File tree Expand file tree Collapse file tree 1 file changed +7
-0
lines changed
modules/post/windows/gather Expand file tree Collapse file tree 1 file changed +7
-0
lines changed Original file line number Diff line number Diff line change @@ -319,8 +319,15 @@ def run
319
319
if val_arr . include? ( hash )
320
320
data = registry_getvaldata ( regpath , hash )
321
321
dec = decrypt_reg ( url , data )
322
+
323
+ # If CryptUnprotectData fails, decrypt_reg() will return "", and unpack() will end up
324
+ # returning an array of nils. If this happens, we can cause an "undefined method
325
+ # `+' for NilClass." when we try to calculate the offset, and this causes the module to die.
326
+ next if dec . empty?
327
+
322
328
#decode data and add to creds array
323
329
header = dec . unpack ( "VVVVVV" )
330
+
324
331
offset = header [ 0 ] + header [ 1 ] #offset to start of data
325
332
cnt = header [ 5 ] /2 # of username/password combinations
326
333
secrets = dec [ offset , dec . length -( offset + 1 ) ] . split ( "\x00 \x00 " )
You can’t perform that action at this time.
0 commit comments