airwoflgh
commented
8 years ago This seems intentional, at least from the code point of view. When sniff() finds a previous attempt it only supports a single previous attempt in the for loop and breaks when one is found.
Would have to change attempt to be a list and iterate through them for your similar sequences configuration to operate.
attempt = NULL;
/* look for this guy in our attempts list */
for(lp = attempts; lp; lp = lp->next) {
knocker_t *att = (knocker_t*)lp->data;
if(!strncmp(att->src, srcIP, sizeof(srcIP)) &&
!strncmp(att->door->target ? att->door->target : myip, dstIP, sizeof(dstIP))) {
attempt = att;
break;
}
}
if(attempt) {
jalbstmeijer
Hi,
It seems that matching sequences is very linear and will not match when sequences start in a similar way.
Is this a feature or bug?
Gr, J
with the following config:
[sequence1] sequence = 2001,2002,2003,2011 seq_timeout = 15 tcpflags = syn start_command = date
[sequence2] sequence = 2001,2002,2003,2012 seq_timeout = 15 tcpflags = syn start_command = date
[sequence3] sequence = 2001,2002,2003,2013 seq_timeout = 15 tcpflags = syn start_command = date
[sequence4] sequence = 2001,2002,2003,2014 seq_timeout = 15 tcpflags = syn start_command = date
and the following actions:
knock -d5 123.123.123.123 2001 2002 2003 2011 knock -d5 123.123.123.123 2001 2002 2003 2012 knock -d5 123.123.123.123 2001 2002 2003 2013 knock -d5 123.123.123.123 2001 2002 2003 2014
I see:
[2014-11-12 15:26] 54.72.48.222: sequence1: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence2: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence3: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence4: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 2 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 3 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 4 [2014-11-12 15:26] 54.72.48.222: sequence1: OPEN SESAME [2014-11-12 15:26] sequence1: running command: date
[2014-11-12 15:26] 54.72.48.222: sequence1: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence2: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence3: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence4: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 2 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 3
[2014-11-12 15:26] 54.72.48.222: sequence1: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence2: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence3: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence4: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 2 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 3
[2014-11-12 15:26] 54.72.48.222: sequence1: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence2: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence3: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence4: Stage 1 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 2 [2014-11-12 15:26] 54.72.48.222: sequence1: Stage 3