admin/Sentinel-One-CobaltStrikeParser
1
0
Fork 0
mirror of https://github.com/Sentinel-One/CobaltStrikeParser synced 2026-06-21 13:45:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Adds unit-test for encrypted beacon x86_64

Browse Source
This commit is contained in:
Nicolas Bareil
2021-05-07 01:37:49 -07:00
parent fbf1e8f30d
commit 845f8269d5
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
samples/10fd211ba97ddf12aecb1e7931d92c3ba37421c362cb1490e0203c1bd88ec141.zip
BIN
View File
Binary file not shown.
test_parse_beacon_config.py
+11
View File
@@ -26,6 +26,17 @@ class TestBeaconParsing(unittest.TestCase):
parser = cobaltstrikeConfig(f)
conf = parser.parse_encrypted_config()
self.assertEqual(conf.get("HttpPostUri"), "/submit.php")
def test_encrypted_x86_64(self):
path = os.path.join(
os.path.dirname(__file__),
"samples",
"10fd211ba97ddf12aecb1e7931d92c3ba37421c362cb1490e0203c1bd88ec141.zip",
)
f = decrypt_sample(path)
parser = cobaltstrikeConfig(f)
conf = parser.parse_encrypted_config()
self.assertEqual(conf.get("PublicKey_MD5"), "d2c8ec15d925e2514714d619022f7cdf")
if __name__ == "__main__":