From 2662831fab5ab70dc60b372f684e839c29a16700 Mon Sep 17 00:00:00 2001 From: evilsocket Date: Thu, 27 Mar 2025 04:56:39 +0100 Subject: [PATCH] fix: removing bash escape sequences from stdout before sending it as api response --- modules/api_rest/api_rest_controller.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/api_rest/api_rest_controller.go b/modules/api_rest/api_rest_controller.go index e4e4261d..af2c3b99 100644 --- a/modules/api_rest/api_rest_controller.go +++ b/modules/api_rest/api_rest_controller.go @@ -8,6 +8,7 @@ import ( "io/ioutil" "net/http" "os" + "regexp" "strconv" "strings" @@ -17,6 +18,10 @@ import ( "github.com/gorilla/mux" ) +var ( + ansiEscapeRegex = regexp.MustCompile(`\x1b\[[0-9;]*[a-zA-Z]`) +) + type CommandRequest struct { Command string `json:"cmd"` } @@ -236,7 +241,8 @@ func (mod *RestAPI) runSessionCommand(w http.ResponseWriter, r *http.Request) { out, _ := io.ReadAll(stdoutReader) os.Stdout = rescueStdout - mod.toJSON(w, APIResponse{Success: true, Message: string(out)}) + // remove ANSI escape sequences (bash color codes) from output + mod.toJSON(w, APIResponse{Success: true, Message: ansiEscapeRegex.ReplaceAllString(string(out), "")}) } func (mod *RestAPI) getEvents(limit int) []session.Event {