Merge pull request #20 from kw2583/startbytes

Cobalt Strike v4 starting bytes

parse_beacon_config.py

@@ -41,9 +41,9 @@ class confConsts:
 
     START_PATTERNS = {
     3: b'\x69\x68\x69\x68\x69\x6b..\x69\x6b\x69\x68\x69\x6b..\x69\x6a',
-    4: b'\x2e\x2f\x2e\x2f\x2e\x2c..\x2e\x2c\x2e\x2f\x2e\x2c..\x2e'
+    4: b'\x2e\x2f\x2e\x2f\x2e...\x2e\x2c\x2e\x2f'
     }
-    START_PATTERN_DECODED = b'\x00\x01\x00\x01\x00\x02..\x00\x02\x00\x01\x00\x02..\x00'
+    START_PATTERN_DECODED = b'\x00\x01\x00\x01\x00...\x00\x02\x00\x01\x00'
     CONFIG_SIZE = 4096
     XORBYTES = {
     3: 0x69,

test_parse_beacon_config.py

@@ -74,6 +74,18 @@ class TestBeaconParsing(unittest.TestCase):
         self.assertEqual(conf.get("Retry_Increase_Attempts"), 0)
         self.assertEqual(conf.get("Retry_Duration"), 0)
 
+    def test_csv4_startbytes(self):
+        path = os.path.join(
+            os.path.dirname(__file__),
+            "samples",
+            "5cd19717831e5259d535783be33f86ad7e77f8df25cd8f342da4f4f33327d989.zip",
+        )
+        f = decrypt_sample(path)
+        parser = cobaltstrikeConfig(f)
+        conf = parser.parse_config()
+        self.assertNotEqual(conf, None)
+
+
 
 if __name__ == "__main__":
     unittest.main()