Sentinel-One/CobaltStrikeParser

improper md5 calculation

kingofcurry opened this issue · 1 comments

hey thanks for the great tool

By the way, I think the MD5 calculation of the public key in "parse_beacon_config.py" is inappropriate.

Where CB's public key is supposed to be 256 bytes, you have an implementation that removes consecutive null-bytes at the start and end of the public key.
If the implementation is as it is, MD5 will be calculated from the key length shorter than 256 bytes.

If you comment out "conf_data = conf_data.strip(b'\x00')" on line 244, you should be able to calculate an appropriate MD5.

Sincerely

Hey, thanks for opening this issue, you're totally correct :)
Got it fixed now