Statically inject x-forward-for into IIS messages

Comments (1)

• 

  kmschramm

  • Leave a comment

  This section was my latest attempt to try to inject something into the message.

  Exec $Message = $Message + $x-forwarded-for + ' ' + '8.8.8.8';

  Here is what is currently in the config.

  Panic Soft

  define ROOT C:\Program Files\nxlog

  ModuleDir %ROOT%\modules
  CacheDir %ROOT%\data
  SpoolDir %ROOT%\data

  #define CERTDIR %ROOT%\cert
  #define CONFDIR %ROOT%\conf

  # Note that these two lines define constants only; the log file location
  # is ultimately set by the `LogFile` directive (see below). The
  # `MYLOGFILE` define is also used to rotate the log file automatically
  # (see the `_fileop` block).

  define LOGDIR %ROOT%\data
  define MYLOGFILE %LOGDIR%\nxlog.log

  # By default, `LogFile %MYLOGFILE%` is set in log4ensics.conf. This
  # allows the log file location to be modified via NXLog Manager. If you
  # are not using NXLog Manager, you can instead set `LogFile` below and
  # disable the `include` line.
  #include %CONFDIR%\log4ensics.conf

  LogFile %MYLOGFILE%
  Logfile %LOGDIR%\nxlog.log

  <Extension _syslog>
  Module xm_syslog
  </Extension>

  # This block rotates `%MYLOGFILE%` on a schedule. Note that if `LogFile`
  # is changed in log4ensics.conf via NXLog Manager, rotation of the new
  # file should also be configured there.

  <Extension _fileop>
  Module xm_fileop

  # Check the size of our log file hourly, rotate if larger than 5MB
  <Schedule>
  Every 1 hour
  <Exec>
  if ( file_exists('%MYLOGFILE%') and
  (file_size('%MYLOGFILE%') >= 5M) )
  {
  file_cycle('%MYLOGFILE%', 8);
  }
  </Exec>
  </Schedule>

  # Rotate our log file every week on Sunday at midnight
  <Schedule>
  When @weekly
  Exec if file_exists('%MYLOGFILE%') file_cycle('%MYLOGFILE%', 8);
  </Schedule>
  </Extension>

  <Extension json>
  Module xm_json
  </Extension>

  <Extension w3c>
  Module xm_csv
  Fields $date, $time, $s_ip, $cs_method, $cs_uri_stem, $cs_uri_query, $s_port, $cs_username, #$c_ip, $cs_User_Agent, $cs_Referer, $sc_status, $sc_substatus, $sc_win32_status, $X-Forwarded-For
  FieldTypes string, string, string, string, string, string, integer, string, string, string, #string, integer, integer, integer, string
  Delimiter ' '

  </Extension>

  <Extension resolver>
  Module xm_resolver
  </Extension>

  <Extension fileops>
  Module xm_fileop
  </Extension>

  <Input in_iis>
  Module im_file
  File '\\viis01\c$\inetpub\logs\LogFiles\W3SVC2\u_ex*'
  InputType LineBased
  SavePos TRUE
  Exec if $raw_event =~ /^#/ drop(); \
  else \
  { \
  w3c->parse_csv(); \
  $EventTime = parsedate($date + " " + $time); \
  $SourceName = "IIS"; \
  $raw_event = to_json(); \
  }
  Exec $Message = $Message + $x-forwarded-for + ' ' + '8.8.8.8';
  </Input>

  <Output out_iis>
  Module om_udp
  Host 192.168.10.103
  Port 10130
  OutputType Dgram
  Exec to_syslog_bsd();
  </Output>

  <Route IIS>
  Path in_iis => out_iis
  </Route>

  November 4, 2020 - 12:30pm