Keep the client and the server on tracked tcp sessions
parent
88b35a32e5
commit
536fa39ae8
|
@ -162,8 +162,8 @@ class SnifferSMB < BaseProtocolParser
|
|||
"\nNTHASH:#{s[:ntlmhash]}\n"
|
||||
print_status(logmessage)
|
||||
|
||||
src_ip = s[:host]
|
||||
dst_ip = s[:session].split("-")[1].split(":")[0]
|
||||
src_ip = s[:client_host]
|
||||
dst_ip = s[:host]
|
||||
# know this is ugly , last code added :-/
|
||||
smb_db_type_hash = case ntlm_ver
|
||||
when "NTLMv1" then "smb_netv1_hash"
|
||||
|
|
|
@ -177,12 +177,12 @@ class BaseProtocolParser
|
|||
sessions[sessionid][:mtime] = Time.now
|
||||
else
|
||||
# Create a new session entry along with the host/port from the id
|
||||
if (sessionid =~ /^([^:]+):([^-]+)-/s)
|
||||
if (sessionid =~ /^([^:]+):([^-]+)-([^:]+):(\d+)$/s)
|
||||
sessions[sessionid] = {
|
||||
:host => $1,
|
||||
:target_host => $1,
|
||||
:port => $2,
|
||||
:target_port => $2,
|
||||
:client_host => $1,
|
||||
:client_port => $2,
|
||||
:host => $3,
|
||||
:port => $4,
|
||||
:session => sessionid,
|
||||
:ctime => Time.now,
|
||||
:mtime => Time.now
|
||||
|
|
Loading…
Reference in New Issue