SharpSphere - Atacando infraestructura vSphere

Recorrido completo y ejemplos disponibles aquí.

Historial de Versiones

1.0 - Lanzamiento inicial
2.0 - Se agregó soporte para autenticación directa usando SSPI.
2.1 - Se agregó soporte para máquinas virtuales Linux objetivo con --linux, y se añadió una bandera --verbose para listar usuarios y grupos de vCenter

Introducción

SharpSphere brinda a los red teamers la capacidad de interactuar fácilmente con los sistemas operativos invitados de máquinas virtuales gestionadas por vCenter. Utiliza la API de Servicios Web de vSphere y expone las siguientes funciones:

Comando y Control - En combinación con C3 de F-Secure, SharpSphere proporciona C&C dentro de las VMs usando VMware Tools, sin necesidad de conectividad de red directa a la VM objetivo.
Ejecución de Código - Permite ejecutar comandos arbitrarios en el SO invitado y devuelve el resultado
Subida de Archivos - Permite subir archivos arbitrarios al SO invitado
Descarga de Archivos - Permite descargar archivos arbitrarios del SO invitado
Listar VMs - Lista las VMs gestionadas por vCenter que tienen VMware Tools ejecutándose
Volcado de Memoria - Volcar y descargar la memoria de la VM, luego extraer manualmente credenciales de LSASS sin conexión usando WinDbg y Mimikatz (Guía)

SharpSphere soporta la ejecución a través de execute-assembly de Cobalt Strike.

Compilación

Las versiones compiladas se pueden encontrar aquí.

Uso

Módulos disponibles:

SharpSphere.exe help


  list        List all VMs managed by this vCenter

  execute     Execute given command in target VM

  c2          Run C2 using C3's VMwareShareFile module

  upload      Upload file to target VM

  download    Download file from target VM

  help        Display more information on a specific command.

  version     Display version information.

Listar VMs:

SharpSphere.exe list --help 

  --url         Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk

  --username    vCenter username, i.e. [email protected]. Defauls to executing user and pass-through
                authentication if not supplied.

  --password    vCenter password. Defaults to executing user and pass-through authentication if not supplied.

  --verbose     (Default: false) Prints verbose output about vCenter, inc. groups and users

  --help        Display this help screen.

  --version     Display version information.

Ejecución de código:

SharpSphere.exe execute --help

  --url              Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk

  --username         vCenter username, i.e. [email protected]. Defaults to executing user and pass-through authentication if not supplied.

  --password         vCenter password. Defaults to executing user and pass-through authentication if not supplied.

  --ip               Required. Target VM IP address

  --guestusername    Username used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied

  --guestpassword    Password used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied

  --command          Required. Command to execute

  --output           (Default: false) Receive output from your command. Will create a temporary file in outputDir on the guest to save the output. This is then downloaded and printed to the console and the file
                     deleted

  --outputDir        When --output is provided, this is where to store the temporary file.

  --linux            (Default: false) Set if target VM is Linux

  --help             Display this help screen.

  --version          Display version information.

Comando y Control:

SharpSphere.exe c2 --help

  --url              Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk

  --username         vCenter username, i.e. [email protected]. Defaults to executing user and pass-through
                     authentication if not supplied.

  --password         vCenter password. Defaults to executing user and pass-through authentication if not supplied.

  --ip               Required. Target VM IP address

  --guestusername    Username used to authenticate to the guest OS. Defaults to executing user and pass-through
                     authentication if not supplied

  --guestpassword    Password used to authenticate to the guest OS. Defaults to executing user and pass-through
                     authentication if not supplied

  --command          Required. Command to execute

  --output           (Default: false) Receive output from your command. Will create a temporary file in outputDir on the
                     guest to save the output. This is then downloaded and printed to the console and the file deleted

  --outputDir        (Default: C:\Windows\Temp) When --output is provided, this is where to store the temporary file.

Subida de Archivos:

SharpSphere.exe upload --help

  --url              Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk

  --username         vCenter username, i.e. [email protected]. Defaults to executing user and pass-through authentication if not supplied.

  --password         vCenter password. Defaults to executing user and pass-through authentication if not supplied.

  --ip               Required. Target VM IP address

  --guestusername    Username used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied

  --guestpassword    Password used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied

  --source           Required. Full path to local file to upload

  --destination      Required. Full path to location where file should be uploaded

  --help             Display this help screen.

  --version          Display version information.

Descarga de Archivos:

>SharpSphere.exe download --help

  --url              Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk

  --username         vCenter username, i.e. [email protected]. Defaults to executing user and pass-through
                     authentication if not supplied.

  --password         vCenter password. Defaults to executing user and pass-through authentication if not supplied.

  --ip               Required. Target VM IP address

  --guestusername    Username used to authenticate to the guest OS. Defaults to executing user and pass-through
                     authentication if not supplied

  --guestpassword    Password used to authenticate to the guest OS. Defaults to executing user and pass-through
                     authentication if not supplied

  --source           Required. Full path in the guest to the file to upload

  --destination      Required. Full path to the local directory where the file should be downloaded

Volcado de Memoria:

>SharpSphere.exe dump --help
  --url            Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk

  --username       vCenter username, i.e. [email protected]. Defaults to executing user and pass-through
                   authentication if not supplied.

  --password       vCenter password. Defaults to executing user and pass-through authentication if not supplied.

  --targetvm       Required. VM to snapshot

  --snapshot       (Default: false) WARNING: Creates and then deletes a snapshot. If unset, SharpSphere will only
                   extract memory from last existing snapshot, or none if no snapshots are available.

  --destination    Required. Full path to the local directory where the file should be downloaded

Funciones Futuras

Añadir soporte para SO invitado Linux
Incluir una opción --verbose para listar VMs
Añadir una bandera --quiet para no mencionar cada paquete transferido
Añadir una bandera --testauth para confirmar que las credenciales del invitado son válidas

SharpSphere

Más Populares