From 3e1fb78899ae97e007e87790e2399a57ddaebde6 Mon Sep 17 00:00:00 2001 From: sahilranadive Date: Wed, 1 Nov 2023 23:02:37 -0400 Subject: [PATCH 1/3] adding filter for port 37215 --- libcorsaro/libcorsaro_filtering.c | 51 ++++++++++++++++++++++ libcorsaro/libcorsaro_filtering.h | 7 +++ libcorsaro/plugins/report/merging_thread.c | 2 + 3 files changed, 60 insertions(+) diff --git a/libcorsaro/libcorsaro_filtering.c b/libcorsaro/libcorsaro_filtering.c index 8e4aaee..4a08494 100644 --- a/libcorsaro/libcorsaro_filtering.c +++ b/libcorsaro/libcorsaro_filtering.c @@ -368,6 +368,36 @@ static inline int _apply_port_tcp5000_filter(corsaro_logger_t *logger, return 0; } +static inline int _apply_port_tcp37215_filter(corsaro_logger_t *logger, + filter_params_t *fparams) { + + if (!fparams->ip) { + return 0; + } + + if (fparams->tcp == NULL) { + return 0; + } + + if (fparams->dest_port != 37215) { + return 0; + } + + if (!tcp->syn) { + return 0; + } + + if (tcp->ack) { + return 0; + } + + if (ntohs(fparams->ip->ip_len) != 40) { + return 0; + } + + return 1; +} + static inline int _apply_asn_208843_scan_filter(corsaro_logger_t *logger, filter_params_t *fparams) { @@ -936,6 +966,10 @@ static int _apply_erratic_filter(corsaro_logger_t *logger, return 1; } + if (_apply_port_tcp37215_filter(logger, fparams) > 0) { + return 1; + } + if (_apply_asn_208843_scan_filter(logger, fparams) > 0) { return 1; } @@ -1162,6 +1196,13 @@ int corsaro_apply_port_tcp5000_filter(corsaro_logger_t *logger, return _apply_port_tcp5000_filter(logger, &fparams); } +int corsaro_apply_port_tcp37215_filter(corsaro_logger_t *logger, + libtrace_packet_t *packet) { + + PREPROCESS_PACKET + return _apply_port_tcp37215_filter(logger, &fparams); +} + int corsaro_apply_asn_208843_scan_filter(corsaro_logger_t *logger, libtrace_packet_t *packet) { @@ -1243,6 +1284,8 @@ const char *corsaro_get_builtin_filter_name(corsaro_logger_t *logger, return "tcp-port-80"; case CORSARO_FILTERID_TCP_PORT_5000: return "tcp-port-5000"; + case CORSARO_FILTERID_TCP_PORT_37215: + return "tcp-port-37215"; case CORSARO_FILTERID_ASN_208843_SCAN: return "asn-208843-scan"; case CORSARO_FILTERID_DNS_RESP_NONSTANDARD: @@ -1396,6 +1439,8 @@ int corsaro_apply_all_filters(corsaro_logger_t *logger, libtrace_ip_t *ip, _apply_port_tcp80_filter(logger, &fparams); torun[CORSARO_FILTERID_TCP_PORT_5000].result = _apply_port_tcp5000_filter(logger, &fparams); + torun[CORSARO_FILTERID_TCP_PORT_37215].result = + _apply_port_tcp37215_filter(logger, &fparams); torun[CORSARO_FILTERID_ASN_208843_SCAN].result = _apply_asn_208843_scan_filter(logger, &fparams); torun[CORSARO_FILTERID_DNS_RESP_NONSTANDARD].result = @@ -1414,6 +1459,7 @@ int corsaro_apply_all_filters(corsaro_logger_t *logger, libtrace_ip_t *ip, torun[CORSARO_FILTERID_TCP_PORT_23].result == 1 || torun[CORSARO_FILTERID_TCP_PORT_80].result == 1 || torun[CORSARO_FILTERID_TCP_PORT_5000].result == 1 || + torun[CORSARO_FILTERID_TCP_PORT_37215].result == 1 || torun[CORSARO_FILTERID_ASN_208843_SCAN].result == 1 || torun[CORSARO_FILTERID_TTL_200].result == 1 || torun[CORSARO_FILTERID_DNS_RESP_NONSTANDARD].result == 1 || @@ -1531,6 +1577,9 @@ int corsaro_apply_multiple_filters(corsaro_logger_t *logger, case CORSARO_FILTERID_TCP_PORT_5000: torun[i].result =_apply_port_tcp5000_filter(logger, &fparams); break; + case CORSARO_FILTERID_TCP_PORT_37215: + torun[i].result =_apply_port_tcp37215_filter(logger, &fparams); + break; case CORSARO_FILTERID_ASN_208843_SCAN: torun[i].result =_apply_asn_208843_scan_filter(logger, &fparams); break; @@ -1611,6 +1660,8 @@ int corsaro_apply_filter_by_id(corsaro_logger_t *logger, return _apply_port_tcp80_filter(logger, &fparams); case CORSARO_FILTERID_TCP_PORT_5000: return _apply_port_tcp5000_filter(logger, &fparams); + case CORSARO_FILTERID_TCP_PORT_37215: + return _apply_port_tcp37215_filter(logger, &fparams); case CORSARO_FILTERID_ASN_208843_SCAN: return _apply_asn_208843_scan_filter(logger, &fparams); case CORSARO_FILTERID_DNS_RESP_NONSTANDARD: diff --git a/libcorsaro/libcorsaro_filtering.h b/libcorsaro/libcorsaro_filtering.h index 7e2c6c6..b58c738 100644 --- a/libcorsaro/libcorsaro_filtering.h +++ b/libcorsaro/libcorsaro_filtering.h @@ -184,6 +184,11 @@ typedef enum { */ CORSARO_FILTERID_TCP_PORT_5000, + /** Matches TCP packets where the destination port is 37215 and iplen is 40 + * (i.e. CVE-2017-17215) + */ + CORSARO_FILTERID_TCP_PORT_37215, + /*Matches on high scanning traffic characterized by ttl < 64, tcp syn packets , destination port 1433, window size 8192*/ CORSARO_FILTERID_ASN_208843_SCAN, @@ -299,6 +304,8 @@ int corsaro_apply_port_tcp80_filter(corsaro_logger_t *logger, libtrace_packet_t *packet); int corsaro_apply_port_tcp5000_filter(corsaro_logger_t *logger, libtrace_packet_t *packet); +nt corsaro_apply_port_tcp37215_filter(corsaro_logger_t *logger, + libtrace_packet_t *packet); int corsaro_apply_asn_208843_scan_filter(corsaro_logger_t *logger, libtrace_packet_t *packet); int corsaro_apply_dns_resp_oddport_filter(corsaro_logger_t *logger, diff --git a/libcorsaro/plugins/report/merging_thread.c b/libcorsaro/plugins/report/merging_thread.c index 068fc29..dd97233 100644 --- a/libcorsaro/plugins/report/merging_thread.c +++ b/libcorsaro/plugins/report/merging_thread.c @@ -240,6 +240,8 @@ static inline const char * get_filter_stringname(int fbit) { return "non-erratic.tcp-port-80"; case CORSARO_FILTERID_TCP_PORT_5000: return "non-erratic.tcp-port-5000"; + case CORSARO_FILTERID_TCP_PORT_37215: + return "non-erratic.tcp-port-37215"; case CORSARO_FILTERID_ASN_208843_SCAN: return "non-erratic.asn-208843-scan"; case CORSARO_FILTERID_DNS_RESP_NONSTANDARD: From cf5fceb5e3c389ba33e96e9d265a9e6a0ef3a8a1 Mon Sep 17 00:00:00 2001 From: sahilranadive Date: Wed, 1 Nov 2023 23:20:55 -0400 Subject: [PATCH 2/3] fixing code --- libcorsaro/libcorsaro_filtering.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libcorsaro/libcorsaro_filtering.h b/libcorsaro/libcorsaro_filtering.h index b58c738..38c73fe 100644 --- a/libcorsaro/libcorsaro_filtering.h +++ b/libcorsaro/libcorsaro_filtering.h @@ -304,7 +304,7 @@ int corsaro_apply_port_tcp80_filter(corsaro_logger_t *logger, libtrace_packet_t *packet); int corsaro_apply_port_tcp5000_filter(corsaro_logger_t *logger, libtrace_packet_t *packet); -nt corsaro_apply_port_tcp37215_filter(corsaro_logger_t *logger, +int corsaro_apply_port_tcp37215_filter(corsaro_logger_t *logger, libtrace_packet_t *packet); int corsaro_apply_asn_208843_scan_filter(corsaro_logger_t *logger, libtrace_packet_t *packet); From 4149f096c11e7f11299e3cf207782a33353e3b89 Mon Sep 17 00:00:00 2001 From: sahilranadive Date: Wed, 1 Nov 2023 23:23:17 -0400 Subject: [PATCH 3/3] fixing code --- libcorsaro/libcorsaro_filtering.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libcorsaro/libcorsaro_filtering.c b/libcorsaro/libcorsaro_filtering.c index 4a08494..73b30bb 100644 --- a/libcorsaro/libcorsaro_filtering.c +++ b/libcorsaro/libcorsaro_filtering.c @@ -383,11 +383,11 @@ static inline int _apply_port_tcp37215_filter(corsaro_logger_t *logger, return 0; } - if (!tcp->syn) { + if (!fparams->tcp->syn) { return 0; } - if (tcp->ack) { + if (fparams->tcp->ack) { return 0; }