Extract files from SMTP

Zeek
1

Hello All,

I’ve been using bro now for a good few months and I still feel like a complete noob. I need to extract out mime types in smtp traffic - I am looking to extract docx files from our last few weeks of pcaps to then go check for embedded TIFF files (latest 0 day out on MS apps). Time is not on my side at the moment - management is bothered about this one for some reason.

I am running from git master and cannot seem to figure out how the new file handling works. Has anyone done something like this recently after the file handling change and would be willing to share?

Once I get the docx files extracted my intent was to use yara to look for tiffs then foremost to carve any out.

Regards,

Derek

2

Hey Derek,

Attached is a script to dump “All files” out to disk; you would want to modify that and check to see if they are “SMTP” first.

The documentation here should have enough examples to get you started:

http://www.bro.org/sphinx-git/frameworks/file-analysis.html

Hope all is well buddy.

Thanks,

Liam Randall

extract-all-files.bro (83 Bytes)