remove unused logging code

corelight · Apr 28, 2022 · 76ca330 · 76ca330
1 parent c679fe8
commit 76ca330
Showing 1 changed file with 0 additions and 36 deletions.
diff --git a/scripts/main.zeek b/scripts/main.zeek
@@ -1,19 +1,10 @@
 module CVE_2022_26809;
 
 export {
-	redef enum Log::ID += {
-		LOG
-	};
 	redef enum Notice::Type += {
 		ExploitAttempt,
 		ExploitSuccess
 	};
-	type Info: record {
-		ts: time &log;
-		uid: string &log;
-		regex: string &log;
-		data: string &log;
-	};
 }
 
 # Malicious byte strings
@@ -93,26 +84,6 @@ function sec_addr_is_zero(data: string, regex: pattern): bool
 	return sec_addr_len == 0;
 }
 
-# Should work if Zeek parsed malformed Bind ACKs correctly.
-event dce_rpc_bind_ack(c: connection, fid: count, sec_addr: string)
-{
-	local pkt = get_current_packet();
-	if ( big_endian_specific in pkt$data && correct_frag_length(pkt$data,
-	    big_endian_specific) )
-		Log::write(LOG, Info(
-		    $ts=network_time(),
-		    $uid=c$uid,
-		    $regex="big_endian_specific",
-		    $data=pkt$data));
-	if ( big_endian in pkt$data && correct_frag_length(pkt$data,
-	    big_endian_specific) )
-		Log::write(LOG, Info(
-		    $ts=network_time(),
-		    $uid=c$uid,
-		    $regex="big_endian",
-		    $data=pkt$data));
-}
-
 # Exploit Bind ACKs are malformed, so we have to detect here.
 event dce_rpc_message(c: connection, is_orig: bool, fid: count, ptype_id: count,
     ptype: DCE_RPC::PType)
@@ -138,10 +109,3 @@ event dce_rpc_message(c: connection, is_orig: bool, fid: count, ptype_id: count,
 		    $identifier=cat(c$id$orig_h, c$id$resp_h)]);
 	}
 }
-
-event zeek_init() &priority=5
-{
-	Log::create_stream(CVE_2022_26809::LOG, [
-	    $columns=Info,
-	    $path="cve_2022_26809_dce_rpc_bind_ack_data"]);
-}