Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement simple compression / encoding of meterpreter stages #8387

Closed
busterb opened this issue May 15, 2017 · 2 comments
Closed

Implement simple compression / encoding of meterpreter stages #8387

busterb opened this issue May 15, 2017 · 2 comments

Comments

@busterb
Copy link
Member

busterb commented May 15, 2017

This is especially evident in x64 mettle payloads, but because the payloads include padding, the elf2bin payload blobs are a lot larger than they need to be. A 700k elf file becomes almost 3MB on the wire because we literally transfer all of the padding null bytes into the target memory image. This is a similar story with Python meterpreter where quite a bit is whitespace.

It would be nice if there was some simple compression/encoding stagers could implement to transfer stages in a smaller way. Zlib might be too big, but even a RLE (Run Length Encoding) transfer would cut down on size substantially. If we're ok with a C-based stager, there are probably a lot more things we could try.

@itsmeroy2012
Copy link
Contributor

The stagers in the python payloads are base64 encoded. Can we implement the same in case of the stages because base64 encoding is provided as a direct function in python. @busterb @zeroSteiner

@busterb
Copy link
Member Author

busterb commented Mar 28, 2019

We shrunk the null pages, but it's not nearly as bad as it was. Definitely improved enough for my initial complaint.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

2 participants