mitre / builder

Caldera plugin to dynamically compile code segments from abilities

MITRE Caldera Plugin: Builder

The Builder plugin enables Caldera to dynamically compile code segments into payloads that can be executed as abilities by implants.

Installation:

Install the required docker components with the following command:

sudo ./install.sh

Dependencies/Requirements:

1. Docker
2. docker-py

Sample Ability

The following ability will compile the HelloWorld.exe executable, copy it to the machine running the agent, and execute it using either cmd or PowerShell.

---

- id: 096a4e60-e761-4c16-891a-3dc4eff02e74
  name: C# Hello World
  description: Dynamically compile HelloWorld.exe
  tactic: execution
  technique:
    attack_id: T1059
    name: Command-Line Interface
  platforms:
    windows:
      psh,cmd:
        build_target: HelloWorld.exe
        language: csharp
        code: |
          using System;

          namespace HelloWorld
          {
              class Program
              {
                  static void Main(string[] args)
                  {
                      Console.WriteLine("Hello World!");
                  }
              }
          }

DLL dependencies can be added by declaring a payloads list at the root of the ability.

builder's Issues

All dockercross images are being pulled instead of just the latest

Describe the bug
Docker images for dockcross/windows-static are pulling all matching images instead of using just the latest

To Reproduce
Steps to reproduce the behavior:

1. launch the Caldera server.py script with builder plugin enabled

Expected behavior
Only latest image should be pulled for dockercross, just like mono and golang

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: Ubuntu 22.04

Additional context
I let it run all afternoon and filled up over 600Gb for all the different tags for windows-static-x64 image before I quit and added the tag.