Problem: T1098.001 shell script is not working on Linux

[za]

What did you do?

ℹ Please replace this with what you did.
Run ./aws_secret.sh

Refer to: https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098.001/bin/aws_secret.sh

I've generated aws_secret.creds following this command:

aws iam create-access-key --user-name #{username} > "$PathToAtomicsFolder/T1098.001/bin/aws_secret.creds"
cd "$PathToAtomicsFolder/T1098.001/bin/"
./aws_secret.sh

What did you expect to happen?

ℹ Please replace this with what you expected to happen.
.aws/credentials is updated.

What happened instead?

ℹ Please replace this with of what happened instead.
e.g. 💥

➜  bin git:(master) ./aws_secret.sh
Creating Profile in ./aws/credentials
sed: can't read 72s|aws_access_key_id = .*$|aws_access_key_id = <snipped>|g: No such file or directory
sed: can't read 73s|aws_secret_access_key = .*$|aws_secret_access_key = <snipped>|g: No such file or directory

Your Environment

• Which specific operating system are you running (e.g. Windows 7 SP1 32-bit)?
  Linux

• Did you run the test from an elevated or root prompt?
  From the elevated prompt.

• If relevant, which atomic test is this specific to?
  T1098.001

[za]

Removing the double single-tick, fixing the issue:

$ git diff

diff --git a/atomics/T1098.001/bin/aws_secret.sh b/atomics/T1098.001/bin/aws_secret.sh
index f96e740b..152f5b61 100755
--- a/atomics/T1098.001/bin/aws_secret.sh
+++ b/atomics/T1098.001/bin/aws_secret.sh
@@ -5,7 +5,7 @@ secret_key=`cat aws_secret.creds| jq -r '.AccessKey.SecretAccessKey'`
 line=`grep -n atomicredteam ~/.aws/credentials | cut -d : -f1 |bc`
 access="$(($line+1))"
 secret="$(($line+2))"
-sed -i '' "${access}s|aws_access_key_id = .*$|aws_access_key_id = $access_key|g" ~/.aws/credentials
-sed -i '' "${secret}s|aws_secret_access_key = .*$|aws_secret_access_key = $secret_key|g" ~/.aws/credentials
+sed -i "${access}s|aws_access_key_id = .*$|aws_access_key_id = $access_key|g" ~/.aws/credentials
+sed -i "${secret}s|aws_secret_access_key = .*$|aws_secret_access_key = $secret_key|g" ~/.aws/credentials

➜  bin git:(master) ✗ ./aws_secret.sh
Creating Profile in ./aws/credentials