Merge pull request #33 from CERT-Polska/fix/ekans-rsa-keys

Fix ekans RSA key format
CERT-Polska · Jan 8, 2024 · 072f2cb · 072f2cb
2 parents 77df1a1 + fb920b3
commit 072f2cb
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 1 deletion.
diff --git a/src/modules.py b/src/modules.py
@@ -75,7 +75,7 @@ def add_rsa_key(iocs: IocCollection, config: Dict, key: str) -> None:
                 iocs.add_rsa_key(RsaKey(int(enckey[0]), int(enckey[1])))
                 continue
         if isinstance(enckey, str):
-            if "BEGIN PUBLIC" in enckey:
+            if "BEGIN PUBLIC" in enckey or "BEGIN RSA PUBLIC" in enckey:
                 iocs.try_add_rsa_from_pem(enckey)
                 continue
         if isinstance(enckey, str) and all(

diff --git a/tests/testdata/ekans_f5f0acf4248476e67e020bff15506fe8e48a71c00889a2848ef39b1987a260aa.json b/tests/testdata/ekans_f5f0acf4248476e67e020bff15506fe8e48a71c00889a2848ef39b1987a260aa.json
@@ -0,0 +1 @@
+{"type":"ekans","rsa_key":"-----BEGIN RSA PUBLIC KEY-----\nMIIBCgKCAQEAyQ+M5ve829umuy9+BSsUX/krgdF83L3m8/uxRvKX5EZbSh1+buON\nZYr5MjfhrdiOGnrbB1j0Fy31U/uzvWcy7VvK/zcsO/5aAhujhHB/qMAVpZ8zT5BB\nujT1Bvsith/BXgtM99MixD8oZ67VDZaRM9TPE89WuAjnaBZORrk48wFcn1DOAAHD\nZ9z9komtqIH1fm3Y0Q6P76nUscLsYOme082L217Th/lTMoqqs4cF2rn9O9Vp4V9U\naCs4XVxGSpcuqbIscfpf0cm44P2eOEk+sbZdahO9C6fezt7YF4OCJ4Vz3qqMD6z4\n+6d7FRxUu6k3Te2T2bWBZnsDO30pYFi/gwIDAQAB\n-----END RSA PUBLIC KEY-----\n","strings":{"in-blob":"16dc0ae82f3bc8290899d68a0fe6c5d76f074c0f47353347dbeba38b73fb560f"}}
diff --git a/tests/testdata/ekans_f5f0acf4248476e67e020bff15506fe8e48a71c00889a2848ef39b1987a260aa.txt b/tests/testdata/ekans_f5f0acf4248476e67e020bff15506fe8e48a71c00889a2848ef39b1987a260aa.txt
@@ -0,0 +1 @@
+RsaKey n=25381567485863868041796810054489967660897007371837694090604497494701502646327458177848059864906888287364974719104599406206737450616057452413935750248982712981010326001216710955010040913982033684013087457055974209818051996566924669433551522743987679736834836275417150571391300108532319429764878805389142671334922092167709993886648573291830525488976959868135483168390305921166640957763375059243269145814841054664283720591181900948438343817592367169495581445453014119738099701607196873105855081638703841829292743940335367284507037403962855570908012221620011764511625967277596629755748305769248889352354412170216056864643 e=65537