Windows msh exe insertion fix.
Ylian Saint-Hilaire committed
Dec 16, 2020 at 11:23 UTC
f2a52d27df8e360a0dc429220adbf574fe4e184a
2 files changed
+11
-10
exeHandler.js
+8
-7
@@ -87,6 +87,7 @@ module.exports.streamExeWithMeshPolicy = function (options) {
87
if (!options.destinationStream) { throw ('destination stream was not specified'); }
88
if (!options.sourceFileName) { throw ('source file not specified'); }
89
if (!options.msh) { throw ('msh content not specified'); }
90
+ options.mshbuf = Buffer.from(options.msh, 'utf8');
91
92
// If a Windows binary, parse it if not already parsed
93
if ((options.platform == 'win32') && (!options.peinfo)) { options.peinfo = module.exports.parseWindowsExecutable(options.sourceFileName); }
@@ -98,9 +99,9 @@ module.exports.streamExeWithMeshPolicy = function (options) {
99
options.destinationStream.sourceStream.options = options;
100
options.destinationStream.sourceStream.on('end', function () {
101
// Once the binary is streamed, write the msh + length + guid in that order.
101
- this.options.destinationStream.write(this.options.msh); // MSH
102
+ this.options.destinationStream.write(this.options.mshbuf); // MSH
103
var sz = Buffer.alloc(4);
103
- sz.writeUInt32BE(this.options.msh.length, 0);
104
+ sz.writeUInt32BE(this.options.mshbuf.length, 0);
105
this.options.destinationStream.write(sz); // Length in small endian
106
this.options.destinationStream.end(Buffer.from((this.options.randomPolicy === true) ? exeNullPolicyGuid : exeMeshPolicyGuid, 'hex')); // Guid
107
});
@@ -109,9 +110,9 @@ module.exports.streamExeWithMeshPolicy = function (options) {
110
} else if (options.platform == 'win32' && options.peinfo.CertificateTableAddress != 0) {
111
// Read up to the certificate table size and stream that out
112
options.destinationStream.sourceStream = require('fs').createReadStream(options.sourceFileName, { flags: 'r', start: 0, end: options.peinfo.CertificateTableSizePos - 1 });
112
- options.destinationStream.sourceStream.mshPadding = (8 - ((options.peinfo.certificateDwLength + options.msh.length + 20) % 8)) % 8; // Compute the padding with quad-align
113
- options.destinationStream.sourceStream.CertificateTableSize = (options.peinfo.CertificateTableSize + options.msh.length + 20 + options.destinationStream.sourceStream.mshPadding); // Add to the certificate table size
114
- options.destinationStream.sourceStream.certificateDwLength = (options.peinfo.certificateDwLength + options.msh.length + 20 + options.destinationStream.sourceStream.mshPadding); // Add to the certificate size
113
+ options.destinationStream.sourceStream.mshPadding = (8 - ((options.peinfo.certificateDwLength + options.mshbuf.length + 20) % 8)) % 8; // Compute the padding with quad-align
114
+ options.destinationStream.sourceStream.CertificateTableSize = (options.peinfo.CertificateTableSize + options.mshbuf.length + 20 + options.destinationStream.sourceStream.mshPadding); // Add to the certificate table size
115
+ options.destinationStream.sourceStream.certificateDwLength = (options.peinfo.certificateDwLength + options.mshbuf.length + 20 + options.destinationStream.sourceStream.mshPadding); // Add to the certificate size
116
options.destinationStream.sourceStream.options = options;
117
118
options.destinationStream.sourceStream.on('end', function () {
@@ -138,9 +139,9 @@ module.exports.streamExeWithMeshPolicy = function (options) {
139
source3.on('end', function () {
140
// We've sent the entire binary... Now send: Padding + MSH + MSHLength + GUID
141
if (this.mshPadding > 0) { this.options.destinationStream.write(Buffer.alloc(this.mshPadding)); } // Padding
141
- this.options.destinationStream.write(this.options.msh); // MSH content
142
+ this.options.destinationStream.write(this.options.mshbuf); // MSH content
143
var sz = Buffer.alloc(4);
143
- sz.writeUInt32BE(this.options.msh.length, 0);
144
+ sz.writeUInt32BE(this.options.mshbuf.length, 0);
145
this.options.destinationStream.write(sz); // MSH Length, small-endian
146
this.options.destinationStream.end(Buffer.from((this.options.randomPolicy === true) ? exeNullPolicyGuid : exeMeshPolicyGuid, 'hex')); // Guid
147
});
webserver.js
+3
-3
@@ -4325,7 +4325,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4325
if (domain.agentcustomization.companyname != null) { meshsettings += 'companyName=' + domain.agentcustomization.companyname + '\r\n'; }
4326
if (domain.agentcustomization.servicename != null) { meshsettings += 'meshServiceName=' + domain.agentcustomization.servicename + '\r\n'; }
4327
}
4328
- //if (parent.agentTranslations != null) { meshsettings += 'translation=' + parent.agentTranslations + '\r\n'; }
4328
+ if (parent.agentTranslations != null) { meshsettings += 'translation=' + parent.agentTranslations + '\r\n'; }
4329
setContentDispositionHeader(res, 'application/octet-stream', meshfilename, null, argentInfo.rname);
4330
obj.parent.exeHandler.streamExeWithMeshPolicy({ platform: 'win32', sourceFileName: obj.parent.meshAgentBinaries[req.query.id].path, destinationStream: res, msh: meshsettings, peinfo: obj.parent.meshAgentBinaries[req.query.id].pe });
4331
}
@@ -4632,7 +4632,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4632
if (domain.agentcustomization.companyname != null) { meshsettings += 'companyName=' + domain.agentcustomization.companyname + '\r\n'; }
4633
if (domain.agentcustomization.servicename != null) { meshsettings += 'meshServiceName=' + domain.agentcustomization.servicename + '\r\n'; }
4634
}
4635
- //if (parent.agentTranslations != null) { meshsettings += 'translation=' + parent.agentTranslations + '\r\n'; }
4635
+ if (parent.agentTranslations != null) { meshsettings += 'translation=' + parent.agentTranslations + '\r\n'; }
4636
4637
// Setup the response output
4638
var archive = require('archiver')('zip', { level: 5 }); // Sets the compression method.
@@ -4731,7 +4731,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4731
if (domain.agentcustomization.companyname != null) { meshsettings += 'companyName=' + domain.agentcustomization.companyname + '\r\n'; }
4732
if (domain.agentcustomization.servicename != null) { meshsettings += 'meshServiceName=' + domain.agentcustomization.servicename + '\r\n'; }
4733
}
4734
- //if (parent.agentTranslations != null) { meshsettings += 'translation=' + parent.agentTranslations + '\r\n'; }
4734
+ if (parent.agentTranslations != null) { meshsettings += 'translation=' + parent.agentTranslations + '\r\n'; }
4735
return meshsettings;
4736
}
4737