attack_technique: T1090.001
display_name: 'Proxy: Internal Proxy'
atomic_tests:
- name: Connection Proxy
  auto_generated_guid: 0ac21132-4485-4212-a681-349e8a6637cd
  description: |
    Enable traffic redirection.

    Note that this test may conflict with pre-existing system configuration.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    proxy_server:
      description: Proxy server URL (host:port)
      type: Url
      default: 127.0.0.1:8080
    proxy_scheme:
      description: Protocol to proxy (http or https)
      type: String
      default: http
  executor:
    command: |
      export #{proxy_scheme}_proxy=#{proxy_server}
    cleanup_command: |
      unset http_proxy
      unset https_proxy
    name: sh
- name: Connection Proxy for macOS UI
  auto_generated_guid: 648d68c1-8bcd-4486-9abe-71c6655b6a2c
  description: |
    Enable traffic redirection on macOS UI (not terminal).
    The test will modify and enable the "Web Proxy" and "Secure Web Proxy" settings  in System Preferences => Network => Advanced => Proxies for the specified network interface.
    
    Note that this test may conflict with pre-existing system configuration.
  supported_platforms:
    - macos
  input_arguments:
    proxy_server:
      description: Proxy server URL (host)
      type: Url
      default: 127.0.0.1
    proxy_port:
      description: Proxy server port
      type: Integer
      default: 8080
    interface:
      description: Protocol to proxy (http or https)
      type: String
      default: Wi-Fi
  executor:
    name: sh
    command: |
      networksetup -setwebproxy #{interface} #{proxy_server} #{proxy_port}
      networksetup -setsecurewebproxy #{interface} #{proxy_server} #{proxy_port}
    cleanup_command: |
      networksetup -setwebproxystate #{interface} off
      networksetup -setsecurewebproxystate #{interface} off  
- name: portproxy reg key
  auto_generated_guid: b8223ea9-4be2-44a6-b50a-9657a3d4e72a
  description: |
    Adds a registry key to set up a proxy on the endpoint at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
    Upon execution there will be a new proxy entry in netsh
    netsh interface portproxy show all
  supported_platforms:
  - windows
  input_arguments:
    connectaddress:
      description: Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer.
      type: String
      default: 127.0.0.1
    connectport:
      description: Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer.
      type: String
      default: "1337"
    listenport:
      description: Specifies the IPv4 port, by port number or service name, on which to listen.
      type: String
      default: "1337"
  executor:
    command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport} connectaddress=#{connectaddress}
    cleanup_command: netsh interface portproxy delete v4tov4 listenport=#{listenport} -ErrorAction Ignore | Out-Null
    name: powershell
    elevation_required: true
