3 ms·
How could it edit browser history? I never did any Ruby but what I understands from it is that it take the process argument (if null, it take one at random fro
by dwild 11y ago
How could it edit browser history?
I never did any Ruby but what I understands from it is that it take the process argument (if null, it take one at random from that array, seems like default values to test, bad idea but nothing that seems to be their only purpose as that argument is way more useful), it then take path argument (again same stuff with possible default values), the size argument (again but 123456789 as default) and write all that into a string including the current timestamp, which I guess is then added to a file.
As far as I know, there's no standard way to serialize browser history and I doubt it would contains the process and the size of the file.
There's another method that do that in reverse, I guess to then parse that same string.
If I had a guess, I would say that this the part that serialize/deserialize log information from evidence gathering (the actual gathering would happen elsewhere, which I can't find right now, and would call that module to serialize it).
- smoe 11y agoI think you are right. You can find the actual evidence gathering on the clients like in this file, where it's also enriched with metadata and encoded the same way the ruby script does (at least to me, not a c++ programmer, it seems to be the case). https://github.com/hackedteam/soldier-win/blob/master/Soldier/url.cpp#L1085 https://github.com/hackedteam/soldier-win/blob/master/Soldie... Also, while there are plenty of functions for getting data from the target device like `URL_GetBrowserHistory` there are as far i can tell, no obvious equivalents for putting them.