Add T1021 "Remote Services" MITRE technique and sub-technique references #20560

cdelafuente-r7 · 2025-09-22T18:24:12Z

This adds the reference to MITRE ATT&CK technique T1021 "Remote Services" and its sub-techniques. (see https://attack.mitre.org/techniques/T1021/ for details).

This has been mainly done with the help of AI and local scripts. The process was as follows:

Use both the source code and the documentation for each module in Metasploit.
Filter according to keywords related to the MITRE technique.
Process each module from the filtered list of modules using AI with a specific crafted prompt, the source code and the documentation.
Final manual review.

cdelafuente-r7 · 2025-09-22T18:32:55Z

modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb

+      inject_request(cookie, token, 'rm -rf /a')
+      inject_request(cookie, token, 'rm -rf b')


Rubocop was not happy with this...

bwatters-r7 · 2025-09-23T16:31:28Z

Based on reading the ATTA&K docs, we're looking for modules that use an account on a remote service to steal/manipulate/add. That said, this PR includes:
auxiliary/admin/smb

chec_dir_file
download_file
list_directory
ms17_010_command
samba_symlink_traversal
upload_file
webexec_command

I'm unclear as to why those are included, but

change_password
delete_file
psexec_ntdsgrab
webexec_command
are not included. All of these are logging into the SMB service and doing something with those creds?

bwatters-r7 · 2025-09-23T17:02:25Z

I also see that metasploit-framework/modules/auxiliary/admin/teradata /teradata_odbc_sql.py is missing, though it is a sql login module for querying data.
I don't see any of the python modules listed as changed.

cdelafuente-r7 · 2025-09-24T08:18:50Z

Hi Brendan, thank you for looking into this. I agree there are some missing modules there. I need to update my scripts since I just realized some techniques were not properly included.

bwatters-r7 · 2025-09-24T17:55:48Z

It might be worth it to do a scan of all documentation that gives the value for username and then check if the module contains the HTTP::Client, SMB::Client, or other remote-based client library. Based on the MITRE docs, if we're logging in, were using this technique, I assume?

adfoster-r7 · 2025-09-25T14:28:37Z

modules/exploits/windows/smb/smb_relay.rb

          ['URL', 'https://en.wikipedia.org/wiki/SMBRelay'],
-          ['URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx']
+          ['URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx'],
+          ['ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES]


Question: Should we be manually adding the parent T1021_REMOTE_SERVICES here explicitly, or should we be wiring that up behind the scenes implicitly? 🤔

Suggested change

['ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES]

['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES],

['ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES]

The reason being, whether or not we should be showing T1021_REMOTE_SERVICES in Pro's UI or in the info command by default

If we want to go with the implicit approach, then it'd make sense to ignore any related code changes to this PR and create a separate ticket 👍

Or happy to ignore entirely (Spencer's preference) 🥳

In answer to this, see exploits/linux/misc/igel_command_injection
It works through either telnet or VNC. VNC has a special subclause, but telnet does not. The only way to express both is with the overarching technique and the sub-technique. It might be useful to keep them separate so that you can see both?

bwatters-r7 · 2025-09-26T18:49:28Z

modules/exploits/linux/http/asuswrt_lan_rce.rb

          ['CVE', '2018-5999'],
-          ['CVE', '2018-6000']
+          ['CVE', '2018-6000'],
+          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]


This module does not use an account; it uses a special POST requesto to place the router in command mode, then sends a UDP packet instructing the router to start a telnet server serving bash.

bwatters-r7 · 2025-09-26T18:51:48Z

modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb

          ['URL', 'https://www.postgresql.org/support/security/CVE-2025-1094/'], # PostgreSQL Advisory
-          ['URL', 'https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis'] # Rapid7 Analysis
+          ['URL', 'https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis'], # Rapid7 Analysis
+          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]


I do not see anywhere in this module where we are using an authenticated account?

bwatters-r7 · 2025-09-26T20:09:21Z

modules/exploits/windows/smb/smb_relay.rb

          ['URL', 'https://en.wikipedia.org/wiki/SMBRelay'],
-          ['URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx']
+          ['URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx'],
+          ['ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES]


In answer to this, see exploits/linux/misc/igel_command_injection
It works through either telnet or VNC. VNC has a special subclause, but telnet does not. The only way to express both is with the overarching technique and the sub-technique. It might be useful to keep them separate so that you can see both?

bwatters-r7 · 2025-09-26T20:14:05Z

modules/exploits/linux/misc/igel_command_injection.rb

          [ 'URL', 'https://kb.igel.com/securitysafety/en/isn-2021-01-igel-os-remote-command-execution-vulnerability-41449239.html' ],
-          [ 'URL', 'https://www.igel.com/wp-content/uploads/2021/02/lxos_11.04.270.txt' ]
+          [ 'URL', 'https://www.igel.com/wp-content/uploads/2021/02/lxos_11.04.270.txt' ],
+          [ 'ATT&CK', Mitre::Attack::Technique::T1021_005_VNC ]


I don't see anywhere we are authenticating in this module?

bwatters-r7 · 2025-09-26T20:16:46Z

modules/exploits/linux/ssh/ssh_erlangotp_rce.rb

          ['URL', 'https://platformsecurity.com/blog/CVE-2025-32433-poc'],
-          ['URL', 'https://github.com/ProDefense/CVE-2025-32433']
+          ['URL', 'https://github.com/ProDefense/CVE-2025-32433'],
+          ['ATT&CK', Mitre::Attack::Technique::T1021_004_SSH]


I don't see where this is authenticating

bwatters-r7 · 2025-09-26T20:50:53Z

modules/post/windows/gather/credentials/rdc_manager_creds.rb

-        }
+        },
+        'References' => [
+          [ 'ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES ]


Also retrieves passwords

bwatters-r7 · 2025-09-26T20:51:15Z

modules/post/windows/manage/enable_rdp.rb

-        }
+        },
+        'References' => [
+          [ 'ATT&CK', Mitre::Attack::Technique::T1021_001_REMOTE_DESKTOP_PROTOCOL ]


This just enables RDP, it does not authenticate.

bwatters-r7 · 2025-09-26T20:53:01Z

modules/post/windows/manage/install_ssh.rb

          ['URL', 'https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview'],
-          ['URL', 'https://github.com/PowerShell/openssh-portable']
+          ['URL', 'https://github.com/PowerShell/openssh-portable'],
+          ['ATT&CK', Mitre::Attack::Technique::T1021_004_SSH]


I don't think installing ssh counts?

bwatters-r7 · 2025-09-26T20:54:02Z

modules/post/windows/manage/pptp_tunnel.rb

        'References' => [
-          [ 'URL', 'https://www.youtube.com/watch?v=vdppEZjMPCM&hd=1' ]
+          [ 'URL', 'https://www.youtube.com/watch?v=vdppEZjMPCM&hd=1' ],
+          [ 'ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES ]


This seems to be sort of a VNC relay attack, it might be better to use the VNC sub-category?

bwatters-r7 · 2025-09-26T20:54:24Z

modules/post/windows/manage/sshkey_persistence.rb

-        }
+        },
+        'References' => [
+          [ 'ATT&CK', Mitre::Attack::Technique::T1021_004_SSH ]


This just adds an ssh key; it does not log in.

cdelafuente-r7 added the rn-enhancement release notes enhancement label Sep 22, 2025

cdelafuente-r7 commented Sep 22, 2025

View reviewed changes

Add references to MITRE ATT&CK T1021 - Remote Services

150dd43

cdelafuente-r7 force-pushed the feat/mitre/T1021 branch from 6717c16 to 150dd43 Compare September 23, 2025 08:27

bwatters-r7 self-assigned this Sep 23, 2025

adfoster-r7 reviewed Sep 25, 2025

View reviewed changes

bwatters-r7 reviewed Sep 26, 2025

View reviewed changes

		inject_request(cookie, token, 'rm -rf /a')
		inject_request(cookie, token, 'rm -rf b')

	['ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES]
	['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES],
	['ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES]

Add T1021 "Remote Services" MITRE technique and sub-technique references #20560

Are you sure you want to change the base?

Add T1021 "Remote Services" MITRE technique and sub-technique references #20560

Conversation

cdelafuente-r7 commented Sep 22, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bwatters-r7 commented Sep 23, 2025

Uh oh!

bwatters-r7 commented Sep 23, 2025

Uh oh!

cdelafuente-r7 commented Sep 24, 2025

Uh oh!

bwatters-r7 commented Sep 24, 2025

Uh oh!

adfoster-r7 Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adfoster-r7 Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

adfoster-r7 Sep 25, 2025 •

edited

Loading

adfoster-r7 Sep 25, 2025 •

edited

Loading