diff --git a/atomics/Indexes/containers-index.yaml b/atomics/Indexes/containers-index.yaml index 8657a87e..6024a3e0 100644 --- a/atomics/Indexes/containers-index.yaml +++ b/atomics/Indexes/containers-index.yaml @@ -26814,6 +26814,10 @@ execution: description: Command to run type: string default: uname + path: + description: Path to busybox.yaml file + type: string + default: "$PathtoAtomicsFolder/T1609/src/busybox.yaml" dependencies: - description: 'kubectl must be installed @@ -26826,7 +26830,9 @@ execution: ' executor: command: | - kubectl create -f src/busybox.yaml -n #{namespace} + kubectl create -f #{path} -n #{namespace} + # wait 3 seconds for the instance to come up + sleep 3 kubectl exec -n #{namespace} busybox -- #{command} cleanup_command: 'kubectl delete pod busybox -n #{namespace} diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index e154904a..4e59c68d 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -46394,6 +46394,10 @@ execution: description: Command to run type: string default: uname + path: + description: Path to busybox.yaml file + type: string + default: "$PathtoAtomicsFolder/T1609/src/busybox.yaml" dependencies: - description: 'kubectl must be installed @@ -46406,7 +46410,9 @@ execution: ' executor: command: | - kubectl create -f src/busybox.yaml -n #{namespace} + kubectl create -f #{path} -n #{namespace} + # wait 3 seconds for the instance to come up + sleep 3 kubectl exec -n #{namespace} busybox -- #{command} cleanup_command: 'kubectl delete pod busybox -n #{namespace} diff --git a/atomics/T1609/T1609.md b/atomics/T1609/T1609.md index 101ce6bc..1c4ad788 100644 --- a/atomics/T1609/T1609.md +++ b/atomics/T1609/T1609.md @@ -30,13 +30,16 @@ Attackers who have permissions, can run malicious commands in containers in the |------|-------------|------|---------------| | namespace | K8s namespace to use | string | default| | command | Command to run | string | uname| +| path | Path to busybox.yaml file | string | $PathtoAtomicsFolder/T1609/src/busybox.yaml| #### Attack Commands: Run with `bash`! ```bash -kubectl create -f src/busybox.yaml -n #{namespace} +kubectl create -f #{path} -n #{namespace} +# wait 3 seconds for the instance to come up +sleep 3 kubectl exec -n #{namespace} busybox -- #{command} ```