security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Generate docs from job=validate_atomics_generate_docs branch=master

Browse Source
This commit is contained in:
CircleCI Atomic Red Team doc generator
2019-11-13 23:42:50 +00:00
parent b22483e2f1
commit 5dbf1b7864
4 changed files with 96 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1090/T1090.md
+30
View File
@@ -10,6 +10,8 @@ Internal connection proxies can be used to consolidate internal connections from
- [Atomic Test #1 - Connection Proxy](#atomic-test-1---connection-proxy)
- [Atomic Test #2 - portproxy reg key](#atomic-test-2---portproxy-reg-key)
<br/>
@@ -40,3 +42,31 @@ unset https_proxy
```
<br/>
<br/>
## Atomic Test #2 - portproxy reg key
Adds a registry key to set up a proxy on the endpoint at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
**Supported Platforms:** Windows
#### Inputs
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| listenport | Specifies the IPv4 port, by port number or service name, on which to listen. | string | 1337|
| connectport | Specifies the IPv4 port, by port number or service name, to which to connect. If connectport is not specified, the default is the value of listenport on the local computer. | string | 1337|
| connectaddress | Specifies the IPv4 address to which to connect. Acceptable values are IP address, computer NetBIOS name, or computer DNS name. If an address is not specified, the default is the local computer. | string | 127.0.0.1|
#### Run it with `powershell`! Elevation Required (e.g. root or admin)
```
netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport} connectaddress=#{connectaddress}
```
#### Cleanup Commands:
```
netsh interface portproxy delete v4tov4 listenport=#{listenport}
```
<br/>
atomics/index.md
+2
View File
@@ -183,6 +183,7 @@
- Atomic Test #1: Component Object Model Hijacking [windows]
- [T1090 Connection Proxy](./T1090/T1090.md)
- Atomic Test #1: Connection Proxy [macos, linux]
- Atomic Test #2: portproxy reg key [windows]
- [T1196 Control Panel Items](./T1196/T1196.md)
- Atomic Test #1: Control Panel Items [windows]
- [T1207 DCShadow](./T1207/T1207.md)
@@ -869,6 +870,7 @@
- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1090 Connection Proxy](./T1090/T1090.md)
- Atomic Test #1: Connection Proxy [macos, linux]
- Atomic Test #2: portproxy reg key [windows]
- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1132 Data Encoding](./T1132/T1132.md)
atomics/index.yaml
+62 -2
View File
@@ -5923,9 +5923,39 @@ defense-evasion:
command: 'export #{proxy_scheme}_proxy=#{proxy_server}
'
cleanup_command: |-
cleanup_command: |
unset http_proxy
unset https_proxy
- name: portproxy reg key
description: |
Adds a registry key to set up a proxy on the endpoint at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
supported_platforms:
- windows
input_arguments:
listenport:
description: Specifies the IPv4 port, by port number or service name, on
which to listen.
type: string
default: 1337
connectport:
description: Specifies the IPv4 port, by port number or service name, to
which to connect. If connectport is not specified, the default is the
value of listenport on the local computer.
type: string
default: 1337
connectaddress:
description: Specifies the IPv4 address to which to connect. Acceptable
values are IP address, computer NetBIOS name, or computer DNS name. If
an address is not specified, the default is the local computer.
type: string
default: 127.0.0.1
executor:
name: powershell
elevation_required: true
command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport}
connectaddress=#{connectaddress}
cleanup_command: netsh interface portproxy delete v4tov4 listenport=#{listenport}
T1196:
technique:
x_mitre_permissions_required:
@@ -24113,9 +24143,39 @@ command-and-control:
command: 'export #{proxy_scheme}_proxy=#{proxy_server}
'
cleanup_command: |-
cleanup_command: |
unset http_proxy
unset https_proxy
- name: portproxy reg key
description: |
Adds a registry key to set up a proxy on the endpoint at
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4
supported_platforms:
- windows
input_arguments:
listenport:
description: Specifies the IPv4 port, by port number or service name, on
which to listen.
type: string
default: 1337
connectport:
description: Specifies the IPv4 port, by port number or service name, to
which to connect. If connectport is not specified, the default is the
value of listenport on the local computer.
type: string
default: 1337
connectaddress:
description: Specifies the IPv4 address to which to connect. Acceptable
values are IP address, computer NetBIOS name, or computer DNS name. If
an address is not specified, the default is the local computer.
type: string
default: 127.0.0.1
executor:
name: powershell
elevation_required: true
command: netsh interface portproxy add v4tov4 listenport=#{listenport} connectport=#{connectport}
connectaddress=#{connectaddress}
cleanup_command: netsh interface portproxy delete v4tov4 listenport=#{listenport}
T1132:
technique:
x_mitre_data_sources:
atomics/windows-index.md
+2
View File
@@ -24,6 +24,7 @@
- [T1122 Component Object Model Hijacking](./T1122/T1122.md)
- Atomic Test #1: Component Object Model Hijacking [windows]
- [T1090 Connection Proxy](./T1090/T1090.md)
- Atomic Test #2: portproxy reg key [windows]
- [T1196 Control Panel Items](./T1196/T1196.md)
- Atomic Test #1: Control Panel Items [windows]
- [T1207 DCShadow](./T1207/T1207.md)
@@ -620,6 +621,7 @@
- T1043 Commonly Used Port [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1092 Communication Through Removable Media [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1090 Connection Proxy](./T1090/T1090.md)
- Atomic Test #2: portproxy reg key [windows]
- T1094 Custom Command and Control Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1024 Custom Cryptographic Protocol [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1132 Data Encoding](./T1132/T1132.md)