Exemplo n.º 1
0
    def _decode_payload(self, pktt):
        """Decode UDP payload."""
        if 123 in [self.src_port, self.dst_port]:
            # NTP on port 123
            ntp = NTP(pktt)
            if ntp:
                pktt.pkt.ntp = ntp
            return
        elif 53 in [self.src_port, self.dst_port]:
            # DNS on port 53
            dns = DNS(pktt, proto=17)
            if dns:
                pktt.pkt.dns = dns
            return
        elif 88 in [self.src_port, self.dst_port]:
            # KRB5 on port 88
            krb = KRB5(pktt, proto=17)
            if krb:
                pktt.pkt.krb = krb
            return

        # Get RPC header
        rpc = RPC(pktt, proto=17)

        if rpc:
            # Save RPC layer on packet object
            pktt.pkt.rpc = rpc
            if rpc.type:
                # Remove packet call from the xid map since reply has
                # already been decoded
                pktt._rpc_xid_map.pop(rpc.xid, None)

            # Decode NFS layer
            rpc.decode_payload()
Exemplo n.º 2
0
    def _decode_payload(self, pktt):
        """Decode UDP payload."""
        # Get RPC header
        rpc = RPC(pktt, proto=17)

        if rpc:
            # Save RPC layer on packet object
            pktt.pkt.rpc = rpc
            if rpc.type:
                # Remove packet call from the xid map since reply has
                # already been decoded
                pktt._rpc_xid_map.pop(rpc.xid, None)

            # Decode NFS layer
            rpc.decode_payload()
Exemplo n.º 3
0
    def _decode_payload(self, pktt, stream):
        """Decode TCP payload."""
        rpc = None
        if stream['frag_off'] > 0 and len(stream['msfrag']) == 0:
            # This RPC packet lies within previous TCP packet,
            # Re-position the offset of the data
            self.data = self.data[stream['frag_off']:]

        # Get the total size
        save_data = self.data
        size = len(self.data)

        # Try decoding the RPC header before using the msfrag data
        # to re-sync the stream
        if len(stream['msfrag']) > 0:
            rpc = RPC(pktt, self.data, proto=6)
            if not rpc:
                self.data = save_data

        if rpc or (size == 0 and len(stream['msfrag']) > 0 and self.flags_raw != 0x10):
            # There has been some data lost in the capture,
            # to continue decoding next packets, reset stream
            # except if this packet is just a TCP ACK (flags = 0x10)
            stream['msfrag'] = ''
            stream['frag_off'] = 0

        # Expected data segment sequence number
        nseg = self.seq - stream['last_seq']

        # Make sure this segment has valid data
        if nseg != len(stream['msfrag']) and \
           size <= 20 and save_data == '\x00' * size:
            return

        if not rpc:
            # Concatenate previous fragment
            self.data = stream['msfrag'] + self.data
            ldata = len(self.data) - 4

            # Get RPC header
            rpc = RPC(pktt, self.data, proto=6)
        else:
            ldata = size - 4

        if not rpc:
            return

        rpcsize = rpc.fragment_hdr.size

        if ldata < rpcsize:
            # An RPC fragment is missing to decode RPC payload
            stream['msfrag'] += save_data
        else:
            if len(stream['msfrag']) > 0 or ldata == rpcsize:
                stream['frag_off'] = 0
            stream['msfrag'] = ''
            # Save RPC layer on packet object
            pktt.pkt.rpc = rpc
            del self.data

            # Decode NFS layer
            nfs = rpc.decode_nfs()
            if nfs:
                pktt.pkt.nfs = nfs
            rpcbytes = ldata - len(rpc.data)
            if not nfs and rpcbytes != rpcsize:
                pass
            elif rpc.data:
                # Save the offset of next RPC packet within this TCP packet
                # Data offset is cumulative
                stream['frag_off'] += size - len(rpc.data)
                save_data = rpc.data
                ldata = len(rpc.data) - 4
                try:
                    rpc_header = RPC(pktt, rpc.data, proto=6)
                except Exception:
                    rpc_header = None
                if not rpc_header or ldata < rpc_header.fragment_hdr.size:
                    # Part of next RPC packet is within this TCP packet
                    # Save the multi-span fragment data
                    stream['msfrag'] += save_data
                else:
                    # Next RPC packet is entirely within this TCP packet
                    # Re-position the file pointer to the current offset
                    pktt.offset = pktt.b_offset
                    pktt._getfh().seek(pktt.offset)
            else:
                stream['frag_off'] = 0
Exemplo n.º 4
0
    def _decode_payload(self, pktt, stream):
        """Decode TCP payload."""
        rpc = None
        pkt = pktt.pkt
        unpack = pktt.unpack
        if stream['frag_off'] > 0 and len(stream['msfrag']) == 0:
            # This RPC packet lies within previous TCP packet,
            # Re-position the offset of the data
            unpack.seek(unpack.tell() + stream['frag_off'])

        # Get the total size
        sid = unpack.save_state()
        size = unpack.size()
        nonvalid = bool(size <= 20 and unpack.getbytes() == '\x00' * size)

        # Try decoding the RPC header before using the msfrag data
        # to re-sync the stream
        if len(stream['msfrag']) > 0:
            rpc = RPC(pktt, proto=6)
            if not rpc:
                unpack.restore_state(sid)
                sid = unpack.save_state()

        if rpc or (size == 0 and len(stream['msfrag']) > 0 and self.flags_raw != 0x10):
            # There has been some data lost in the capture,
            # to continue decoding next packets, reset stream
            # except if this packet is just a TCP ACK (flags = 0x10)
            stream['msfrag'] = ''
            stream['frag_off'] = 0

        # Expected data segment sequence number
        nseg = self.seq - stream['last_seq']

        # Make sure this segment has valid data
        if nseg != len(stream['msfrag']) and nonvalid:
            return

        if not rpc:
            if len(stream['msfrag']):
                # Concatenate previous fragment
                unpack.insert(stream['msfrag'])
            ldata = unpack.size() - 4

            # Get RPC header
            rpc = RPC(pktt, proto=6)
        else:
            ldata = size - 4

        if not rpc:
            return

        rpcsize = rpc.fragment_hdr.size

        truncbytes = pkt.record.length_orig - pkt.record.length_inc
        if truncbytes == 0 and ldata < rpcsize:
            # An RPC fragment is missing to decode RPC payload
            unpack.restore_state(sid)
            stream['msfrag'] += unpack.getbytes()
        else:
            if len(stream['msfrag']) > 0 or ldata == rpcsize:
                stream['frag_off'] = 0
            stream['msfrag'] = ''
            # Save RPC layer on packet object
            pkt.rpc = rpc
            if rpc.type:
                # Remove packet call from the xid map since reply has
                # already been decoded
                pktt._rpc_xid_map.pop(rpc.xid, None)

            # Decode NFS layer
            rpcload = rpc.decode_payload()
            rpcbytes = ldata - unpack.size()
            if not rpcload and rpcbytes != rpcsize:
                pass
            elif unpack.size():
                # Save the offset of next RPC packet within this TCP packet
                # Data offset is cumulative
                stream['frag_off'] += size - unpack.size()
                sid = unpack.save_state()
                ldata = unpack.size() - 4
                try:
                    rpc_header = RPC(pktt, proto=6, state=False)
                except Exception:
                    rpc_header = None
                if not rpc_header or ldata < rpc_header.fragment_hdr.size:
                    # Part of next RPC packet is within this TCP packet
                    # Save the multi-span fragment data
                    unpack.restore_state(sid)
                    stream['msfrag'] += unpack.getbytes()
                else:
                    # Next RPC packet is entirely within this TCP packet
                    # Re-position the file pointer to the current offset
                    pktt.offset = pktt.boffset
                    pktt._getfh().seek(pktt.offset)
            else:
                stream['frag_off'] = 0
Exemplo n.º 5
0
    def _decode_payload(self, pktt, stream):
        """Decode TCP payload."""
        rpc = None
        pkt = pktt.pkt
        unpack = pktt.unpack

        if 53 in [self.src_port, self.dst_port]:
            # DNS on port 53
            dns = DNS(pktt, proto=6)
            if dns:
                pkt.dns = dns
            return
        elif 88 in [self.src_port, self.dst_port]:
            # KRB5 on port 88
            krb = KRB5(pktt, proto=6)
            if krb:
                pkt.krb = krb
            return

        if stream.frag_off > 0 and len(stream.buffer) == 0:
            # This RPC packet lies within previous TCP packet,
            # Re-position the offset of the data
            unpack.seek(unpack.tell() + stream.frag_off)

        # Get the total size
        sid = unpack.save_state()
        size = unpack.size()

        # Try decoding the RPC header before using the stream buffer data
        # to re-sync the stream
        if len(stream.buffer) > 0:
            rpc = RPC(pktt, proto=6)
            if not rpc:
                unpack.restore_state(sid)
                sid = unpack.save_state()

        if rpc or (size == 0 and len(stream.buffer) > 0
                   and self.flags.rawflags != 0x10):
            # There has been some data lost in the capture,
            # to continue decoding next packets, reset stream
            # except if this packet is just a TCP ACK (flags = 0x10)
            stream.buffer = ""
            stream.frag_off = 0

        if not rpc:
            if len(stream.buffer):
                # Concatenate previous fragment
                unpack.insert(stream.buffer)
            ldata = unpack.size() - 4

            # Get RPC header
            rpc = RPC(pktt, proto=6)
        else:
            ldata = size - 4

        if not rpc:
            return

        rpcsize = rpc.fragment_hdr.size

        truncbytes = pkt.record.length_orig - pkt.record.length_inc
        if truncbytes == 0 and ldata < rpcsize:
            # An RPC fragment is missing to decode RPC payload
            unpack.restore_state(sid)
            stream.add_fragment(unpack.getbytes(), self.seq)
        else:
            if len(stream.buffer) > 0 or ldata == rpcsize:
                stream.frag_off = 0
            stream.buffer = ""
            # Save RPC layer on packet object
            pkt.rpc = rpc
            if rpc.type:
                # Remove packet call from the xid map since reply has
                # already been decoded
                pktt._rpc_xid_map.pop(rpc.xid, None)

            # Decode NFS layer
            rpcload = rpc.decode_payload()
            rpcbytes = ldata - unpack.size()
            if not rpcload and rpcbytes != rpcsize:
                pass
            elif unpack.size():
                # Save the offset of next RPC packet within this TCP packet
                # Data offset is cumulative
                stream.frag_off += size - unpack.size()
                sid = unpack.save_state()
                ldata = unpack.size() - 4
                try:
                    rpc_header = RPC(pktt, proto=6, state=False)
                except Exception:
                    rpc_header = None
                if not rpc_header or ldata < rpc_header.fragment_hdr.size:
                    # Part of next RPC packet is within this TCP packet
                    # Save the multi-span fragment data
                    unpack.restore_state(sid)
                    stream.add_fragment(unpack.getbytes(), self.seq)
                else:
                    # Next RPC packet is entirely within this TCP packet
                    # Re-position the file pointer to the current offset
                    pktt.seek(pktt.boffset)
            else:
                stream.frag_off = 0
Exemplo n.º 6
0
    def _decode_payload(self, pktt, stream):
        """Decode TCP payload."""
        rpc = None
        pkt = pktt.pkt
        unpack = pktt.unpack
        if stream['frag_off'] > 0 and len(stream['msfrag']) == 0:
            # This RPC packet lies within previous TCP packet,
            # Re-position the offset of the data
            unpack.seek(unpack.tell() + stream['frag_off'])

        # Get the total size
        sid = unpack.save_state()
        size = unpack.size()
        nonvalid = bool(size <= 20 and unpack.getbytes() == '\x00' * size)

        # Try decoding the RPC header before using the msfrag data
        # to re-sync the stream
        if len(stream['msfrag']) > 0:
            rpc = RPC(pktt, proto=6)
            if not rpc:
                unpack.restore_state(sid)
                sid = unpack.save_state()

        if rpc or (size == 0 and len(stream['msfrag']) > 0 and self.flags_raw != 0x10):
            # There has been some data lost in the capture,
            # to continue decoding next packets, reset stream
            # except if this packet is just a TCP ACK (flags = 0x10)
            stream['msfrag'] = ''
            stream['frag_off'] = 0

        # Expected data segment sequence number
        nseg = self.seq - stream['last_seq']

        # Make sure this segment has valid data
        if nseg != len(stream['msfrag']) and nonvalid:
            return

        if not rpc:
            if len(stream['msfrag']):
                # Concatenate previous fragment
                unpack.insert(stream['msfrag'])
            ldata = unpack.size() - 4

            # Get RPC header
            rpc = RPC(pktt, proto=6)
        else:
            ldata = size - 4

        if not rpc:
            return

        rpcsize = rpc.fragment_hdr.size

        truncbytes = pkt.record.length_orig - pkt.record.length_inc
        if truncbytes == 0 and ldata < rpcsize:
            # An RPC fragment is missing to decode RPC payload
            unpack.restore_state(sid)
            stream['msfrag'] += unpack.getbytes()
        else:
            if len(stream['msfrag']) > 0 or ldata == rpcsize:
                stream['frag_off'] = 0
            stream['msfrag'] = ''
            # Save RPC layer on packet object
            pkt.rpc = rpc
            if rpc.type:
                # Remove packet call from the xid map since reply has
                # already been decoded
                pktt._rpc_xid_map.pop(rpc.xid, None)

            # Decode NFS layer
            nfs = rpc.decode_nfs()
            if nfs:
                pkt.nfs = nfs
            rpcbytes = ldata - unpack.size()
            if not nfs and rpcbytes != rpcsize:
                pass
            elif unpack.size():
                # Save the offset of next RPC packet within this TCP packet
                # Data offset is cumulative
                stream['frag_off'] += size - unpack.size()
                sid = unpack.save_state()
                ldata = unpack.size() - 4
                try:
                    rpc_header = RPC(pktt, proto=6, state=False)
                except Exception:
                    rpc_header = None
                if not rpc_header or ldata < rpc_header.fragment_hdr.size:
                    # Part of next RPC packet is within this TCP packet
                    # Save the multi-span fragment data
                    unpack.restore_state(sid)
                    stream['msfrag'] += unpack.getbytes()
                else:
                    # Next RPC packet is entirely within this TCP packet
                    # Re-position the file pointer to the current offset
                    pktt.offset = pktt.boffset
                    pktt._getfh().seek(pktt.offset)
            else:
                stream['frag_off'] = 0
Exemplo n.º 7
0
    def _decode_payload(self, pktt, stream):
        """Decode TCP payload."""
        rpc = None
        pkt = pktt.pkt
        unpack = pktt.unpack

        if 53 in [self.src_port, self.dst_port]:
            # DNS on port 53
            dns = DNS(pktt, proto=6)
            if dns:
                pkt.dns = dns
            return
        elif 88 in [self.src_port, self.dst_port]:
            # KRB5 on port 88
            krb = KRB5(pktt, proto=6)
            if krb:
                pkt.krb = krb
            return

        if stream.frag_off > 0 and len(stream.buffer) == 0:
            # This RPC packet lies within previous TCP packet,
            # Re-position the offset of the data
            unpack.seek(unpack.tell() + stream.frag_off)

        # Get the total size
        sid = unpack.save_state()
        size = unpack.size()

        # Try decoding the RPC header before using the stream buffer data
        # to re-sync the stream
        if len(stream.buffer) > 0:
            rpc = RPC(pktt, proto=6)
            if not rpc:
                unpack.restore_state(sid)
                sid = unpack.save_state()

        if rpc or (size == 0 and len(stream.buffer) > 0 and self.flags.rawflags != 0x10):
            # There has been some data lost in the capture,
            # to continue decoding next packets, reset stream
            # except if this packet is just a TCP ACK (flags = 0x10)
            stream.buffer = ""
            stream.frag_off = 0

        if not rpc:
            if len(stream.buffer):
                # Concatenate previous fragment
                unpack.insert(stream.buffer)
            ldata = unpack.size() - 4

            # Get RPC header
            rpc = RPC(pktt, proto=6)
        else:
            ldata = size - 4

        if not rpc:
            return

        rpcsize = rpc.fragment_hdr.size

        truncbytes = pkt.record.length_orig - pkt.record.length_inc
        if truncbytes == 0 and ldata < rpcsize:
            # An RPC fragment is missing to decode RPC payload
            unpack.restore_state(sid)
            stream.add_fragment(unpack.getbytes(), self.seq)
        else:
            if len(stream.buffer) > 0 or ldata == rpcsize:
                stream.frag_off = 0
            stream.buffer = ""
            # Save RPC layer on packet object
            pkt.rpc = rpc
            if rpc.type:
                # Remove packet call from the xid map since reply has
                # already been decoded
                pktt._rpc_xid_map.pop(rpc.xid, None)

            # Decode NFS layer
            rpcload = rpc.decode_payload()
            rpcbytes = ldata - unpack.size()
            if not rpcload and rpcbytes != rpcsize:
                pass
            elif unpack.size():
                # Save the offset of next RPC packet within this TCP packet
                # Data offset is cumulative
                stream.frag_off += size - unpack.size()
                sid = unpack.save_state()
                ldata = unpack.size() - 4
                try:
                    rpc_header = RPC(pktt, proto=6, state=False)
                except Exception:
                    rpc_header = None
                if not rpc_header or ldata < rpc_header.fragment_hdr.size:
                    # Part of next RPC packet is within this TCP packet
                    # Save the multi-span fragment data
                    unpack.restore_state(sid)
                    stream.add_fragment(unpack.getbytes(), self.seq)
                else:
                    # Next RPC packet is entirely within this TCP packet
                    # Re-position the file pointer to the current offset
                    pktt.seek(pktt.boffset)
            else:
                stream.frag_off = 0