2
ettercap -- dissector mountd (NFS) -- RPC
4
Copyright (C) 2001 ALoR <alor@users.sourceforge.net>, NaGA <crwm@freemail.it>
6
This program is free software; you can redistribute it and/or modify
7
it under the terms of the GNU General Public License as published by
8
the Free Software Foundation; either version 2 of the License, or
9
(at your option) any later version.
11
This program is distributed in the hope that it will be useful,
12
but WITHOUT ANY WARRANTY; without even the implied warranty of
13
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14
GNU General Public License for more details.
16
You should have received a copy of the GNU General Public License
17
along with this program; if not, write to the Free Software
18
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
20
$Id: ec_dissector_mountd.c,v 1.3 2002/04/12 15:59:15 alor Exp $
23
#include "include/ec_main.h"
25
#include "include/ec_dissector.h"
26
#include "include/ec_inet_structures.h"
30
int SID_MAP_TCP[XID_LEN];
31
int versions_tcp[XID_LEN];
32
char *REM_DIRS_TCP[XID_LEN];
34
int SID_MAP_UDP[XID_LEN];
35
int versions_udp[XID_LEN];
36
char *REM_DIRS_UDP[XID_LEN];
40
FUNC_DISSECTOR(Dissector_mountdUDP);
41
FUNC_DISSECTOR(Dissector_mountdTCP);
43
// ==========================================================
46
FUNC_DISSECTOR(Dissector_mountdTCP)
52
tcp = (TCP_header *) data;
53
buf = (char *)((int)tcp + tcp->doff * 4);
55
if (data_to_ettercap->datalen==0) return (0);
57
type = *(int *)(buf+8);
58
XID = *(int *)(buf+4);
60
sprintf(data_to_ettercap->type, "mountd");
62
if (ntohs(tcp->source) != SERV_PORT)
64
int program,proc,version;
66
program = *(int *)(buf + 16);
67
proc = *(int *)(buf + 24);
68
version = *(int *)(buf + 20);
71
if (type == 0 && ntohl(program) == 100005 && ntohl(proc) == 1 )
75
DEBUG_MSG("\tDissector_mountd TCP - CALL");
77
for (i=0; i<XID_LEN; i++)
78
if (!SID_MAP_TCP[i]) break;
80
if (i==XID_LEN) return (0);
83
cred = *(int *)(buf + 32);
85
len = *(int *)(buf+44+cred);
91
REM_DIRS_TCP[i] = calloc(1, ntohl(len)+1);
92
memcpy(REM_DIRS_TCP[i], buf+48+cred, ntohl(len));
93
versions_tcp[i]=version;
99
if ( ntohl(type) == 1 )
101
int i, len,result,offs;
104
DEBUG_MSG("\tDissector_mountd TCP - REPLY");
106
for (i=0; i<XID_LEN; i++)
107
if (SID_MAP_TCP[i]==XID) break;
109
if (i==XID_LEN) return (0);
113
result = *(int *)(buf+28);
116
free(REM_DIRS_TCP[i]);
117
return (0); //Unautorized
120
outstr = data_to_ettercap->info;
121
snprintf(outstr, sizeof(data_to_ettercap->info), "NFS SERVER: %s FHANDLE: %s [", data_to_ettercap->source_ip, REM_DIRS_TCP[i]);
123
free(REM_DIRS_TCP[i]);
125
if (ntohl(versions_tcp[i])==3)
127
len = *(int *)(buf+32);
138
for (i=0; i<len-1; i++)
139
snprintf(outstr, sizeof(data_to_ettercap->info), "%s%.2x ", outstr, buf[i+offs]);
141
snprintf(outstr, sizeof(data_to_ettercap->info), "%s%.2x]\n", outstr, buf[i+offs]);
143
sprintf(data_to_ettercap->user, "\n");
144
sprintf(data_to_ettercap->pass, "\n");
151
FUNC_DISSECTOR(Dissector_mountdUDP)
157
udp = (UDP_header *) data;
158
buf = data + UDP_HEADER;
160
type = *(int *)(buf+4);
163
sprintf(data_to_ettercap->type,"mountd");
165
if (ntohs(udp->source) != SERV_PORT)
167
int program,proc,version;
169
program = *(int *)(buf+12);
170
proc = *(int *)(buf+20);
171
version = *(int *)(buf+16);
174
if (type == 0 && ntohl(program) == 100005 && ntohl(proc) == 1 )
178
DEBUG_MSG("\tDissector_mountd UDP - CALL");
180
for (i=0; i<XID_LEN; i++)
181
if (!SID_MAP_UDP[i]) break;
183
if (i==XID_LEN) return (0);
185
SID_MAP_UDP[i] = XID;
186
cred = *(int *)(buf+28);
188
len = *(int *)(buf+40+cred);
194
REM_DIRS_UDP[i] = calloc(1, ntohl(len)+1);
195
memcpy(REM_DIRS_UDP[i], buf+44+cred, ntohl(len));
196
versions_udp[i] = version;
202
if ( ntohl(type) == 1 )
204
int i, len, offs,result;
207
DEBUG_MSG("\tDissector_mountd UCP - REPLY");
209
for (i=0; i<XID_LEN; i++)
210
if (SID_MAP_UDP[i]==XID) break;
212
if (i==XID_LEN) return (0);
216
result = *(int *)(buf+24);
219
free(REM_DIRS_UDP[i]);
220
return (0); //Unautorized
223
outstr = data_to_ettercap->info;
224
snprintf(outstr, sizeof(data_to_ettercap->info), "NFS SERVER: %s FHANDLE: %s [", data_to_ettercap->source_ip, REM_DIRS_UDP[i]);
226
free(REM_DIRS_UDP[i]);
228
if (ntohl(versions_udp[i]) == 3)
230
len = *(int *)(buf+28);
232
if (len>64) len = 64;
241
for (i=0; i<len-1; i++)
242
snprintf(outstr, sizeof(data_to_ettercap->info), "%s%.2x ", outstr, buf[i+offs]);
244
snprintf(outstr, sizeof(data_to_ettercap->info), "%s%.2x]\n", outstr, buf[i+offs]);
246
sprintf(data_to_ettercap->user, "\n");
247
sprintf(data_to_ettercap->pass, "\n");
252
// vim:ts=3:expandtab