💡 [REQUEST] - OS/Arch Metadata Filtering

[l50]

Implementation PR

N/A

Reference Issues

#196

Summary

It would be great to be able to filter on metadata for a specific TTP using ttpforge list.

Aside from providing a nicer interface to find specific TTPs, this work could also be used to provide feedback if someone is trying to run an incompatible TTP, i.e. macOS TTP on a linux box.

Basic Example

If we wanted all TTPs that target x86_64 linux:

ttpforge list ttps -os linux -arch x86_64

Or if we wanted all macOS TTPs (generally speaking and ignoring the architecture):

ttpforge list ttps -os macos

Drawbacks

It's work, but otherwise I'm not seeing any downsides.

Unresolved questions

No response

[d3sch41n]

TL;DR

I intend to add a compatibility: section containing a list of OS/arch combinations

• we can later add a version field as well:

compatibility:
  - os: linux
    arch: amd64
  - os: darwin
    arch:  arm64

Disambiguation

This specifies "where is it possible for ttpforge to run this TTP" - it does not specify the target environment.
For example, a linux-based attack tool designed to attack remote windows systems would declare linux rather than windows compatibility.

Schema Details

The following validation rules will be enforced:

• os must be a valid GOOS value
• arch: must be a valid GOARCH value

ttpforge run Mechanics

If a TTP specifies a compatibility section, then TTPForge will refuse to execute it (and immediately print a clear error message)
unless the runtime.GOOS and runtime.GOARCH values match one of the entries in the compatibility list:

The arch field will not be mandatory, because there will be many situations in which it is overly restrictive - for instance, a TTP that just executes some inline Python (no compiling C files etc.) is not expected to have architecture-dependent properties. In such cases, one could simply write:

compatibility:
  - os: linux
  - os: darwin

ttpforge list ttps Mechanics

Corresponding options will be added to the ttpforge list command to filter on the above values:

ttpforge list --compatible-with "os=macOS,arch=arm64" 

The following shorthand will be allowed to filter to "which TTPs can I run right now on my current GOOS/GOARCH":

ttpforge list --compatible

SubTTPs

The compatibilty: filters will also be enforced against SubTTPs - this will prevent you from tying incompatible sub TTPs together.

[d3sch41n]

This will also encompass @l50's prior FR

#196

[d3sch41n]

Maybe we call it platform_requirements instead