diff --git a/red_ttp/schedule_cron.py b/red_ttp/schedule_cron.py new file mode 100644 index 0000000..c2ae5b0 --- /dev/null +++ b/red_ttp/schedule_cron.py @@ -0,0 +1,35 @@ +# Name: Scheduling Local Job with crontab +# rta: schedule_cron.py +# ATT&CK: T1168 +# Description: Writes a cron job to a temporary crontab file schedules it for execution. + +import os +import common + +CRONTAB_BINARY = '/usr/bin/crontab' +TMP_CRON = '/tmp/cron_tmp' +CRON_SCHEDULE = '* * * * * ' +CRON_PAYLOAD = 'bash -c "echo file marker > /tmp/file_marker.txt"' + +def main(): + + common.log('Writing temporary crontab file...') + with open(TMP_CRON,'w') as evil_cron: + evil_cron.write(CRON_SCHEDULE + CRON_PAYLOAD + '\n') + if os.path.exists(TMP_CRON): + common.log('Successfully created temporary crontab file!') + else: + common.log('Failed to create temporary crontab file.') + + common.log('Replacing current user crontab file...') + code, output = common.execute([CRONTAB_BINARY, TMP_CRON],shell=True) + if code == 0: + common.log('Current user crontab replaced!') + else: + common.log('Failed to replace current user crontab.') + + common.remove_file(TMP_CRON) + + +if __name__ == "__main__": + exit(main()) \ No newline at end of file