diff --git a/dissect/cobaltstrike/beacon.py b/dissect/cobaltstrike/beacon.py index 9eef340..35f75f4 100644 --- a/dissect/cobaltstrike/beacon.py +++ b/dissect/cobaltstrike/beacon.py @@ -794,7 +794,7 @@ def settings_map(self, index_type="enum", pretty=False, parse=True) -> MappingPr for setting in self.settings_tuple: val = setting.value if index_type == "name": - key = setting.index.name + key = setting.index.name or str(setting.index) elif index_type == "const": key = setting.index.value else: diff --git a/tests/test_beacon.py b/tests/test_beacon.py index adc1b67..4f0e7b0 100644 --- a/tests/test_beacon.py +++ b/tests/test_beacon.py @@ -311,3 +311,15 @@ def test_beacon_domains_punycode(punycode_beacon_file): assert bconfig.domains == ["kçi.com"] assert bconfig.domains[0].encode("idna") == b"xn--ki-4ia.com" assert b"k\xe7i.com" in bconfig.raw_settings["SETTING_DOMAINS"] + + +def test_beacon_setting_unknown_enum(): + setting = ( + beacon.cs_struct.uint16(6969).dumps(), + beacon.SettingsType.TYPE_PTR.dumps(), + beacon.cs_struct.uint16(3).dumps(), + b"foo", + ) + config = beacon.BeaconConfig(b"".join(setting)) + assert None not in config.settings + assert dict(config.settings) == {"BeaconSetting.6969": b"foo"}