Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Falco Base64 doesn't work #987

Closed
realgam3 opened this issue Dec 30, 2019 · 3 comments · Fixed by #1033
Closed

Falco Base64 doesn't work #987

realgam3 opened this issue Dec 30, 2019 · 3 comments · Fixed by #1033
Labels
kind/bug

Comments

@realgam3
Copy link

realgam3 commented Dec 30, 2019 •
edited
Loading

executing falco with -b doesn't work
after getting logs %evt.buffer is still dot escaped and not base64

Environment:
Falco version: 0.18.0
Docker Image: falcosecurity/falco
Docker CMD: /usr/bin/falco -A -b -S 10240

Log Output:
{"output":"2019-12-30T20:24:22.672367973+0000: Debug Untrusted file downloaded (user=www-data shell=curl parent=sh cmdline=curl http://xxxx.co.il/xxxx.jpg pcmdline=sh -c curl http://xxxx.co.il/xxxx.jpg gparent=apache2 ggparent=apache2 aname[4]=containerd-shim aname[5]=containerd aname[6]=systemd aname[7]=<NA> container_id=db332d9d4314 container_name=drupal_sandbox_drupal_1 image=drupal evt_buffer=HTTP/1.1 200 OK..Server: nginx/1.12.2..Date: Mon, 30 Dec 2019 20:18:33 GMT..Content-Type: image/jpeg..Content-Length: 33617..Last-Modified: Sat, 21 Apr 2018 19:53:52 GMT..Connection: keep-alive..ETag: \"5adb96d0-8351\"..Accept-Ranges: bytes..........JFIF..............Photoshop 3.0.8BIM.......g..(.bFBMD01000aa803000090120000a924000080270000302a000053360000724e000043520000ed5500005459000051830000.....ICC_PROFILE.......lcms....mntrRGB XYZ .........).9acspAPPL...................................-lcms................................................desc.......^cprt...\\....wtpt...h....bkpt...|....rXYZ........gXYZ........bXYZ........rTRC.......@gTRC.......@bTRC.......@desc........c2..................................................................................text....FB..XYZ ...............-XYZ ...........3....XYZ ......o...8.....XYZ ......b.........XYZ ......$.........curv...............c...k...?.Q.4!.).2.;.F.Qw].kpz....|.i.}...0.....C...........................\".##!. %*5-%'2( .?/279<<<$-BFA:F5;<9...C...........9& &99999999999999999999999999999999999999999999999999...........\"......................................................................................................................(R.'.J[.V.z.]..SN......-f......H.........................y..:}.\\..n..L...\".?c..G.KX....t+..~~....{.\\. ......................i.4.a.g..uY.jHd.-...<......v..j.v\"9.$......=1................E..g..0..zO..........y9i~..s.....j..\"}..........Mz}.t.{i...z.Q-...;rW...........5...0.....l......|_i.bc......|..(......~u-S.......Z......)fZ./Ib.).2.%g<>.k.y.zU.;...RhY...V..3:..........#..x>~....p{...........{.%.<..|.L.Y./........9..y...5.....i.X.........).Mw.nc5..J.|.f#.4rz.w....em.(..o....5......x.c..S.O.\\..=Ro......p{......by............x]..ZP...}...f......h.V....&t..&...../.z...OO.{..R.r.tIW7.S...l....../.=?........w........1..h{\\X.1..O..._Uj..........k1....\\J.-&...-.m.....;....w8.^=.s.fy%...\"'.9......<..........R.O.O3D..kf...h........7..7...K....?...5.H.......o>yLu...32......J.g.k.*...eo.....o....}K6..w.4'..\\....f..:q........|...|..f..w...........?F..+...f....{Q0.........Vz.9a..TL..X.I.mH..K.8...(_.1>3!.s.LZf..~wC.y-..|........`..JY\"hvy........ ......i...+.Y.......-R............\\...Jqa......nwj..'?..^.(.CM..w..J....Z......EM,I..~..o.F........#.1-.tOcM.;^.....G$.....5.y..&.mG.u.Yo.u...X$.}_._GG`H...kP...........U/V..c...o.....E.^3.!^....k^Cdv.......f..g]........9..=...t....^.X..[.v...S.....$.....U.?...J_...R..>._9..J.....p&.....g?.C..zvj.................LWM.|.X.M[xB.TX.J.X.V.........o.<....3.2..q2\\..M..C.|...j.....B..W...j.8.kE....>z...b...b^u..{.:......{.<.../Mh...M....ef.%..oVC.z>'U.j.SN...~.yiRm[.f-...7....c\\.r.......<TJ.5....g........\".c...Wm3..]r.....d\".....:7.1.C...o?S.i...w..iKV.^..m5..3.z..........n....M7.j.ZX...%.Z........&...k..i..NE..I....lM1>.ts..V....R^.X...I[...L.3...^].U.D..s....<.W.)R................^.....?/a=.p....-.....a...^.._8.GO<.../.....@...w.^.i.6.9....b.,..iaM........y...b..j..X...a....K...I....aY...4.:...v.1.)W......q6....n.K................E.+...o..z....$.t.>_O......3..[G.`......KyN.J._'..e.Z...b.z0s..m%.+.U.]..G..E..l...a.3...hI&sj0..a....G..,A5.0..cH...+............o.7.~.....Ue.l..I.[|..........+R.G..b.N.}d...........v....},.a.&.xL....j}G_ ..V..st..=6.X.)..m)gK...7.\".c.X....M5.)-.b.........q.....$..Yc8.....t.X..X.yt..g..&.>..hO..W..6.7?F.N....>....*.1.].;.............v..z.t#./...^.A......Y.....gU[k.J:}*..C.I...0....^..f..X.g-.....f6..1.q..G2.k9k..wk.u...........W(^.9.=b|..U.^..j......<}.....m..........z<../\\...6k.>.vq.....e.y9.s..D..K.X..O'?l.;....K].j..:e.QSM...:m&.]7.o.5.z0........a..; ..kvX'6g6..nWW..4..3J'.^...t..I.....~........y.W......M\".(.........>OS.....:+T...t-.;.s...|\"..)xq....\\D..T.}$D.mb.........7.q.dc84.xkm.KK...J.V-.3.....z...G0k..7g.g.s.?7Vs.\".W....a......./.xy.....uk..D...~...#\\@.F.N~...Z....y...z.Zm........c../....\".:K.<.m_Mc.{Z_........l..l........\\.]..6.z.k.3.p.:\\....7...{.....]$.M...1w.Q.........9...|...8...P...OzvG_...a.N^.......&..m...m..3.g..........vrG...M.......kh.....J....|...6.....4.s.q.Z.)...6j.|.mv..i.>...n/C;5..:.t............I%~N.{.%-.sG.......R......r.2...s...g\\.pT.|I.../^ZM.......7.y.y......2.&2.l.<.......<...d..........T.A5:....u......3.0u,sz]|..t9Ym.....E....|.............r=.....b..u.]....K..5....o...c.DG..q...R.....~wL...;....C3...';t.........:y..k.z.....ut.|....{.?S...|b..~......'u...Y....0...Ri....zh...Y.Z;]....B.........{/+...B.7U.k.5.|..b/,..5.h...~,.t|.....?....._.z.7...E...m...h..<N/w..'..rK../U4...WxzH...L.r)yi...].....+.G...vx&.Y6.tg].c}...M...{D.....].............Y.Wy.9;.MVhK...n....M#.$..uy7.~......3.VDy7h6.x$F$F%k.,`.r<..c&......uy]yW....e.......ln.].1...]3...%..=....\\..@........q....}Yj..k;A\"6.M.c.CHf.j....r....zx...).W.|.fQ....X6....j.&..3..g&3...+.m.=.H.3{......y....m.4.BGJKZ..:.O.H.......#....g.....?].+.KX.1.`....i.......r:..1...m66c#.....l..c..j..r...#......A./..c...t........]tFjoV.....o.(k..........uyu...V.7e.b...\\...b.....Lz..'.....8.X..D..d.0.g.3..g.....q.d...q.k.....j`.x_w.1......8...b(e...../k..-P......./........................... !\"012.@#A.3$4BP`...............Q.%....Lg.O.H......c.`.......4!@......84...+em....f.X.k4Ls..&..@..Z.....a.L.eNP.h.......A..Zz.e.G.LM7Z\".*t5>....f.;Mf..A..%.K...:..s.%....#m*u...;C<{...]b.y..l-....a...~N.B6..Jl...Yuu........`...........A>b.....-s.J.OaQ.1.....p4j.......B.......imVao../...b.R.Zv%.L.f..O.n..4..&...m4.L.%gx...[..w.}...\"..u......\".W r.N..cm... ...i.$..X99.jG..2..X....OI.[k.........X..*.....S.....\".j>.y]'.....Xw..V|....A.&/...i...Im....D.<W...g..........f3.#.Q.q..<.r...TW.|F.....i...../....@<*..... ..,>H.u.DM9..\\..KN..,T;#....~...[...w..pT.o..:..Q7Qo........m.j.....TC...O..k...6.^fk.b.%.p............E.je.l....d.Rx.U....(.......~8..o......4......Y>W.X.WIc.Z......!...a...|...S..f..._.....c.U.d...{.....1q.....;:Y>.]*JS.@.3k......0.X(..-...q.....ce...y...%....!..WH.*.....V..L%...15>.....t>,.6..=.[hrI....fE.E......i.Iu....ej+.yU.-1..+.e?e...:.....W.gQ...u+J.....?.q...K.?<..i.....<.%..7........Yf..Vc..W..jS..Z...To..?.%).../n....w..e....x.k@....pkzy...J.j&.X.....i..Zf\\.*..Ll....1.c..[2....bd.'..[..[T........a,.<1?K-:...~4.I.b...].~.,.MO..|..!4.....c.\"a..*j.F0..&..!......c,..v.1...+>....u\\...V.+.......\".3#.lp.p.z.~...g..Y....t.E.Gp#..j.....O..i......C..........8.F.U=B....LJ.......W..xOU......t%}K.i..u.i.0.........g..P..L&/...:.mJ}.C.Y....q1...p.....[..[u..O....f..s..B...V.m...u.....`..i..ow#.}..#......'..@.I..L....Y...^......mm.p.t..c...[l..*.~....0........!,...u........./).fh..c....%...V....#sT.....-...U..i......h ...r...l....k......-9....7/..>[..........r.T.,S.}.5..U.Vc.#y..a..!:.._R.,..2......s.x6.._..9UX..2.....Lz.+.........?.NU..k.~>2mY.b`..j..glK.Wk.O.a..O>..3^%.p..C...........:B.Z......O..5.f.s..C.j.(@...V.t..~-.~...../.].Wf;,....j........e...i.`..F...u2=.2.....Z...(.pT<...6{L7......I...H.\".U.z.....tD.t....\"..K...dc..M%...\".....,se....}.).&...}.,110j...g.c..9:`.w[UBx%.6r+.....}.57.........'...ho.T.:K-[U?._1...v.4......K...O..d...J....'.]{o..,\\-..!_&.......5.-..o..cV(.WHY.WJ.......?....../M.Y.c.c.!.F[......F...qL1.q....b6.k..2-...u...o.....w........p.`..{..E..l.x.8......9e..k.O...<N...Q.......jJO...f..b4..@5.......;k,o.&R...l..A+..[A..MA.s_e.%...C.T..l.....f..m.....E#.....!.&....wd..A......c..........c.c.....o....._...........1:....,....Tr.A...i<....wq..z.]..~....%l...fVN...tQ.I]...iK.....sd5.k.g.. S...5......b.9..........e.I.tI...7..J.%....@$..i>...I. ..U|v.......E+U.[......v.y.J..i..8.g.M............NVD.....'...km..S6..G._....A.=.u.E.3p..._#.#..H+.......5<.....q.>^..)6.... X~@..A.o....<..,........ym.K1.N.7Iu.........j...Q.-.IZ..<..|\\O.....3BcM&...^c*../C$6.....Ue/.._......y.9-......eP...4.E..~B.4.M&......N.....i....u.8q6.2.......... .G.S....... j?.c....a<....1...f.'.V.\\....%.%.M)H....1b....i.g.r.i4.Mu.i.N.?..v...b.<....].....2.o....3\"......fi..U.H<....Xr2W.......L..[.<).L.M8..:....;F...s]{..;.......Y..i4...`..4...w.J|.....4............-`L.P...v....}.1..mXK....c+..A...x...QF.!.n.\".u.?.......h.t...{.k5+5.Q./.......^.!K[...05\\..L.^..........m.v.....b....cXq.l....C,X.&a......E.v....H..........Em|..K...\"..`..J...:6.>U..*N...54..j.J........Oi.L.+}k...O.hJ{.......u(.X..D2.U.F6....EX.......N...t..8..N......u.N.4.S.. ..~....y.U...nV;,RZ\".....L.eh.=....Q..cL?...|.....r...I.o.|..i.k..n.t.5t...n.....{g.oM..9.Q.oq.<..._..A.....0...i.a..PLs,.@.. ._..-...(....>.b...w56.I.........Nm7y.V=<.{......_d..1....X......h...&A...........f#k_m.Nl%.l... 4.G-..M&.....gP&....&Xe.X{.....F.>.T.4.H.Z6....m.v....7&..........t.....y.U...$..........:....CkLo....^...\\.r....u..r.......v].....9....~3....g..D.DR...1..2..2.....J.;3.W..1..4.W..5....c6..9......{....:o.i....01.K...............lv..[..J.....F....fc6......|W..2.....hf.4.^.&w.F ./L...m.Y..v.S.....f9.....6...9...w/+O.....L.d_..EOewF....@t9....ac.[.m.........;d...k.. ..........#.\\......M.~.p..0s3..1...a..>.l_.a~ev.l.gZ..............+^.?_..7?[.......+N..'.T..0..Q..wT.fC............/b...p...!.L..:.3...U...P.`..U7....1sj.9..).2.F/....r).8?....o.m.\\,m..H.../.X...[k..^.J...;P.f..=.Xg.O.....`...#....i.f+n........Zp1+..3..a...4....S'....3f.a...(.^.']o....3r^.31....k....i;...m0.....q+...9...5....\\.M...,.v......q.e?..T>.X.........d...8.V.d....EA......7..a.S.?.`...5.at1p...........p6.E.%|.....!....W5.P...<J.G.U.+.2S..h..G.):yI...(.1..N....6..L...9.O...t..^....\\.y8u....|f......2g.....mE...t...f.;...T...(.....J.1...1...2..\\..5.SMt.....LK..X.N*....g..2.8b~..O.b.......[*...u}9.f.......ec&J..;.......,....a...g....W.^....`.....F....i...v.Y..k.....#Qb..H9.y.y..g..}....;.......F<oScU...)8..f.^Z..l.f.I..Q..N....1....0..Ut..n%V.C...3..Le.p.z...?.A6..M.h'...E..._R...<....y..f.=[..].zZ.;+h.-f.....Xf.]*'..6M&..M..P.....,.0.~5..&;C0).S..N..N.L.....a.Uu....dy.t.g.....B...`1.k5..c.L...w...... .>a....._.........>A.`.0...K....&....................... .!01.@A\"2QPB........?...I^\".1.x..A:...6.V....%1..=....5....l..<O..s....Q@B..\"...h......).nPpN..>.;G....;Zl..:CuPC..gt..C.q....:}.}).3.@@.8.PO..h.i@B%J..8...{......E|O.H..8..P..C9......*.p..%;..Pn....s[...Q..~p....Jp..?..\\..%FMa*4...@..T*...0k't...).H...MA..D..(8..v.J\"8i...'0.1...\".....Y....V...1.A.t..O..a(S..hP...M.8..p.0.V......).,N............Q.R....d......k...m.ak*q.P.A8#.....u?.t...j....P.?.......:,,..?....U....@'.n...y...:D..B..\"...L...B6.....@D.t......X...Z.V.+W...j.......`...T...F.O..G.F.....X*.]r.x....jw.3Q..7.F.E...w.<.0oXKn..=.Q...)..4Fc...D..S...[w.0..7.2....iN.1.G.A.Bx...........f...`#s./..k.(..5....,S..*' evt_buflen=13274 evt_type=recvfrom evt_dir=< fd_typechar=4)","priority":"Debug","rule":"Download untrusted file","time":"2019-12-30T20:24:22.672367973Z", "output_fields": {"container.id":"db332d9d4314","container.image.repository":"drupal","container.name":"drupal_sandbox_drupal_1","evt.buffer":"HTTP/1.1 200 OK..Server: nginx/1.12.2..Date: Mon, 30 Dec 2019 20:18:33 GMT..Content-Type: image/jpeg..Content-Length: 33617..Last-Modified: Sat, 21 Apr 2018 19:53:52 GMT..Connection: keep-alive..ETag: \"5adb96d0-8351\"..Accept-Ranges: bytes..........JFIF..............Photoshop 3.0.8BIM.......g..(.bFBMD01000aa803000090120000a924000080270000302a000053360000724e000043520000ed5500005459000051830000.....ICC_PROFILE.......lcms....mntrRGB XYZ .........).9acspAPPL...................................-lcms................................................desc.......^cprt...\\....wtpt...h....bkpt...|....rXYZ........gXYZ........bXYZ........rTRC.......@gTRC.......@bTRC.......@desc........c2..................................................................................text....FB..XYZ ...............-XYZ ...........3....XYZ ......o...8.....XYZ ......b.........XYZ ......$.........curv...............c...k...?.Q.4!.).2.;.F.Qw].kpz....|.i.}...0.....C...........................\".##!. %*5-%'2( .?/279<<<$-BFA:F5;<9...C...........9& &99999999999999999999999999999999999999999999999999...........\"......................................................................................................................(R.'.J[.V.z.]..SN......-f......H.........................y..:}.\\..n..L...\".?c..G.KX....t+..~~....{.\\. ......................i.4.a.g..uY.jHd.-...<......v..j.v\"9.$......=1................E..g..0..zO..........y9i~..s.....j..\"}..........Mz}.t.{i...z.Q-...;rW...........5...0.....l......|_i.bc......|..(......~u-S.......Z......)fZ./Ib.).2.%g<>.k.y.zU.;...RhY...V..3:..........#..x>~....p{...........{.%.<..|.L.Y./........9..y...5.....i.X.........).Mw.nc5..J.|.f#.4rz.w....em.(..o....5......x.c..S.O.\\..=Ro......p{......by............x]..ZP...}...f......h.V....&t..&...../.z...OO.{..R.r.tIW7.S...l....../.=?........w........1..h{\\X.1..O..._Uj..........k1....\\J.-&...-.m.....;....w8.^=.s.fy%...\"'.9......<..........R.O.O3D..kf...h........7..7...K....?...5.H.......o>yLu...32......J.g.k.*...eo.....o....}K6..w.4'..\\....f..:q........|...|..f..w...........?F..+...f....{Q0.........Vz.9a..TL..X.I.mH..K.8...(_.1>3!.s.LZf..~wC.y-..|........`..JY\"hvy........ ......i...+.Y.......-R............\\...Jqa......nwj..'?..^.(.CM..w..J....Z......EM,I..~..o.F........#.1-.tOcM.;^.....G$.....5.y..&.mG.u.Yo.u...X$.}_._GG`H...kP...........U/V..c...o.....E.^3.!^....k^Cdv.......f..g]........9..=...t....^.X..[.v...S.....$.....U.?...J_...R..>._9..J.....p&.....g?.C..zvj.................LWM.|.X.M[xB.TX.J.X.V.........o.<....3.2..q2\\..M..C.|...j.....B..W...j.8.kE....>z...b...b^u..{.:......{.<.../Mh...M....ef.%..oVC.z>'U.j.SN...~.yiRm[.f-...7....c\\.r.......<TJ.5....g........\".c...Wm3..]r.....d\".....:7.1.C...o?S.i...w..iKV.^..m5..3.z..........n....M7.j.ZX...%.Z........&...k..i..NE..I....lM1>.ts..V....R^.X...I[...L.3...^].U.D..s....<.W.)R................^.....?/a=.p....-.....a...^.._8.GO<.../.....@...w.^.i.6.9....b.,..iaM........y...b..j..X...a....K...I....aY...4.:...v.1.)W......q6....n.K................E.+...o..z....$.t.>_O......3..[G.`......KyN.J._'..e.Z...b.z0s..m%.+.U.]..G..E..l...a.3...hI&sj0..a....G..,A5.0..cH...+............o.7.~.....Ue.l..I.[|..........+R.G..b.N.}d...........v....},.a.&.xL....j}G_ ..V..st..=6.X.)..m)gK...7.\".c.X....M5.)-.b.........q.....$..Yc8.....t.X..X.yt..g..&.>..hO..W..6.7?F.N....>....*.1.].;.............v..z.t#./...^.A......Y.....gU[k.J:}*..C.I...0....^..f..X.g-.....f6..1.q..G2.k9k..wk.u...........W(^.9.=b|..U.^..j......<}.....m..........z<../\\...6k.>.vq.....e.y9.s..D..K.X..O'?l.;....K].j..:e.QSM...:m&.]7.o.5.z0........a..; ..kvX'6g6..nWW..4..3J'.^...t..I.....~........y.W......M\".(.........>OS.....:+T...t-.;.s...|\"..)xq....\\D..T.}$D.mb.........7.q.dc84.xkm.KK...J.V-.3.....z...G0k..7g.g.s.?7Vs.\".W....a......./.xy.....uk..D...~...#\\@.F.N~...Z....y...z.Zm........c../....\".:K.<.m_Mc.{Z_........l..l........\\.]..6.z.k.3.p.:\\....7...{.....]$.M...1w.Q.........9...|...8...P...OzvG_...a.N^.......&..m...m..3.g..........vrG...M.......kh.....J....|...6.....4.s.q.Z.)...6j.|.mv..i.>...n/C;5..:.t............I%~N.{.%-.sG.......R......r.2...s...g\\.pT.|I.../^ZM.......7.y.y......2.&2.l.<.......<...d..........T.A5:....u......3.0u,sz]|..t9Ym.....E....|.............r=.....b..u.]....K..5....o...c.DG..q...R.....~wL...;....C3...';t.........:y..k.z.....ut.|....{.?S...|b..~......'u...Y....0...Ri....zh...Y.Z;]....B.........{/+...B.7U.k.5.|..b/,..5.h...~,.t|.....?....._.z.7...E...m...h..<N/w..'..rK../U4...WxzH...L.r)yi...].....+.G...vx&.Y6.tg].c}...M...{D.....].............Y.Wy.9;.MVhK...n....M#.$..uy7.~......3.VDy7h6.x$F$F%k.,`.r<..c&......uy]yW....e.......ln.].1...]3...%..=....\\..@........q....}Yj..k;A\"6.M.c.CHf.j....r....zx...).W.|.fQ....X6....j.&..3..g&3...+.m.=.H.3{......y....m.4.BGJKZ..:.O.H.......#....g.....?].+.KX.1.`....i.......r:..1...m66c#.....l..c..j..r...#......A./..c...t........]tFjoV.....o.(k..........uyu...V.7e.b...\\...b.....Lz..'.....8.X..D..d.0.g.3..g.....q.d...q.k.....j`.x_w.1......8...b(e...../k..-P......./........................... !\"012.@#A.3$4BP`...............Q.%....Lg.O.H......c.`.......4!@......84...+em....f.X.k4Ls..&..@..Z.....a.L.eNP.h.......A..Zz.e.G.LM7Z\".*t5>....f.;Mf..A..%.K...:..s.%....#m*u...;C<{...]b.y..l-....a...~N.B6..Jl...Yuu........`...........A>b.....-s.J.OaQ.1.....p4j.......B.......imVao../...b.R.Zv%.L.f..O.n..4..&...m4.L.%gx...[..w.}...\"..u......\".W r.N..cm... ...i.$..X99.jG..2..X....OI.[k.........X..*.....S.....\".j>.y]'.....Xw..V|....A.&/...i...Im....D.<W...g..........f3.#.Q.q..<.r...TW.|F.....i...../....@<*..... ..,>H.u.DM9..\\..KN..,T;#....~...[...w..pT.o..:..Q7Qo........m.j.....TC...O..k...6.^fk.b.%.p............E.je.l....d.Rx.U....(.......~8..o......4......Y>W.X.WIc.Z......!...a...|...S..f..._.....c.U.d...{.....1q.....;:Y>.]*JS.@.3k......0.X(..-...q.....ce...y...%....!..WH.*.....V..L%...15>.....t>,.6..=.[hrI....fE.E......i.Iu....ej+.yU.-1..+.e?e...:.....W.gQ...u+J.....?.q...K.?<..i.....<.%..7........Yf..Vc..W..jS..Z...To..?.%).../n....w..e....x.k@....pkzy...J.j&.X.....i..Zf\\.*..Ll....1.c..[2....bd.'..[..[T........a,.<1?K-:...~4.I.b...].~.,.MO..|..!4.....c.\"a..*j.F0..&..!......c,..v.1...+>....u\\...V.+.......\".3#.lp.p.z.~...g..Y....t.E.Gp#..j.....O..i......C..........8.F.U=B....LJ.......W..xOU......t%}K.i..u.i.0.........g..P..L&/...:.mJ}.C.Y....q1...p.....[..[u..O....f..s..B...V.m...u.....`..i..ow#.}..#......'..@.I..L....Y...^......mm.p.t..c...[l..*.~....0........!,...u........./).fh..c....%...V....#sT.....-...U..i......h ...r...l....k......-9....7/..>[..........r.T.,S.}.5..U.Vc.#y..a..!:.._R.,..2......s.x6.._..9UX..2.....Lz.+.........?.NU..k.~>2mY.b`..j..glK.Wk.O.a..O>..3^%.p..C...........:B.Z......O..5.f.s..C.j.(@...V.t..~-.~...../.].Wf;,....j........e...i.`..F...u2=.2.....Z...(.pT<...6{L7......I...H.\".U.z.....tD.t....\"..K...dc..M%...\".....,se....}.).&...}.,110j...g.c..9:`.w[UBx%.6r+.....}.57.........'...ho.T.:K-[U?._1...v.4......K...O..d...J....'.]{o..,\\-..!_&.......5.-..o..cV(.WHY.WJ.......?....../M.Y.c.c.!.F[......F...qL1.q....b6.k..2-...u...o.....w........p.`..{..E..l.x.8......9e..k.O...<N...Q.......jJO...f..b4..@5.......;k,o.&R...l..A+..[A..MA.s_e.%...C.T..l.....f..m.....E#.....!.&....wd..A......c..........c.c.....o....._...........1:....,....Tr.A...i<....wq..z.]..~....%l...fVN...tQ.I]...iK.....sd5.k.g.. S...5......b.9..........e.I.tI...7..J.%....@$..i>...I. ..U|v.......E+U.[......v.y.J..i..8.g.M............NVD.....'...km..S6..G._....A.=.u.E.3p..._#.#..H+.......5<.....q.>^..)6.... X~@..A.o....<..,........ym.K1.N.7Iu.........j...Q.-.IZ..<..|\\O.....3BcM&...^c*../C$6.....Ue/.._......y.9-......eP...4.E..~B.4.M&......N.....i....u.8q6.2.......... .G.S....... j?.c....a<....1...f.'.V.\\....%.%.M)H....1b....i.g.r.i4.Mu.i.N.?..v...b.<....].....2.o....3\"......fi..U.H<....Xr2W.......L..[.<).L.M8..:....;F...s]{..;.......Y..i4...`..4...w.J|.....4............-`L.P...v....}.1..mXK....c+..A...x...QF.!.n.\".u.?.......h.t...{.k5+5.Q./.......^.!K[...05\\..L.^..........m.v.....b....cXq.l....C,X.&a......E.v....H..........Em|..K...\"..`..J...:6.>U..*N...54..j.J........Oi.L.+}k...O.hJ{.......u(.X..D2.U.F6....EX.......N...t..8..N......u.N.4.S.. ..~....y.U...nV;,RZ\".....L.eh.=....Q..cL?...|.....r...I.o.|..i.k..n.t.5t...n.....{g.oM..9.Q.oq.<..._..A.....0...i.a..PLs,.@.. ._..-...(....>.b...w56.I.........Nm7y.V=<.{......_d..1....X......h...&A...........f#k_m.Nl%.l... 4.G-..M&.....gP&....&Xe.X{.....F.>.T.4.H.Z6....m.v....7&..........t.....y.U...$..........:....CkLo....^...\\.r....u..r.......v].....9....~3....g..D.DR...1..2..2.....J.;3.W..1..4.W..5....c6..9......{....:o.i....01.K...............lv..[..J.....F....fc6......|W..2.....hf.4.^.&w.F ./L...m.Y..v.S.....f9.....6...9...w/+O.....L.d_..EOewF....@t9....ac.[.m.........;d...k.. ..........#.\\......M.~.p..0s3..1...a..>.l_.a~ev.l.gZ..............+^.?_..7?[.......+N..'.T..0..Q..wT.fC............/b...p...!.L..:.3...U...P.`..U7....1sj.9..).2.F/....r).8?....o.m.\\,m..H.../.X...[k..^.J...;P.f..=.Xg.O.....`...#....i.f+n........Zp1+..3..a...4....S'....3f.a...(.^.']o....3r^.31....k....i;...m0.....q+...9...5....\\.M...,.v......q.e?..T>.X.........d...8.V.d....EA......7..a.S.?.`...5.at1p...........p6.E.%|.....!....W5.P...<J.G.U.+.2S..h..G.):yI...(.1..N....6..L...9.O...t..^....\\.y8u....|f......2g.....mE...t...f.;...T...(.....J.1...1...2..\\..5.SMt.....LK..X.N*....g..2.8b~..O.b.......[*...u}9.f.......ec&J..;.......,....a...g....W.^....`.....F....i...v.Y..k.....#Qb..H9.y.y..g..}....;.......F<oScU...)8..f.^Z..l.f.I..Q..N....1....0..Ut..n%V.C...3..Le.p.z...?.A6..M.h'...E..._R...<....y..f.=[..].zZ.;+h.-f.....Xf.]*'..6M&..M..P.....,.0.~5..&;C0).S..N..N.L.....a.Uu....dy.t.g.....B...`1.k5..c.L...w...... .>a....._.........>A.`.0...K....&....................... .!01.@A\"2QPB........?...I^\".1.x..A:...6.V....%1..=....5....l..<O..s....Q@B..\"...h......).nPpN..>.;G....;Zl..:CuPC..gt..C.q....:}.}).3.@@.8.PO..h.i@B%J..8...{......E|O.H..8..P..C9......*.p..%;..Pn....s[...Q..~p....Jp..?..\\..%FMa*4...@..T*...0k't...).H...MA..D..(8..v.J\"8i...'0.1...\".....Y....V...1.A.t..O..a(S..hP...M.8..p.0.V......).,N............Q.R....d......k...m.ak*q.P.A8#.....u?.t...j....P.?.......:,,..?....U....@'.n...y...:D..B..\"...L...B6.....@D.t......X...Z.V.+W...j.......`...T...F.O..G.F.....X*.]r.x....jw.3Q..7.F.E...w.<.0oXKn..=.Q...)..4Fc...D..S...[w.0..7.2....iN.1.G.A.Bx...........f...`#s./..k.(..5....,S..*'","evt.buflen":13274,"evt.dir":"<","evt.time.iso8601":1577737462672367973,"evt.type":"recvfrom","fd.typechar":"4","proc.aname[2]":"apache2","proc.aname[3]":"apache2","proc.aname[4]":"containerd-shim","proc.aname[5]":"containerd","proc.aname[6]":"systemd","proc.aname[7]":null,"proc.cmdline":"curl http://xxxx.co.il/xxxx.jpg ","proc.name":"curl","proc.pcmdline":"sh -c curl http://xxxx.co.il/xxxx.jpg","proc.pname":"sh","user.name":"www-data"}}
realgam3 added a commit to realgam3/falco that referenced this issue Jan 4, 2020
@realgam3
Fix issue falcosecurity#987
dbc981c 
For the people who uses the  -b or --print-base64 command argument,
"s_inspector->set_buffer_format(sinsp_evt::PF_NORMAL);" will restore the state to normal dot escaped string instead of base64 (that they chose....).
@fntlnz
Copy link
Contributor

fntlnz commented Jan 4, 2020 •
edited
Loading

hey, @realgam3 thanks for catching this! Does your patch fix the problem? I'd be happy to do a review.

@realgam3
Copy link
Author

realgam3 commented Jan 5, 2020

hey, @realgam3 thanks for catching this! Does your patch fix the problem? I'd be happy to do a review.

Yup :)
I use it

@poiana poiana mentioned this issue Jan 5, 2020
Closed
@realgam3
Copy link
Author

realgam3 commented Jan 5, 2020

Pull Request: #988

leodido added a commit to realgam3/falco that referenced this issue Jan 24, 2020
@realgam3 @leodido
fix: base64 (issue falcosecurity#987)
93ddc4a 
For the people who uses the -b or --print-base64 command argument,
"s_inspector->set_buffer_format(sinsp_evt::PF_NORMAL);"
will restore the state to normal dot escaped string instead of base64 (that they chose....).

Co-authored-by: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
@leodido leodido mentioned this issue Feb 4, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Base64 format fix falcosecurity/falco
Fix base64 flag realgam3/falco
2 participants
@fntlnz @realgam3