Colson Wilhoit
150ff0502e
* Linux Shell Evasion Rule Tuning * Update execution_python_tty_shell.toml * Update rules/linux/execution_apt_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_apt_binary.toml * Update rules/linux/execution_awk_binary_shell.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_awk_binary_shell.toml * Update rules/linux/execution_c89_c99_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_c89_c99_binary.toml * Update rules/linux/execution_cpulimit_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_cpulimit_binary.toml * Update rules/linux/execution_expect_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_expect_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_expect_binary.toml * Update rules/linux/execution_find_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_find_binary.toml * Update rules/linux/execution_gcc_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_gcc_binary.toml * Update rules/linux/execution_mysql_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_mysql_binary.toml * Update rules/linux/execution_nice_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_nice_binary.toml * Update rules/linux/execution_ssh_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_ssh_binary.toml * Update execution_perl_tty_shell.toml * Update execution_python_tty_shell.toml * Update rules/linux/execution_apt_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_awk_binary_shell.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_c89_c99_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_cpulimit_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_expect_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_find_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_gcc_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_mysql_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_nice_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/linux/execution_ssh_binary.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
57 lines
1.7 KiB
Python
57 lines
1.7 KiB
Python
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
# or more contributor license agreements. Licensed under the Elastic License
|
|
# 2.0; you may not use this file except in compliance with the Elastic License
|
|
# 2.0.
|
|
|
|
# Name: Encrypting files with 7zip
|
|
# RTA: sevenzip_encrypted.py
|
|
# ATT&CK: T1022
|
|
# Description: Uses "bin\.exe" to perform encryption of archives and archive headers.
|
|
|
|
import base64
|
|
import os
|
|
import sys
|
|
|
|
from . import common
|
|
|
|
SEVENZIP = common.get_path("bin", "7za.exe")
|
|
|
|
|
|
def create_exfil(path=os.path.abspath("secret_stuff.txt")):
|
|
common.log("Writing dummy exfil to %s" % path)
|
|
with open(path, 'wb') as f:
|
|
f.write(base64.b64encode(b"This is really secret stuff\n" * 100))
|
|
return path
|
|
|
|
|
|
@common.requires_os(common.WINDOWS)
|
|
@common.dependencies(SEVENZIP)
|
|
def main(password="s0l33t"):
|
|
# create 7z.exe with not-7zip name, and exfil
|
|
svnz2 = os.path.abspath("a.exe")
|
|
common.copy_file(SEVENZIP, svnz2)
|
|
exfil = create_exfil()
|
|
|
|
exts = ["7z", "zip", "gzip", "tar", "bz2", "bzip2", "xz"]
|
|
out_jpg = os.path.abspath("out.jpg")
|
|
|
|
for ext in exts:
|
|
# Write archive for each type
|
|
out_file = os.path.abspath("out." + ext)
|
|
common.execute([svnz2, "a", out_file, "-p" + password, exfil], mute=True)
|
|
common.remove_file(out_file)
|
|
|
|
# Write archive for each type with -t flag
|
|
if ext == "bz2":
|
|
continue
|
|
|
|
common.execute([svnz2, "a", out_jpg, "-p" + password, "-t" + ext, exfil], mute=True)
|
|
common.remove_file(out_jpg)
|
|
|
|
common.execute([SEVENZIP, "a", out_jpg, "-p" + password, exfil], mute=True)
|
|
common.remove_files(exfil, svnz2, out_jpg)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
exit(main(*sys.argv[1:]))
|