AttackMate is a tool to automate cyber attack scenarios that supports scripting of attack techniques across all phases of the Cyber Kill Chain. AttackMate’s design principles aim to integrate with penetration testing and attack emulation frameworks such as Metasploit and Sliver Framework and enables simple execution of commands via shell or ssh. For example, AttackMate enables to execute Metasploit modules or generate payloads and run commands in Metasploit sessions. Moreover, it is able to generate Sliver implants, automatize Sliver to send C2 commands, and configure and compile LD_PRELOAD-rootkits. AttackMate also offers a simple interface to automate shell or ssh interaction, run commands in background mode, transfer files via sftp, and start http clients or servers. All attack steps may be scheduled, chained, and repeatedly executed using a simple configuration file that supports variable declarations and conditional workflows.

Requirements

• python >= 3.12

• libmagic

Installation

Manually:

$ git clone https://github.com/ait-aecid/attackmate.git
$ cd attackmate
$ pip3 install .

Using pip:

$ pip3 install attackmate

Using uv:

$ git clone https://github.com/ait-aecid/attackmate.git
$ cd attackmate
$ uv sync

Execute

With pip:

$ attackmate playbook.yml

With uv:

$ uv run attackmate playbook.yml

Documentation

Please take a look at our documentation on how to install and use attackmate:

• Installation

• Documentation

• Command Reference

• Example Playbooks

Publications

• AttackMate: Realistic Emulation and Automation of Cyber Attack Scenarios Across the Kill Chain on Arxiv

Contribution

We’re happily taking patches and other contributions. Please see the following links on how to get started:

• Contribution Guide

Disclaimer

AttackMate is purely for educational and academic purposes. The software is provided “as is” and the authors are not responsible for any damage or mishaps that may occur during its use.

Do not attempt to use AttackMate to violate the law. Misuse of the provided software and information may result in criminal charges.

Security

AttackMate should only be executed against systems you own or have explicit permission to test. For this reason, all software bugs are treated with equal priority, regardless of whether they have security implications.

*Please note that AttackMate could easily be executed in a dangerous way. For example, by parsing the RESULT_STDOUT of a malicious server. The server response could lead to a command injection. Keep that in mind and always treat external input with caution!

License

GPL-3.0

Financial Support

Funded by the European Union under GA no. 101121403 (NEWSROOM) and GA no. 101103385 (AInception). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them. Further supported by the Horizon Europe project MIRANDA (101168144). Co-funded by the Austrian security research programme KIRAS of the Federal Ministry of Finance (BMF) in course of the projects ASOC (FO999905301) and Testcat (FO999911248).