diff --git a/atomics/T1027.001/T1027.001.yaml b/atomics/T1027.001/T1027.001.yaml index a84f631e..47608365 100644 --- a/atomics/T1027.001/T1027.001.yaml +++ b/atomics/T1027.001/T1027.001.yaml @@ -4,7 +4,7 @@ atomic_tests: - name: Pad Binary to Change Hash - Linux/macOS dd auto_generated_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a description: | - Uses dd to add a zero to the binary to change the hash. + Uses dd to add a zero byte, high-quality random data, and low-quality random data to the binary to change the hash. Upon successful execution, dd will modify `/tmp/evil-binary`, therefore the expected hash will change. supported_platforms: @@ -25,7 +25,37 @@ atomic_tests: cp /bin/ls #{file_to_pad} executor: command: | - dd if=/dev/zero bs=1 count=1 >> #{file_to_pad} + dd if=/dev/zero bs=1 count=1 >> #{file_to_pad} #adds null bytes + dd if=/dev/random bs=1 count=1 >> #{file_to_pad} #adds high-quality random data + dd if=/dev/urandom bs=1 count=1 >> #{file_to_pad} #adds low-quality random data + cleanup_command: | + rm #{file_to_pad} + name: sh + +- name: Pad Binary to Change Hash using truncate command - Linux/macOS + description: | + Uses truncate to add a byte to the binary to change the hash. + + Upon successful execution, truncate will modify `/tmp/evil-binary`, therefore the expected hash will change. + supported_platforms: + - macos + - linux + input_arguments: + file_to_pad: + description: Path of binary to be padded + type: path + default: /tmp/evil-binary + dependency_executor_name: bash + dependencies: + - description: | + The binary must exist on disk at specified location (#{file_to_pad}) + prereq_command: | + if [ -f #{file_to_pad} ]; then exit 0; else exit 1; fi; + get_prereq_command: | + cp /bin/ls #{file_to_pad} + executor: + command: | + truncate -s +1 #{file_to_pad} #adds a byte to the file size cleanup_command: | rm #{file_to_pad} name: sh