From 11b77b4153f6054aa9a7dc2651cf6a2447275e34 Mon Sep 17 00:00:00 2001
From: Kevin Robertson <robertsonk@gmail.com>
Date: Sun, 21 Aug 2016 22:49:56 -0400
Subject: Bug fixes

Hostname parsing and UDP client fixes.
---
 Scripts/Inveigh.ps1 | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

(limited to 'Scripts/Inveigh.ps1')

diff --git a/Scripts/Inveigh.ps1 b/Scripts/Inveigh.ps1
index ce67d6d..907a8e3 100644
--- a/Scripts/Inveigh.ps1
+++ b/Scripts/Inveigh.ps1
@@ -1621,8 +1621,20 @@ $sniffer_scriptblock =
                 
                             $LLMNR_query = [System.BitConverter]::ToString($payload_bytes[13..($payload_bytes.Length - 4)])
                             $LLMNR_query = $LLMNR_query -replace "-00",""
-                            $LLMNR_query = $LLMNR_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
-                            $LLMNR_query_string = New-Object System.String($LLMNR_query,0,$LLMNR_query.Length)
+
+                            if($LLMNR_query.Length -eq 2)
+                            {
+                                $LLMNR_query = [Char][System.Convert]::ToInt16($LLMNR_query,16)
+                                $LLMNR_query_string = New-Object System.String($LLMNR_query)
+                            }
+                            else
+                            {
+                                $LLMNR_query = $LLMNR_query.Split("-") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}
+                                $LLMNR_query_string = New-Object System.String($LLMNR_query,0,$LLMNR_query.Length)
+                            }
+
+                            
+                            $inveigh.console_queue.Add($LLMNR_query_string)
                 
                             if($LLMNR -eq 'Y')
                             {
-- 
cgit v1.2.3