Skip to content

Commit c365db1

Browse files
author
Brent Cook
committed
pull in GUID fixes from rapid7#8818
1 parent 9877a61 commit c365db1

File tree

1 file changed

+9
-6
lines changed

1 file changed

+9
-6
lines changed

lib/rex/post/meterpreter/packet.rb

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,12 @@ module Meterpreter
129129
LOAD_LIBRARY_FLAG_EXTENSION = (1 << 1)
130130
LOAD_LIBRARY_FLAG_LOCAL = (1 << 2)
131131

132+
#
133+
# Sane defaults
134+
#
135+
GUID_SIZE = 16
136+
NULL_GUID = "\x00" * GUID_SIZE
137+
132138
###
133139
#
134140
# Base TLV (Type-Length-Value) class
@@ -670,13 +676,10 @@ class Packet < GroupTlv
670676
###
671677

672678
XOR_KEY_SIZE = 4
673-
SESSION_GUID_SIZE = 16
674679
ENCRYPTED_FLAGS_SIZE = 4
675680
PACKET_LENGTH_SIZE = 4
676681
PACKET_TYPE_SIZE = 4
677-
PACKET_HEADER_SIZE = XOR_KEY_SIZE + SESSION_GUID_SIZE + ENCRYPTED_FLAGS_SIZE + PACKET_LENGTH_SIZE + PACKET_TYPE_SIZE
678-
679-
SESSION_NULL_GUID = "\x00" * SESSION_GUID_SIZE
682+
PACKET_HEADER_SIZE = XOR_KEY_SIZE + GUID_SIZE + ENCRYPTED_FLAGS_SIZE + PACKET_LENGTH_SIZE + PACKET_TYPE_SIZE
680683

681684
AES_IV_SIZE = 16
682685

@@ -804,7 +807,7 @@ def aes_decrypt(key, iv, data)
804807
def to_r(session_guid = nil, key = nil)
805808
xor_key = (rand(254) + 1).chr + (rand(254) + 1).chr + (rand(254) + 1).chr + (rand(254) + 1).chr
806809

807-
raw = (session_guid || SESSION_NULL_GUID).dup
810+
raw = (session_guid || NULL_GUID).dup
808811
tlv_data = GroupTlv.instance_method(:to_r).bind(self).call
809812

810813
if key && key[:key] && key[:type] == ENC_FLAG_AES256
@@ -836,7 +839,7 @@ def decrypt_packet(key, encrypt_flags, data)
836839
end
837840

838841
def parse_header!
839-
xor_key = self.raw.unpack('A4')[0]
842+
xor_key = self.raw.unpack('a4')[0]
840843
data = xor_bytes(xor_key, self.raw[0..PACKET_HEADER_SIZE])
841844
_, self.session_guid, self.encrypt_flags, self.length, self.type = data.unpack('a4a16NNN')
842845
end

0 commit comments

Comments
 (0)