diff --git a/C2_Profiles/httpx/httpx/c2_code/webserver/transforms.go b/C2_Profiles/httpx/httpx/c2_code/webserver/transforms.go index 4a27865..b7d4fdd 100644 --- a/C2_Profiles/httpx/httpx/c2_code/webserver/transforms.go +++ b/C2_Profiles/httpx/httpx/c2_code/webserver/transforms.go @@ -22,13 +22,23 @@ func transformBase64URL(prev []byte, value string) ([]byte, error) { return []byte(base64.URLEncoding.EncodeToString(prev)), nil } func transformBase64URLReverse(prev []byte, value string) ([]byte, error) { - decodedLength := base64.URLEncoding.DecodedLen(len(prev)) - decoded := make([]byte, decodedLength) - actualDecoded, err := base64.URLEncoding.Decode(decoded, prev) - if err != nil { + if len(prev) > 0 && prev[len(prev)-1] == '=' { + decodedLength := base64.URLEncoding.DecodedLen(len(prev)) + decoded := make([]byte, decodedLength) + actualDecoded, err := base64.URLEncoding.Decode(decoded, prev) + if err == nil { + return decoded[:actualDecoded], nil + } + return nil, err + } else { + decodedLength := base64.RawURLEncoding.DecodedLen(len(prev)) + decoded := make([]byte, decodedLength) + actualDecoded, err := base64.RawURLEncoding.Decode(decoded, prev) + if err == nil { + return decoded[:actualDecoded], nil + } return nil, err } - return decoded[:actualDecoded], nil } func transformPrepend(prev []byte, value string) ([]byte, error) { diff --git a/C2_Profiles/httpx/httpx/c2functions/transforms.go b/C2_Profiles/httpx/httpx/c2functions/transforms.go index a5f6633..e7ae70c 100644 --- a/C2_Profiles/httpx/httpx/c2functions/transforms.go +++ b/C2_Profiles/httpx/httpx/c2functions/transforms.go @@ -24,15 +24,26 @@ func transformBase64URL(prev []byte, value string) ([]byte, error) { return []byte(base64.URLEncoding.EncodeToString(prev)), nil } func transformBase64URLReverse(prev []byte, value string) ([]byte, error) { - decodedLength := base64.URLEncoding.DecodedLen(len(prev)) - decoded := make([]byte, decodedLength) - actualDecoded, err := base64.URLEncoding.Decode(decoded, prev) - if err != nil { + if len(prev) > 0 && prev[len(prev)-1] == '=' { + decodedLength := base64.URLEncoding.DecodedLen(len(prev)) + decoded := make([]byte, decodedLength) + actualDecoded, err := base64.URLEncoding.Decode(decoded, prev) + if err == nil { + return decoded[:actualDecoded], nil + } + return nil, err + } else { + decodedLength := base64.RawURLEncoding.DecodedLen(len(prev)) + decoded := make([]byte, decodedLength) + actualDecoded, err := base64.RawURLEncoding.Decode(decoded, prev) + if err == nil { + return decoded[:actualDecoded], nil + } return nil, err } - return decoded[:actualDecoded], nil } + func transformPrepend(prev []byte, value string) ([]byte, error) { return append([]byte(value), prev...), nil }