CSEC_PUBLIC/hayabusa
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

指摘されたところ

Browse Source
This commit is contained in:
kazuminn
2020-11-02 16:15:44 +09:00
parent 1fcf025a06
commit 73fa8090f0
1 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/detections/utils.rs
View File

@@ -56,20 +56,18 @@ pub fn check_command(
let re = Regex::new(r"'.*$").unwrap(); let re = Regex::new(r"'.*$").unwrap();
base64.push_str(&re.replace_all(&base64.to_string(), "")); base64.push_str(&re.replace_all(&base64.to_string(), ""));
} }
if !base64.is_empty() { if let Ok(decoded) = base64::decode(&base64) {
if Regex::new(r"Compression.GzipStream.*Decompress") if !base64.is_empty() {
.unwrap() if Regex::new(r"Compression.GzipStream.*Decompress")
.is_match(commandline) .unwrap()
{ .is_match(commandline)
if let Ok(decoded) = base64::decode(&base64) { {
let mut d = GzDecoder::new(decoded.as_slice()); let mut d = GzDecoder::new(decoded.as_slice());
let mut uncompressed = String::new(); let mut uncompressed = String::new();
d.read_to_string(&mut uncompressed).unwrap(); d.read_to_string(&mut uncompressed).unwrap();
println!("Decoded : {}", uncompressed); println!("Decoded : {}", uncompressed);
text.push_str("Base64-encoded and compressed function\n"); text.push_str("Base64-encoded and compressed function\n");
} } else {
} else {
if let Ok(decoded) = base64::decode(&base64) {
println!("Decoded : {}", str::from_utf8(decoded.as_slice()).unwrap()); println!("Decoded : {}", str::from_utf8(decoded.as_slice()).unwrap());
text.push_str("Base64-encoded function\n"); text.push_str("Base64-encoded function\n");
text.push_str(&check_obfu(str::from_utf8(decoded.as_slice()).unwrap())); text.push_str(&check_obfu(str::from_utf8(decoded.as_slice()).unwrap()));