1 #include "config.h"
2 #include <stdlib.h>
3 #include <stdio.h>
4 #include <stdarg.h>
5 #ifdef RZB_PDF_FOX_NUGGET
6 #include <razorback/log.h>
7 #include <razorback/types.h>
8 #include <razorback/metadata.h>
9 #include <razorback/api.h>
10 #endif
11
12 #include "foxreport.h"
13
14 const char *reg = "<?xml version=\"1.0\"?>"
15 "<razorback>\n<registration>"
16 "<nugget_id>1ceb82dd-543b-4117-a9d8-45768e38f310</nugget_id>"
17 "<application_type>d721e5f0-a5b7-4cea-9eae-4111117d72c4</application_type>"
18 "<data_types>"
19 "<data_type>PDF_FILE</data_type>"
20 "</data_types>"
21 "</registration>\n</razorback>\n";
22
23
24 const char *RZBAlert = "<?xml version=\"1.0\"?>"
25 "<razorback>"
26 "<response>"
27 "<verdict priority=\"2\" gid=\"6969\" sid=\"1\">"
28 "<flags>"
29 "<sourcefire>"
30 "<set>128</set>"
31 "<unset>0</unset>"
32 "</sourcefire>"
33 "<enterprise>"
34 "<set>0</set>"
35 "<unset>0</unset>"
36 "</enterprise>"
37 "</flags>"
38 "<message>%s</message>"
39 "<metadata>"
40 "<entry>"
41 "<type>REPORT</type>"
42 "<data>PDF Fox: Message contains more information on the error.</data>"
43 "</entry>"
44 "</metadata>"
45 "</verdict>"
46 "</response>"
47 "</razorback>\n";
48
49
registerWithRZB()50 void registerWithRZB () {
51 printf("%s", reg);
52 exit(1);
53 }
54
55 //#define PDF_FOX_COMMAND_LINE
56
57 /*
58 *
59 * Reports Errors
60 *
61 */
foxLog(REPORTMODE type,const char * fmt,...)62 void foxLog (REPORTMODE type, const char *fmt, ...)
63 {
64 char *msg = NULL;
65
66 va_list argp;
67 va_start (argp, fmt);
68
69 if (vasprintf (&msg, fmt, argp) == -1)
70 return;
71
72 switch(type) {
73 case PRINT:
74 #ifdef PDF_FOX_COMMAND_LINE
75 printf("%s", msg);
76 #endif
77 #ifdef RZB_PDF_FOX_NUGGET
78 #endif
79 break;
80 case FATAL:
81 #ifdef PDF_FOX_COMMAND_LINE
82 printf("[FATAL] %s", msg);
83 exit(-1);
84 #endif
85 #ifdef RZB_PDF_FOX_NUGGET
86 rzb_log(LOG_ERR, "Shutting Down Context. %s", msg);
87 #endif
88 break;
89
90 case NONFATAL:
91 #ifdef PDF_FOX_SHOW_NONFATAL
92 #ifdef PDF_FOX_COMMAND_LINE
93 printf("[NONFATAL] %s", msg);
94 #endif
95 #ifdef RZB_PDF_FOX_NUGGET
96 rzb_log(LOG_ERR, "%s", msg);
97 #endif
98 #endif
99 break;
100
101 case PDF_DEBUG:
102 #ifdef PDF_FOX_SHOW_DEBUG
103 #ifdef PDF_FOX_COMMAND_LINE
104 printf("[PDF_DEBUG] %s", msg);
105 #endif
106 #ifdef RZB_PDF_FOX_NUGGET
107 rzb_log(LOG_DEBUG, "%s", msg);
108 #endif
109 #endif
110 break;
111 }
112
113 va_end (argp);
114 if (msg != NULL)
115 free (msg);
116 }
117
118 #ifdef PDF_FOX_COMMAND_LINE
foxReport(const char * msg,const char * cve,uint32_t sid,uint32_t sfflags,uint32_t entflags,uint32_t priority)119 void foxReport(const char *msg, const char *cve, uint32_t sid, uint32_t sfflags, uint32_t entflags, uint32_t priority) {
120 printf("ALERT: Malicious PDF found.\nMessage: %s %s\nsid: %d\n", cve, msg, sid);
121 }
122 #endif
123 #ifdef RZB_PDF_FOX_NUGGET
124 #include <razorback/judgment.h>
125 #include <razorback/types.h>
126
127 static struct Judgment *judgment;
128
initPDFFoxJudgment(struct Judgment * incoming)129 void initPDFFoxJudgment (struct Judgment *incoming){
130
131 judgment = incoming;
132 judgment->iGID = 9;
133
134 }
135
136 /**For razorback reporting,
137 * We'll need several pieces of data...
138 *
139 * Message, sid, flags, priority...
140 *
141 * All of this depends on the vuln in question...
142 */
143
foxReport(const char * msg,const char * cve,uint32_t sid,uint32_t sfflags,uint32_t entflags,uint32_t priority)144 void foxReport(const char *msg, const char *cve, uint32_t sid, uint32_t sfflags, uint32_t entflags, uint32_t priority) {
145 judgment->sMessage = (uint8_t *)msg;
146 judgment->iSID = sid;
147 judgment->Set_SfFlags = sfflags;
148 judgment->Set_EntFlags = entflags;
149 judgment->iPriority = priority;
150 Metadata_Add_CVE(judgment->pMetaDataList, cve);
151 Razorback_Render_Verdict(judgment);
152 }
153 #endif
154