CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix decode's optional

Browse Source
This commit is contained in:
kazuminn
2020-10-31 22:36:52 +09:00
parent 52a165ea19
commit 1fcf025a06
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/detections/utils.rs
View File

@@ -61,24 +61,22 @@ pub fn check_command(
.unwrap() .unwrap()
.is_match(commandline) .is_match(commandline)
{ {
/* if let Ok(decoded) = base64::decode(&base64) {
if let decoded = base64::decode(&base64) {
let mut d = GzDecoder::new(decoded.as_slice()); let mut d = GzDecoder::new(decoded.as_slice());
let mut uncompressed = String::new(); let mut uncompressed = String::new();
d.read_to_string(&mut uncompressed).unwrap(); d.read_to_string(&mut uncompressed).unwrap();
println!("Decoded : {}", uncompressed); println!("Decoded : {}", uncompressed);
text.push_str("Base64-encoded and compressed function\n"); text.push_str("Base64-encoded and compressed function\n");
} }
*/
} else { } else {
let decoded = base64::decode(base64).unwrap(); if let Ok(decoded) = base64::decode(&base64) {
println!("Decoded : {}", str::from_utf8(decoded.as_slice()).unwrap()); println!("Decoded : {}", str::from_utf8(decoded.as_slice()).unwrap());
text.push_str("Base64-encoded function\n"); text.push_str("Base64-encoded function\n");
text.push_str(&check_obfu(str::from_utf8(decoded.as_slice()).unwrap())); text.push_str(&check_obfu(str::from_utf8(decoded.as_slice()).unwrap()));
text.push_str(&check_regex(str::from_utf8(decoded.as_slice()).unwrap(), 0)); text.push_str(&check_regex(str::from_utf8(decoded.as_slice()).unwrap(), 0));
} }
} }
}
if !text.is_empty() { if !text.is_empty() {
println!("EventID : {}", event_id); println!("EventID : {}", event_id);
if servicecmd != 0 { if servicecmd != 0 {