
vCenter 공격용 .NET 프로젝트
전체 설명 및 예제는 여기에서 확인할 수 있습니다.
SharpSphere는 레드 팀원이 vCenter에서 관리하는 가상 머신의 게스트 운영 체제와 쉽게 상호작용할 수 있도록 합니다. vSphere Web Services API를 사용하며 다음 기능을 제공합니다:
SharpSphere는 Cobalt Strike의 execute-assembly를 통한 실행을 지원합니다.
컴파일된 버전은 여기에서 찾을 수 있습니다.
사용 가능한 모듈:
SharpSphere.exe help
list List all VMs managed by this vCenter
execute Execute given command in target VM
c2 Run C2 using C3's VMwareShareFile module
upload Upload file to target VM
download Download file from target VM
help Display more information on a specific command.
version Display version information.
SharpSphere.exe list --help
--url Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk
--username vCenter username, i.e. [email protected]. Defauls to executing user and pass-through
authentication if not supplied.
--password vCenter password. Defaults to executing user and pass-through authentication if not supplied.
--verbose (Default: false) Prints verbose output about vCenter, inc. groups and users
--help Display this help screen.
--version Display version information.
SharpSphere.exe execute --help
--url Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk
--username vCenter username, i.e. [email protected]. Defaults to executing user and pass-through authentication if not supplied.
--password vCenter password. Defaults to executing user and pass-through authentication if not supplied.
--ip Required. Target VM IP address
--guestusername Username used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied
--guestpassword Password used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied
--command Required. Command to execute
--output (Default: false) Receive output from your command. Will create a temporary file in outputDir on the guest to save the output. This is then downloaded and printed to the console and the file
deleted
--outputDir When --output is provided, this is where to store the temporary file.
--linux (Default: false) Set if target VM is Linux
--help Display this help screen.
--version Display version information.
SharpSphere.exe c2 --help
--url Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk
--username vCenter username, i.e. [email protected]. Defaults to executing user and pass-through
authentication if not supplied.
--password vCenter password. Defaults to executing user and pass-through authentication if not supplied.
--ip Required. Target VM IP address
--guestusername Username used to authenticate to the guest OS. Defaults to executing user and pass-through
authentication if not supplied
--guestpassword Password used to authenticate to the guest OS. Defaults to executing user and pass-through
authentication if not supplied
--command Required. Command to execute
--output (Default: false) Receive output from your command. Will create a temporary file in outputDir on the
guest to save the output. This is then downloaded and printed to the console and the file deleted
--outputDir (Default: C:\Windows\Temp) When --output is provided, this is where to store the temporary file.
SharpSphere.exe upload --help
--url Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk
--username vCenter username, i.e. [email protected]. Defaults to executing user and pass-through authentication if not supplied.
--password vCenter password. Defaults to executing user and pass-through authentication if not supplied.
--ip Required. Target VM IP address
--guestusername Username used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied
--guestpassword Password used to authenticate to the guest OS. Defaults to executing user and pass-through authentication if not supplied
--source Required. Full path to local file to upload
--destination Required. Full path to location where file should be uploaded
--help Display this help screen.
--version Display version information.
>SharpSphere.exe download --help
--url Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk
--username vCenter username, i.e. [email protected]. Defaults to executing user and pass-through
authentication if not supplied.
--password vCenter password. Defaults to executing user and pass-through authentication if not supplied.
--ip Required. Target VM IP address
--guestusername Username used to authenticate to the guest OS. Defaults to executing user and pass-through
authentication if not supplied
--guestpassword Password used to authenticate to the guest OS. Defaults to executing user and pass-through
authentication if not supplied
--source Required. Full path in the guest to the file to upload
--destination Required. Full path to the local directory where the file should be downloaded
>SharpSphere.exe dump --help
--url Required. vCenter SDK URL, i.e. https://127.0.0.1/sdk
--username vCenter username, i.e. [email protected]. Defaults to executing user and pass-through
authentication if not supplied.
--password vCenter password. Defaults to executing user and pass-through authentication if not supplied.
--targetvm Required. VM to snapshot
--snapshot (Default: false) WARNING: Creates and then deletes a snapshot. If unset, SharpSphere will only
extract memory from last existing snapshot, or none if no snapshots are available.
--destination Required. Full path to the local directory where the file should be downloaded
--verbose 옵션 포함--quiet 플래그 추가--testauth 플래그 추가