Skip to content

Port 37215 filter corresponding tp AS15399 #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sahilranadive wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Port 37215 filter corresponding tp AS15399 #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3e1fb78
adding filter for port 37215
sahilranadive Nov 2, 2023
cf5fceb
fixing code
sahilranadive Nov 2, 2023
4149f09
fixing code
sahilranadive Nov 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 51 additions & 0 deletions libcorsaro/libcorsaro_filtering.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -368,6 +368,36 @@ static inline int _apply_port_tcp5000_filter(corsaro_logger_t *logger,
return 0;
}

static inline int _apply_port_tcp37215_filter(corsaro_logger_t *logger,
filter_params_t *fparams) {

if (!fparams->ip) {
return 0;
}

if (fparams->tcp == NULL) {
return 0;
}

if (fparams->dest_port != 37215) {
return 0;
}

if (!fparams->tcp->syn) {
return 0;
}

if (fparams->tcp->ack) {
return 0;
}

if (ntohs(fparams->ip->ip_len) != 40) {
return 0;
}

return 1;
}

static inline int _apply_asn_208843_scan_filter(corsaro_logger_t *logger,
filter_params_t *fparams) {

Expand Down Expand Up @@ -936,6 +966,10 @@ static int _apply_erratic_filter(corsaro_logger_t *logger,
return 1;
}

if (_apply_port_tcp37215_filter(logger, fparams) > 0) {
return 1;
}

if (_apply_asn_208843_scan_filter(logger, fparams) > 0) {
return 1;
}
Expand Down Expand Up @@ -1162,6 +1196,13 @@ int corsaro_apply_port_tcp5000_filter(corsaro_logger_t *logger,
return _apply_port_tcp5000_filter(logger, &fparams);
}

int corsaro_apply_port_tcp37215_filter(corsaro_logger_t *logger,
libtrace_packet_t *packet) {

PREPROCESS_PACKET
return _apply_port_tcp37215_filter(logger, &fparams);
}

int corsaro_apply_asn_208843_scan_filter(corsaro_logger_t *logger,
libtrace_packet_t *packet) {

Expand Down Expand Up @@ -1243,6 +1284,8 @@ const char *corsaro_get_builtin_filter_name(corsaro_logger_t *logger,
return "tcp-port-80";
case CORSARO_FILTERID_TCP_PORT_5000:
return "tcp-port-5000";
case CORSARO_FILTERID_TCP_PORT_37215:
return "tcp-port-37215";
case CORSARO_FILTERID_ASN_208843_SCAN:
return "asn-208843-scan";
case CORSARO_FILTERID_DNS_RESP_NONSTANDARD:
Expand Down Expand Up @@ -1396,6 +1439,8 @@ int corsaro_apply_all_filters(corsaro_logger_t *logger, libtrace_ip_t *ip,
_apply_port_tcp80_filter(logger, &fparams);
torun[CORSARO_FILTERID_TCP_PORT_5000].result =
_apply_port_tcp5000_filter(logger, &fparams);
torun[CORSARO_FILTERID_TCP_PORT_37215].result =
_apply_port_tcp37215_filter(logger, &fparams);
torun[CORSARO_FILTERID_ASN_208843_SCAN].result =
_apply_asn_208843_scan_filter(logger, &fparams);
torun[CORSARO_FILTERID_DNS_RESP_NONSTANDARD].result =
Expand All @@ -1414,6 +1459,7 @@ int corsaro_apply_all_filters(corsaro_logger_t *logger, libtrace_ip_t *ip,
torun[CORSARO_FILTERID_TCP_PORT_23].result == 1 ||
torun[CORSARO_FILTERID_TCP_PORT_80].result == 1 ||
torun[CORSARO_FILTERID_TCP_PORT_5000].result == 1 ||
torun[CORSARO_FILTERID_TCP_PORT_37215].result == 1 ||
torun[CORSARO_FILTERID_ASN_208843_SCAN].result == 1 ||
torun[CORSARO_FILTERID_TTL_200].result == 1 ||
torun[CORSARO_FILTERID_DNS_RESP_NONSTANDARD].result == 1 ||
Expand Down Expand Up @@ -1531,6 +1577,9 @@ int corsaro_apply_multiple_filters(corsaro_logger_t *logger,
case CORSARO_FILTERID_TCP_PORT_5000:
torun[i].result =_apply_port_tcp5000_filter(logger, &fparams);
break;
case CORSARO_FILTERID_TCP_PORT_37215:
torun[i].result =_apply_port_tcp37215_filter(logger, &fparams);
break;
case CORSARO_FILTERID_ASN_208843_SCAN:
torun[i].result =_apply_asn_208843_scan_filter(logger, &fparams);
break;
Expand Down Expand Up @@ -1611,6 +1660,8 @@ int corsaro_apply_filter_by_id(corsaro_logger_t *logger,
return _apply_port_tcp80_filter(logger, &fparams);
case CORSARO_FILTERID_TCP_PORT_5000:
return _apply_port_tcp5000_filter(logger, &fparams);
case CORSARO_FILTERID_TCP_PORT_37215:
return _apply_port_tcp37215_filter(logger, &fparams);
case CORSARO_FILTERID_ASN_208843_SCAN:
return _apply_asn_208843_scan_filter(logger, &fparams);
case CORSARO_FILTERID_DNS_RESP_NONSTANDARD:
Expand Down
7 changes: 7 additions & 0 deletions libcorsaro/libcorsaro_filtering.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,11 @@ typedef enum {
*/
CORSARO_FILTERID_TCP_PORT_5000,

/** Matches TCP packets where the destination port is 37215 and iplen is 40
* (i.e. CVE-2017-17215)
*/
CORSARO_FILTERID_TCP_PORT_37215,

/*Matches on high scanning traffic characterized by ttl < 64, tcp syn packets
, destination port 1433, window size 8192*/
CORSARO_FILTERID_ASN_208843_SCAN,
Expand Down Expand Up @@ -299,6 +304,8 @@ int corsaro_apply_port_tcp80_filter(corsaro_logger_t *logger,
libtrace_packet_t *packet);
int corsaro_apply_port_tcp5000_filter(corsaro_logger_t *logger,
libtrace_packet_t *packet);
int corsaro_apply_port_tcp37215_filter(corsaro_logger_t *logger,
libtrace_packet_t *packet);
int corsaro_apply_asn_208843_scan_filter(corsaro_logger_t *logger,
libtrace_packet_t *packet);
int corsaro_apply_dns_resp_oddport_filter(corsaro_logger_t *logger,
Expand Down
2 changes: 2 additions & 0 deletions libcorsaro/plugins/report/merging_thread.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,8 @@ static inline const char * get_filter_stringname(int fbit) {
return "non-erratic.tcp-port-80";
case CORSARO_FILTERID_TCP_PORT_5000:
return "non-erratic.tcp-port-5000";
case CORSARO_FILTERID_TCP_PORT_37215:
return "non-erratic.tcp-port-37215";
case CORSARO_FILTERID_ASN_208843_SCAN:
return "non-erratic.asn-208843-scan";
case CORSARO_FILTERID_DNS_RESP_NONSTANDARD:
Expand Down