Red Hat NETWORK 3.6 - Guía de usuario descargar pdf (Pagina 39)

In each of these cases, the plugin would not match if the patterns contained in these “not”

statements were present. For example, in the first pmatch statement, if the pattern

“pattern” were present, then the plugin would not match. In the second statement, the

binary pattern of “AAA” (the letter “A” in ASCII hex is 0x41) would match only if it were not

presenting the first three characters.

Time Dependent Plugins

The last plugin example shows some more advanced features of the PVS plugin language

that allows a plugin to be time dependent as well as make use of the evaluation of other

plugins. The plugin shows how the PVS can detect an anonymous FTP server. The NEXT

keyword is used to separate plugins the plugin file.

id=1018

nooutput

hs_sport=21

name=Anonymous FTP (login: ftp)

pmatch=^USER ftp

match=^331

NEXT #-----------------------------------------------------------

id=1019

dependency=1018

timed-dependency=5

hs_sport=21

name=Anonymous FTP enabled

description=The remote FTP server has anonymous access enabled.

risk=LOW

pmatch=^PASS

match=^230

Since we are trying to detect an anonymous FTP server we are going to be looking for the

following traffic pattern:

USER ftp

1) FTP client -----------------------> FTP server

331 Guest login ok, ...

2) FTP client <----------------------- FTP server

PASS [email protected]

3) FTP client -----------------------> FTP server

230 Logged in

4) FTP client <----------------------- FTP server

Here we cannot use a single plugin to detect this entire session. So, instead we use two

plugins: the first plugin looks for packets 1) and 2) and the second plugin looks for packets

3) and 4).

A review of the above plugin shows that plugin 1018 matches 1) and 2) in the session by

keying on the patterns “USER ftp” and the 331 return code. Plugin 1019 matches on 3) and

4) by keying on the patterns “PASS” and the 230 return code.

1 2 ... 34 35 36 37 38 39 40 41 42 43 44 ... 60 61

Sin comentarios

Red Hat NETWORK 3.6 - Guía de usuario Pagina 39