Nebula

Nebula è un framework per il Penetration Testing sul Cloud e (si spera) DevOps. È costruito con moduli per ciascun provider e per ogni funzionalità. Ad aprile 2021 copre solo AWS, ma è un progetto in corso e si spera che continui a crescere per testare GCP, Azure, Kubernetes, Docker o motori di automazione come Ansible, Terraform, Chef, ecc. Ho iniziato a scriverlo mentre leggevo "Hands-On AWS Penetration Testing with Kali Linux" (https://www.amazon.com/Hands-Penetration-Testing-Kali-Linux/dp/1789136725) ed era basato su Pacu (https://github.com/RhinoSecurityLabs/pacu)

Presentazioni:

BlackHat Europe 2021: https://www.blackhat.com/eu-21/arsenal/schedule/index.html#nebula-a-case-study-in-penetrating-something-as-soft-as-a-cloud-25174

Attualmente copre:

Enumerazione, sfruttamento e post-sfruttamento di AWS, Azure (Graph e Management API) e DigitalOcean

Attualmente ci sono 53 moduli che coprono:

Ricognizione
Enumerazione
Sfruttamento
Pulizia

La versione 3.0 include:

Cooperazione di squadra con l'architettura client-teamserver
Tutte le richieste richiedono autenticazione (tranne la richiesta di autenticazione, ovviamente)
Tutte le informazioni sono memorizzate in un server MongoDB e accessibili tramite comandi. Le informazioni dovranno ovviamente essere enumerate prima, ma questo permette di non enumerare un determinato oggetto

Installazione

........... ...''''''''''''''... ..'''''...........''''''............ ..''''.. ...'''''''''''''''... ..'''.. ..............'''''.. .''''. .;loddool:'. ..''''.. ..'''. .;clokXWWMWNKkl;. .''''. .'''. .',,'.. ';dNMMMMMWKko;. .'''.. .''''. .cx0NWWNX0koc;,'cKMMMMMMMMMWXOo:. .''''.... .'''. .',',:oONMMMMMWNNNWMMMMMMWKk0WMMWXx' .''''''''... ..'''. .,dXMMMMMMMMMMMMMNOl',oONWWd. .......'''''.. ...'''''.. :o' cXMMMMMMMMMMMMMWNXKKXNWWKxc,. ..''''.. ..''''.... oNKl'. ..oXMMMMMMMMMMMMMMMMMMMMMMMMMNKOdc,.. ..''''. ..''''.. ,OWWX0O0XWMMMMMMMMMMMMMMMMMMWWWWMMMMMMMMMWXOxooxk:. ..'''. ..'''''''''''''''''''''. .l0NMMMMMMMMMMMMMMMMMMMMN0dc;;;coONMMMMMMMMMMMMMK: ..'''. ....................... .,dXMMMMMMMMMMMMMMMMMMWX0ko:. .;OWMMMMMMMMMMMWx. .'''. .oWMMMMMMMMMMMMMMWNXXXWMMWKd' .:lccclodOXWMWd. .'''. ,lc' .................. ',. .,OWMMMMMMMMMMMMXx:'...:0WMMMKl. .. .'oKO, .'''. ,0MWx. .''''''''''''''''''. ;OKOOOO0NWMMMMMMMMMMMMNl. .cdoox0XOl;'....... ... .'''. .;ol' ................... ;kXWMMMMMMMMMMMMMMMMMWx. .:0WNKkdo:. ... .'''. .................... .:ldxk0XWMMMMMMMMMMMW0o' .';;,. .... ..'''. ;k00000000000000000000x' ..;lkXWMMMMMMMMMWXkc. ..'''. .lXWWWWWWWWWWWWWWWWWWMMWKl. ;OWMMMMMMMMMMMWKx:. ..''''. .,,,,,,,,,,,,,,,,,:kNMMW0o,. 'kWMMMMMMMMMMMMMMWKd,. ..''''.. .:ONMMMNKkdlc:::::::::ccldkKWMMMMMMMMMMMMMMMMMMNOl' ...........'''''.. .,oOXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXkc....''''''''''... .':ldkO0000000000000000000000000000000000000000Ox:. ........ ........................................... _ _______ ______ _ _______ ( ( /|( ____ \( ___ \ |\ /|( \ ( ___ ) | \ ( || ( \/| ( ) )| ) ( || ( | ( ) | | \ | || (__ | (__/ / | | | || | | (___) | | (\ \) || __) | __ ( | | | || | | ___ | | | \ || ( | ( \ \ | | | || | | ( ) | | ) \ || (____/\| )___) )| (___) || (____/\| ) ( | |/ )_)(_______/|/ \___/ (_______)(_______/|/ \| Because Clouds are so AWSome ------------------------------------------------------------- Created by: gl4ssesbo1 ------------------------------------------------------------- 48 aws 1 gcp 7 azure 0 office365 0 docker 0 kubernetes 6 misc 4 azuread 4 digitalocean ------------------------------------------------------------- 81 modules 6 cleanup 0 detection 19 enum 22 exploit 2 persistence 2 listeners 0 lateral movement 7 detection bypass 0 privesc 16 reconnaissance 2 stager 1 postexploitation 4 misc Remember: ------------------------------------------------------------- 1) Only use this tool if you have permissions from the infrastructure's owner. Don't be a dick. Don't choose jail. And if you have some scruples, don't hack others just because you can (or cannot, in which case that's why you chose this tool to do it). 2) There is a template file on module directory that you can use if you want to develop new modules. If you want to contribute on this tool, be my guest. 3) Thank you for using this tool and Hack the Planet Legally! -------------------------------------------------------------

### Help Eseguendo il comando *help*, otterrai un elenco dei comandi che possono essere utilizzati:``` ()()(AWS) >>> help Help Command: Description: ------------- ------------ help Show help for all the commands help credentials Show help for credentials help module Show help for modules help workspace Show help for credentials help user-agent Show help for credentials help shell Show help for shell connections Module Commands Description --------------- ----------- show modules List all the modules show enum List all Enumeration modules show exploit List all Exploit modules show persistence List all Persistence modules show privesc List all Privilege Escalation modules show reconnaissance List all Reconnaissance modules show listener List all Reconnaissance modules show cleanup List all Enumeration modules show detection List all Exploit modules show detectionbypass List all Persistence modules show lateralmovement List all Privilege Escalation modules show stager List all Reconnaissance modules use module <module> Use a module. options Show options of a module you have selected. run Run a module you have selected. Eg: 'run <module name>' search Search for a module via pattern. Eg: 'search s3' back Unselect a module set <option> Set option of a module. Need to have the module used first. unset <option> Unset option of a module. Need to have the module used first. User-Agent commands Description ------------------- ----------- set user-agent windows Set a windows client user agent set user-agent linux Set a linux client user agent set user-agent custom Set a custom client user agent show user-agent Show the current user-agent unset user-agent Use the user agent that boto3 produces Workspace Commands Description ------------------ ----------- create workspace <wp> Create a workspace use workspace <wp> Use one of the workspaces remove workspace <wp> Remove a workspace Shell commands Description ------------------- ----------- shell check_env Check the environment you are in, get data and meta-data shell exit Kill a connection shell <command> Run a command on a system. You don't need " on the command, just shell <command1> <command2>

cleanup/aws_iam_delete_login_profile Delete access of a user to the Management Console enum/aws_ec2_enum_elastic_ips Lists User data of an Instance provided. Requires Secret Key and Access Key of an IAM that has access to it. enum/aws_ec2_enum_images List all ec2 images. Needs credentials of an IAM with DescribeImages right. Output is dumpled on a file. It takes a sh*tload of time, unfortunately. And boy, is it a huge output. enum/aws_ec2_enum_instances Describes instances attribues: Instances, VCP, Zones, Images, Security Groups, Snapshots, Subnets, Tags, Volumes. Requires Secret Key and Access Key of an IAM that has access to all or any of the API calls: DescribeAvailabilityZones, DescribeImages, DescribeInstances, DescribeKeyPairs, DescribeSecurityGroups, DescribeSnapshots, DescribeSubnets, DescribeTags, DescribeVolumes, DescribeVpcs

Nebula

Più Popolari

Server

Client

Utilizzo```

Enumera privilegi

GetUID```

(test)()(AWS) >>> getuid

UserId: A******************Q

Moduli

Elenco dei moduli

Ricerca dei moduli

Opzioni

Usando le opzioni, possiamo elencare le informazioni sul modulo:``` (work1)()(enum/aws_ec2_enum_instances) >>> options Desctiption:

Author:

AWSCLI Command:

Needs Credentials: True

Options:

Elenco workspaces

Per ottenere un elenco di workspaces, usa:``` (work1)()(enum/aws_ec2_enum_instances) >>> show workspaces

Workspaces:

Reverse Shell

Stager

Per generare uno stager, utilizza i moduli su stagers:``` ()()(AWS) >>> use module stager/aws_python_tcp ()()(stager/aws_python_tcp) >>> options Desctiption:

Author:

Needs Credentials: False

AWSCLI Command:

Options:

Agenti utente