From fbf1e8f30d003c679fe763a59151e0c31f7a2a33 Mon Sep 17 00:00:00 2001
From: Nicolas Bareil <nicolas.bareil@airbus.com>
Date: Fri, 7 May 2021 01:29:27 -0700
Subject: [PATCH] Merging decrypt_beacons()

---
 beacon_utils.py        |  4 +++-
 parse_beacon_config.py | 33 ---------------------------------
 2 files changed, 3 insertions(+), 34 deletions(-)

diff --git a/beacon_utils.py b/beacon_utils.py
index 2102004..1e5b7ea 100644
--- a/beacon_utils.py
+++ b/beacon_utils.py
@@ -55,7 +55,10 @@ def get_beacon_data(url, arch):
     eicar_offset = buf.find(b'EICAR-STANDARD-ANTIVIRUS-TEST-FILE')
     if eicar_offset != -1:
         return buf
+    return decrypt_beacon(buf)
 
+
+def decrypt_beacon(buf):
     offset = buf.find(b'\xff\xff\xff')
     if offset == -1:
         _cli_print('[-] Unexpected buffer received')
@@ -74,5 +77,4 @@ def get_beacon_data(url, arch):
             b = struct.unpack_from('<I', buf, i*4+4)[0]
             с = a ^ b
             decoded_data += struct.pack('<I', с)
-
         return decoded_data
diff --git a/parse_beacon_config.py b/parse_beacon_config.py
index e7a71b2..ede029e 100644
--- a/parse_beacon_config.py
+++ b/parse_beacon_config.py
@@ -473,39 +473,6 @@ class cobaltstrikeConfig:
 
 
     def parse_encrypted_config_non_pe(self, version=None, quiet=False, as_json=False):
-        def xor(a, b):
-            return bytearray([a[0]^b[0], a[1]^b[1], a[2]^b[2], a[3]^b[3]])
-        # All credits to @Te-k: Shameless rip of https://github.com/Te-k/cobaltstrike/blob/master/lib.py
-        def decrypt_beacon(data):
-            # Find the base address
-            if data.startswith(b"\xfc\xe8"):
-                # 32 bits
-                # The base address of the sample change depending on the code
-                ba = data.find(b"\xe8\xd4\xff\xff\xff")
-                if ba == -1:
-                    ba = data.find(b"\xe8\xd0\xff\xff\xff")
-                    if ba == -1:
-                        return None
-                ba += 5
-            elif data.startswith(b"\xfc\x48"):
-                # 64 bits
-                ba = data.find(b"\xe8\xc8\xff\xff\xff")
-                if ba == -1:
-                    return None
-                ba += 5
-            else:
-                return None
-            key = data[ba:ba+4]
-            size = struct.unpack("I", xor(key, data[ba+4:ba+8]))[0]
-            # Decrypt
-            res = bytearray()
-            i = ba+8
-            while i < (len(data) - ba - 8):
-                d = data[i:i+4]
-                res += xor(d, key)
-                key = d
-                i += 4
-            return res
         self.data = decrypt_beacon(self.data)
         return self.parse_config(version=version, quiet=quiet, as_json=as_json)