maxDcb-C2Core/modules/SshExec/sshExec.json

{
  "name": "sshExec",
  "display_name": "sshExec",
  "kind": "module",
  "description": "Execute a command on a remote SSH server using username/password authentication.",
  "command_template": "sshExec [--vault {vault:q}] -h {h:q} [-P {P}] [-u {u:q}] [-p {p:q}] -- {command:raw}",
  "target": "beacon",
  "requires_session": true,
  "platforms": ["windows", "linux"],
  "archs": ["any"],
  "args": [
    {
      "name": "--vault",
      "type": "credential",
      "required": false,
      "description": "TeamServer vault credential reference. The TeamServer resolves it to -u user --password password before dispatch.",
      "credential_filter": {
        "type": "password"
      }
    },
    {
      "name": "-h",
      "type": "flag",
      "required": true,
      "description": "SSH host name or IP."
    },
    {
      "name": "--host",
      "type": "flag",
      "required": false,
      "description": "SSH host name or IP."
    },
    {
      "name": "-P",
      "type": "flag",
      "required": false,
      "description": "SSH port. Defaults to 22."
    },
    {
      "name": "--port",
      "type": "flag",
      "required": false,
      "description": "SSH port. Defaults to 22."
    },
    {
      "name": "-u",
      "type": "flag",
      "required": false,
      "description": "SSH username for explicit credential mode."
    },
    {
      "name": "--user",
      "type": "flag",
      "required": false,
      "description": "SSH username for explicit credential mode."
    },
    {
      "name": "-p",
      "type": "flag",
      "required": false,
      "description": "SSH password."
    },
    {
      "name": "--password",
      "type": "flag",
      "required": false,
      "description": "SSH password."
    },
    {
      "name": "-c",
      "type": "flag",
      "required": false,
      "description": "Remote command."
    },
    {
      "name": "--command",
      "type": "flag",
      "required": false,
      "description": "Remote command."
    },
    {
      "name": "command",
      "type": "text",
      "required": true,
      "description": "Remote command tail passed after --.",
      "variadic": true
    }
  ],
  "examples": [
    "sshExec --vault cred:credentialId -h 10.0.0.5 -- id",
    "sshExec -h 10.0.0.5 -u admin -p Passw0rd! -c \"ipconfig /all\"",
    "sshExec -h server -P 22 -u admin -p Passw0rd! -- /bin/echo hello"
  ],
  "source": "manifest"
}