redcanaryco/chain-reactor

Request: Provide parameters to reactions on execution

rctgardner opened this issue · 0 comments

It would be nice to be able to provide simple string parameters to the compiled binaries on execution, either in the form of CLI parameters or environment variables. My existing use case is developing a reaction for generic DDoS botnets like Mirai, and providing a fake binary filename on the command line, like so:

Example atom

[
  {
    "name": "EXECUTE-BOT",
    "fork-and-rename": [ "./${1}" ]
  }
]
$ ./reaction x86_64
...
atom: EXECUTE-BOT
        quark: fork-and-rename("./x86_64")

$ ./reaction arm7
...
atom: EXECUTE-BOT
        quark: fork-and-rename("./arm7")

$ ./reaction mips
...
atom: EXECUTE-BOT
        quark: fork-and-rename("./mips")