Skip to content

Commit df83114

Browse files
author
jvazquez-r7
committed
2 parents 9d439b6 + a95425d commit df83114

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

modules/post/windows/gather/enum_ie.rb

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,8 +319,15 @@ def run
319319
if val_arr.include?(hash)
320320
data = registry_getvaldata(regpath, hash)
321321
dec = decrypt_reg(url, data)
322+
323+
# If CryptUnprotectData fails, decrypt_reg() will return "", and unpack() will end up
324+
# returning an array of nils. If this happens, we can cause an "undefined method
325+
# `+' for NilClass." when we try to calculate the offset, and this causes the module to die.
326+
next if dec.empty?
327+
322328
#decode data and add to creds array
323329
header = dec.unpack("VVVVVV")
330+
324331
offset = header[0] + header[1] #offset to start of data
325332
cnt = header[5]/2 # of username/password combinations
326333
secrets = dec[offset,dec.length-(offset + 1)].split("\x00\x00")

0 commit comments

Comments
 (0)