-
Notifications
You must be signed in to change notification settings - Fork 1.2k
/
main.zeek
123 lines (102 loc) · 3 KB
/
main.zeek
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
@load base/protocols/conn/removal-hooks
module NTLM;
export {
redef enum Log::ID += { LOG };
global log_policy: Log::PolicyHook;
type Info: record {
## Timestamp for when the event happened.
ts : time &log;
## Unique ID for the connection.
uid : string &log;
## The connection's 4-tuple of endpoint addresses/ports.
id : conn_id &log;
## Username given by the client.
username : string &log &optional;
## Hostname given by the client.
hostname : string &log &optional;
## Domainname given by the client.
domainname : string &log &optional;
## NetBIOS name given by the server in a CHALLENGE.
server_nb_computer_name: string &log &optional;
## DNS name given by the server in a CHALLENGE.
server_dns_computer_name: string &log &optional;
## Tree name given by the server in a CHALLENGE.
server_tree_name: string &log &optional;
## Indicate whether or not the authentication was successful.
success : bool &log &optional;
## Internally used field to indicate if the login attempt
## has already been logged.
done: bool &default=F;
};
## NTLM finalization hook. Remaining NTLM info may get logged when it's called.
global finalize_ntlm: Conn::RemovalHook;
}
redef DPD::ignore_violations += { Analyzer::ANALYZER_NTLM };
redef record connection += {
ntlm: Info &optional;
};
event zeek_init() &priority=5
{
Log::create_stream(NTLM::LOG, [$columns=Info, $path="ntlm", $policy=log_policy]);
}
function set_session(c: connection)
{
if ( ! c?$ntlm )
{
c$ntlm = NTLM::Info($ts=network_time(), $uid=c$uid, $id=c$id);
Conn::register_removal_hook(c, finalize_ntlm);
}
}
event ntlm_negotiate(c: connection, request: NTLM::Negotiate) &priority=5
{
set_session(c);
}
event ntlm_challenge(c: connection, challenge: NTLM::Challenge) &priority=5
{
set_session(c);
if ( challenge?$target_info )
{
local ti = challenge$target_info;
if ( ti?$nb_computer_name )
c$ntlm$server_nb_computer_name = ti$nb_computer_name;
if ( ti?$dns_computer_name )
c$ntlm$server_dns_computer_name = ti$dns_computer_name;
if ( ti?$dns_tree_name )
c$ntlm$server_tree_name = ti$dns_tree_name;
}
}
event ntlm_authenticate(c: connection, request: NTLM::Authenticate) &priority=5
{
set_session(c);
if ( request?$domain_name )
c$ntlm$domainname = request$domain_name;
if ( request?$workstation )
c$ntlm$hostname = request$workstation;
if ( request?$user_name )
c$ntlm$username = request$user_name;
}
event gssapi_neg_result(c: connection, state: count) &priority=3
{
# Ignore "incomplete" replies (state==1)
if ( c?$ntlm && state != 1 )
c$ntlm$success = (state == 0);
}
event gssapi_neg_result(c: connection, state: count) &priority=-3
{
if ( c?$ntlm && ! c$ntlm$done )
{
# Only write if success is actually set to something...
if ( c$ntlm?$success )
{
Log::write(NTLM::LOG, c$ntlm);
c$ntlm$done = T;
}
}
}
hook finalize_ntlm(c: connection)
{
if ( c?$ntlm && ! c$ntlm$done )
{
Log::write(NTLM::LOG, c$ntlm);
}
}