diff --git a/lib/rex/post/meterpreter/packet.rb b/lib/rex/post/meterpreter/packet.rb index 372324381f..692ffe90e8 100644 --- a/lib/rex/post/meterpreter/packet.rb +++ b/lib/rex/post/meterpreter/packet.rb @@ -673,11 +673,12 @@ class Packet < GroupTlv # def to_r raw = super - xor_key = rand(254) + 1 - xor_key |= (rand(254) + 1) << 8 - xor_key |= (rand(254) + 1) << 16 - xor_key |= (rand(254) + 1) << 24 - result = [xor_key].pack('N') + xor_bytes(xor_key, raw) + xor_key = '' + xor_key << (rand(254) + 1).chr + xor_key << (rand(254) + 1).chr + xor_key << (rand(254) + 1).chr + xor_key << (rand(254) + 1).chr + result = xor_key + xor_bytes(xor_key, raw) result end @@ -688,7 +689,7 @@ class Packet < GroupTlv # the TLV values. # def from_r(bytes) - xor_key = bytes[0,4].unpack('N')[0] + xor_key = bytes[0,4] super(xor_bytes(xor_key, bytes[4, bytes.length])) end @@ -697,7 +698,7 @@ class Packet < GroupTlv # def xor_bytes(xor_key, bytes) result = '' - bytes.bytes.zip([xor_key].pack('V').bytes.cycle).each do |b| + bytes.bytes.zip(xor_key.bytes.cycle).each do |b| result << (b[0].ord ^ b[1].ord).chr end result diff --git a/lib/rex/post/meterpreter/packet_parser.rb b/lib/rex/post/meterpreter/packet_parser.rb index 5b33c7b7c5..3fcf34f1fa 100644 --- a/lib/rex/post/meterpreter/packet_parser.rb +++ b/lib/rex/post/meterpreter/packet_parser.rb @@ -57,7 +57,7 @@ class PacketParser # payload length left to the number of bytes # specified in the length if (self.hdr_length_left == 0) - xor_key = raw[0, 4].unpack('N')[0] + xor_key = raw[0, 4] length_bytes = packet.xor_bytes(xor_key, raw[4, 4]) # header size doesn't include the xor key, which is always tacked on the front self.payload_length_left = length_bytes.unpack("N")[0] - (HEADER_SIZE - 4)