Module: FIDIUS::EvasionDB::LogMatchesHelper

Defined in:
lib/evasion-db/log_matches_helper.rb

Overview

This helper is indented to find matches between logged packets and idmef-events by comparing their payload.

Class Method Summary collapse

Class Method Details

.find_packets_for_event(event, packets) ⇒ hash

tries to find the packet which generated the given event

Parameters:

  • a (IdmefEvent) —

    certain idmef event

  • Array (Array) —

    of Packet

Returns:

  • (hash) —

    :packet=>:index,:length index and length are indicating where the match between both payloads is.



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/evasion-db/log_matches_helper.rb', line 23

def self.find_packets_for_event(event,packets)
  event_payload = nil
  return unless event.payload
  if event.payload.size > 0
    event_payload = self.to_hex(event.payload).gsub("\\x","")
  end
  return unless event_payload

  packets.each do |packet|
    str = nil
    # lets find the payload of the prelude event
    # in one of the logged payloads
    packet_payload = self.to_hex(packet.payload).gsub("\\x","")
    str = packet_payload[event_payload]
    return {:packet=>packet,:index=>packet.payload.index(event.payload),:length=>event.payload.size} if str != nil
  end
  nil
end

.to_hex(str, prefix = "\\x", count = 1) ⇒ Object

this method is from Rex::Text of metasploit

Raises:

  • (::RuntimeError) 


8
9
10
11
12
13
14
15
16
 
# File 'lib/evasion-db/log_matches_helper.rb', line 8

def self.to_hex(str, prefix = "\\x", count = 1)
 raise ::RuntimeError, "unable to chunk into #{count} byte chunks" if ((str.length % count) > 0)

 # XXX: Regexp.new is used here since using /.{#{count}}/o would compile
 # the regex the first time it is used and never check again.  Since we
 # want to know how many to capture on every instance, we do it this
 # way.
 return str.unpack('H*')[0].gsub(Regexp.new(".{#{count * 2}}", nil, 'n')) { |s| prefix + s }
end