Skip to content

fix: interaction data corruption causing unmarshal errors #1341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dogancanbakir merged 2 commits into from
Mar 4, 2026
Merged

fix: interaction data corruption causing unmarshal errors #1341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da91f8e
fix: interaction data corruption causing unmarshal errors
dogancanbakir Feb 26, 2026
70580fa
use jsoniter.Marshal in round-trip tests
dogancanbakir Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pkg/client/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -459,6 +459,7 @@ func (c *Client) getInteractions(callback InteractionCallback) error {
gologger.Error().Msgf("Could not decrypt interaction: %v\n", err)
continue
}
plaintext = bytes.TrimRight(plaintext, " \t\r\n")
interaction := &server.Interaction{}
if err := jsoniter.Unmarshal(plaintext, interaction); err != nil {
gologger.Error().Msgf("Could not unmarshal interaction data interaction: %v\n", err)
Expand Down
17 changes: 8 additions & 9 deletions pkg/server/dns_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package server

import (
"bytes"
"context"
"fmt"
"net"
Expand Down Expand Up @@ -295,12 +294,12 @@ func (h *DNSServer) handleInteraction(domain string, w dns.ResponseWriter, r *dn
h.options.OnResult(interaction)
}

buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode root tld dns interaction: %s\n", err)
} else {
gologger.Debug().Msgf("Root TLD DNS Interaction: \n%s\n", buffer.String())
if err := h.options.Storage.AddInteractionWithId(correlationID, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("Root TLD DNS Interaction: \n%s\n", string(data))
if err := h.options.Storage.AddInteractionWithId(correlationID, data); err != nil {
gologger.Warning().Msgf("Could not store dns interaction: %s\n", err)
}
}
Expand Down Expand Up @@ -348,12 +347,12 @@ func (h *DNSServer) handleInteraction(domain string, w dns.ResponseWriter, r *dn
RemoteAddress: host,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode dns interaction: %s\n", err)
} else {
gologger.Debug().Msgf("DNS Interaction: \n%s\n", buffer.String())
if err := h.options.Storage.AddInteraction(correlationID, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("DNS Interaction: \n%s\n", string(data))
if err := h.options.Storage.AddInteraction(correlationID, data); err != nil {
gologger.Warning().Msgf("Could not store dns interaction: %s\n", err)
}
}
Expand Down
9 changes: 4 additions & 5 deletions pkg/server/ftp_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package server

import (
"bytes"
"crypto/tls"
"fmt"
"io"
Expand Down Expand Up @@ -131,12 +130,12 @@ func (h *FTPServer) recordInteraction(remoteAddress, data string) {
RawRequest: data,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
dataBytes, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode ftp interaction: %s\n", err)
} else {
gologger.Debug().Msgf("FTP Interaction: \n%s\n", buffer.String())
if err := h.options.Storage.AddInteractionWithId(h.options.Token, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("FTP Interaction: \n%s\n", string(dataBytes))
if err := h.options.Storage.AddInteractionWithId(h.options.Token, dataBytes); err != nil {
gologger.Warning().Msgf("Could not store ftp interaction: %s\n", err)
}
}
Expand Down
17 changes: 8 additions & 9 deletions pkg/server/http_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package server

import (
"bytes"
"crypto/tls"
"encoding/base64"
"fmt"
Expand Down Expand Up @@ -158,12 +157,12 @@ func (h *HTTPServer) logger(handler http.Handler) http.HandlerFunc {
RemoteAddress: host,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode root tld http interaction: %s\n", err)
} else {
gologger.Debug().Msgf("Root TLD HTTP Interaction: \n%s\n", buffer.String())
if err := h.options.Storage.AddInteractionWithId(ID, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("Root TLD HTTP Interaction: \n%s\n", string(data))
if err := h.options.Storage.AddInteractionWithId(ID, data); err != nil {
gologger.Warning().Msgf("Could not store root tld http interaction: %s\n", err)
}
}
Expand Down Expand Up @@ -218,13 +217,13 @@ func (h *HTTPServer) handleInteraction(r *http.Request, uniqueID, fullID, reqStr
RemoteAddress: hostPort,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode http interaction: %s\n", err)
} else {
gologger.Debug().Msgf("HTTP Interaction: \n%s\n", buffer.String())
gologger.Debug().Msgf("HTTP Interaction: \n%s\n", string(data))

if err := h.options.Storage.AddInteraction(correlationID, buffer.Bytes()); err != nil {
if err := h.options.Storage.AddInteraction(correlationID, data); err != nil {
gologger.Warning().Msgf("Could not store http interaction: %s\n", err)
}
}
Expand Down
17 changes: 8 additions & 9 deletions pkg/server/ldap_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package server

import (
"bytes"
"crypto/tls"
"fmt"
"strings"
Expand Down Expand Up @@ -145,12 +144,12 @@ func (ldapServer *LDAPServer) handleInteraction(uniqueID, fullID, reqString, hos
RemoteAddress: host,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode ldap interaction: %s\n", err)
} else {
gologger.Debug().Msgf("LDAP Interaction: \n%s\n", buffer.String())
if err := ldapServer.options.Storage.AddInteraction(correlationID, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("LDAP Interaction: \n%s\n", string(data))
if err := ldapServer.options.Storage.AddInteraction(correlationID, data); err != nil {
gologger.Warning().Msgf("Could not store ldap interaction: %s\n", err)
}
}
Expand Down Expand Up @@ -411,12 +410,12 @@ func (ldapServer *LDAPServer) logInteraction(interaction Interaction) {
// Correlation id doesn't apply here, we skip encryption
interaction.Protocol = "ldap"
interaction.Timestamp = time.Now()
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode ldap interaction: %s\n", err)
} else {
gologger.Debug().Msgf("LDAP Interaction: \n%s\n", buffer.String())
if err := ldapServer.options.Storage.AddInteractionWithId(ldapServer.options.Token, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("LDAP Interaction: \n%s\n", string(data))
if err := ldapServer.options.Storage.AddInteractionWithId(ldapServer.options.Token, data); err != nil {
gologger.Warning().Msgf("Could not store ldap interaction: %s\n", err)
}
}
Expand Down
9 changes: 4 additions & 5 deletions pkg/server/responder_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package server

import (
"bytes"
"os"
"os/exec"
"path/filepath"
Expand Down Expand Up @@ -89,12 +88,12 @@ func (h *ResponderServer) ListenAndServe(responderAlive chan bool) error {
RawRequest: responderData,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode responder interaction: %s\n", err)
} else {
gologger.Debug().Msgf("Responder Interaction: \n%s\n", buffer.String())
if err := h.options.Storage.AddInteractionWithId(h.options.Token, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("Responder Interaction: \n%s\n", string(data))
if err := h.options.Storage.AddInteractionWithId(h.options.Token, data); err != nil {
gologger.Warning().Msgf("Could not store dns interaction: %s\n", err)
}
}
Expand Down
9 changes: 4 additions & 5 deletions pkg/server/smb_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package server

import (
"bytes"
"fmt"
"os"
"os/exec"
Expand Down Expand Up @@ -101,12 +100,12 @@ func (h *SMBServer) ListenAndServe(smbAlive chan bool) error {
RawRequest: smbData,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode smb interaction: %s\n", err)
} else {
gologger.Debug().Msgf("SMB Interaction: \n%s\n", buffer.String())
if err := h.options.Storage.AddInteractionWithId(h.options.Token, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("SMB Interaction: \n%s\n", string(data))
if err := h.options.Storage.AddInteractionWithId(h.options.Token, data); err != nil {
gologger.Warning().Msgf("Could not store dns interaction: %s\n", err)
}
}
Expand Down
17 changes: 8 additions & 9 deletions pkg/server/smtp_server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package server

import (
"bytes"
"crypto/tls"
"net"
"strings"
Expand Down Expand Up @@ -107,12 +106,12 @@ func (h *SMTPServer) defaultHandler(remoteAddr net.Addr, from string, to []strin
RemoteAddress: host,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode root tld SMTP interaction: %s\n", err)
} else {
gologger.Debug().Msgf("Root TLD SMTP Interaction: \n%s\n", buffer.String())
if err := h.options.Storage.AddInteractionWithId(ID, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("Root TLD SMTP Interaction: \n%s\n", string(data))
if err := h.options.Storage.AddInteractionWithId(ID, data); err != nil {
gologger.Warning().Msgf("Could not store root tld smtp interaction: %s\n", err)
}
}
Expand Down Expand Up @@ -148,12 +147,12 @@ func (h *SMTPServer) defaultHandler(remoteAddr net.Addr, from string, to []strin
RemoteAddress: host,
Timestamp: time.Now(),
}
buffer := &bytes.Buffer{}
if err := jsoniter.NewEncoder(buffer).Encode(interaction); err != nil {
data, err := jsoniter.Marshal(interaction)
if err != nil {
gologger.Warning().Msgf("Could not encode smtp interaction: %s\n", err)
} else {
gologger.Debug().Msgf("%s\n", buffer.String())
if err := h.options.Storage.AddInteraction(correlationID, buffer.Bytes()); err != nil {
gologger.Debug().Msgf("%s\n", string(data))
if err := h.options.Storage.AddInteraction(correlationID, data); err != nil {
gologger.Warning().Msgf("Could not store smtp interaction: %s\n", err)
}
}
Expand Down
Loading
Loading