Extracting Email Attachments

Zeek
1

Hello all,

New bro user here. I’m trying to understand how to enable email attachment extraction with bro. I see in smtp-entities the setting “extract-file” which by default is False. What is the right way to enable it and set the directory where these attachments will reside?

Thanks in advance!

Jason

2

## define the mime types you want extracted /.*/ means everything

redef SMTP::extract_file_types += /application\/*/;

## path where extracted attachments need to go:
redef SMTP::extraction_prefix = "/data/bro/extract/smtp-entity" ;

3

Based on Aashish’s recommendations, I added the following 4 lines to the end of my local.bro:

redef SMTP::extract_file_types += /application/*/;

redef SMTP::extraction_prefix = “/tmp/extracted_”;
redef SMTP::extract_file = T;
redef SMTP::calc_md5 = T;

While there are attachments listed in the smtp_entities.log, they have no MD5 hashes and have not been extracted to /tmp. What am I missing?

4

I think it should have been /application\/.*/ instead of /application\/*/ - I think
Aashish made a small typo there. Could you try adding the missing "."? :slight_smile:

Johanna

5

These two lines don't make any sense. Those names aren't globals, they are fields of the SMTP::EntityInfo record type. You can set them in certain situations but you shouldn't need to since the other lines you had should take care of what you're trying to do (once you have that little error that Johanna pointed out fixed).

  .Seth

6

I tried both:
redef SMTP::extract_file_types += /application/./;
and
redef SMTP::extract_file_types += /./;

But still end up with no attachments in /tmp, nor MD5s in the smtp_entities.log.

7

So apparently I was incorrect in thinking that local.bro was loading automatically when running bro from the command line. Including the local.bro policy successfully extracted the attachments.

What it also told me was that these two lines:
redef SMTP::extract_file = T;
redef SMTP::calc_md5 = T;

Are not valid. But poking around a little bit in entities.bro I found the generate_md5 mime-types and redefined that in the local.bro file.

Thanks for the help all!