106                signature_t signCurrent; 
    105107                char * szConfPath;; 
    …… 
    208210                return; 
    209211 
    210         if(pState->fMagicSent /* && pState->fMatch */) 
     212        if(pState->fMagicSent) 
    211213        { 
    212214                char * szUrl = (char *) malloc(nPacketLength + 1); 
    …… 
    222224                                break; 
    223225                        } 
    224  
    225                 pState->pLogManager->log(LL_INFO, "Successful bagle session, fetch \"%s\".", szUrl); 
    226                 pState->pFetchDispatcher->fetchFile(szUrl); 
    227  
    228                 free(szUrl); 
    229  
    230                 pState->fDone = true; 
    231                 pState->pNetworking->closeSocket(iHandle);               
     226                         
     227                if(strncmp(szUrl, "http", 4) || strncmp(szUrl, "ftp", 3) || strncmp(szUrl, "https", 5)) 
     228                { 
     229                        pState->pLogManager->log(LL_INFO, "Detected binary Bagle upload (unimplemented)."); 
     230                } 
     231                else 
     232                { 
     233                        pState->pLogManager->log(LL_INFO, "Successful bagle session, fetch \"%s\".", szUrl); 
     234                        pState->pFetchDispatcher->fetchFile(szUrl); 
     235 
     236                        free(szUrl); 
     237 
     238                        pState->fDone = true; 
     239                        pState->pNetworking->closeSocket(iHandle); 
     240                } 
    232241        } 
    233242        else