search

SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.4k stars 165 forks source link

Artifacts not included in Linux tests #180

Open oscarintherocks opened 2 years ago

oscarintherocks commented 2 years ago

Describe the bug The configured artifacts in one linux tests are not included in the final ZIP file after build and download the test, so the test can't be executed successfully.

To Reproduce Steps to reproduce the behavior:

  1. Add a new execution artifact (you can upload any file for testing, I'm using a compiled test module from T1547.006)
  2. Create a new test case (I'm using T1547.006 as example) and add the compiled module (or test file) as artifact
  3. Save the test case and open it again
  4. Click on "Build and Download"
  5. Unzip the downloaded file and you only will have the .sh file with the commands to execute but the configured artifact file is missing

Expected behavior The artifact should be packed inside the ZIP file

Desktop (please complete the following information):

SRAPSpencer commented 2 years ago

The "Execution Artifacts" on the Red Team side is independent from the automation execution, they aren't related. It's just meant to be a place to retain the artifact used in the test, similar to the Evidence Files on blue side. This may become a feature in a future release.

thebleucheese commented 2 years ago

The "Execution Artifacts" on the Red Team side is independent from the automation execution, they aren't related. It's just meant to be a place to retain the artifact used in the test, similar to the Evidence Files on blue side. This may become a feature in a future release.

@oscarintherocks A note on this - Execution Artifacts can be embedded in windows binaries for CMD and PowerShell executors. However, if the executor is bash (for linux/mac targets) we haven't implemented embedding binary data in the shell scripts generated. If you're looking to use it in this way we'll note it as a feature request.

What Paul said is correct as well though. The Execution Artifacts have a dual purpose. One is as a way to organize tools to perform a test for the Red Team side. This would include things like c2 configurations, shell scripts, etc. The other is as you mentioned, embedding things like scripts or executables to be run by VECTR's automation tools. The latter has not yet been implemented for non-windows targets.

oscarintherocks commented 2 years ago

Thank you for the info and the great job with Vectr :)