Adds smb test for ticket 5770

diff --git a/tests/smb-length-5770/README.md b/tests/smb-length-5770/README.md
new file mode 100644 (file)
index 0000000..38d8a80
--- /dev/null
+++ b/tests/smb-length-5770/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test SMB evasion with write data length bigger than NBSS record length
+
+# PCAP
+
+The pcap comes from running MacOS with a shared SMB directory named public (with user toto and password toto).
+There is a proxy on port 4445 that rewrites the smb2 write command if the file data begins by 'E' to have a bigger field length.

diff --git a/tests/smb-length-5770/input.pcap b/tests/smb-length-5770/input.pcap
new file mode 100644 (file)
index 0000000..d025e46
Binary files /dev/null and b/tests/smb-length-5770/input.pcap differ

diff --git a/tests/smb-length-5770/proxy_smb2.py b/tests/smb-length-5770/proxy_smb2.py
new file mode 100644 (file)
index 0000000..2ce5f7d
--- /dev/null
+++ b/tests/smb-length-5770/proxy_smb2.py
@@ -0,0 +1,40 @@
+import sys
+import binascii
+from threading import Thread
+import time
+import socket
+
+
+
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.bind(("127.0.0.1", 4445))
+s.listen(1)
+conn, addr = s.accept()
+s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+print("accpeted, now connecting")
+s2.connect(("127.0.0.1", 445))
+print("connected")
+ok = True
+while ok:
+    data = conn.recv(32768)
+    print("received", len(data), data[16])
+    if len(data) == 0:
+        break
+    data = bytearray(data)
+    changed = 0
+    if data[16] == 9:
+        # write request
+        print("write", data[116])
+        if data[116] == 69:
+            # if the first letter of payload is E
+            # let's add 65536 to the length
+            data[74] = data[74] + 1
+            print("modified", binascii.hexlify(data))
+    s2.send(data)
+    resp = s2.recv(32768)
+    print("response", len(resp))
+    resp = bytearray(resp)
+    conn.send(resp)
+
+conn.close()
+s.close()

diff --git a/tests/smb-length-5770/test.yaml b/tests/smb-length-5770/test.yaml
new file mode 100644 (file)
index 0000000..82a00aa
--- /dev/null
+++ b/tests/smb-length-5770/test.yaml
@@ -0,0 +1,11 @@
+# disables checksum verification
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: fileinfo
+        fileinfo.filename: "toto.txt"
+        dest_port: 445