Nebula

Nebula是一个云和（希望）DevOps渗透测试框架。它针对每个提供商和每个功能构建模块。截至2021年4月，它只涵盖AWS，但目前是一个持续进行的项目，希望将继续发展，测试GCP、Azure、Kubernetes、Docker或自动化引擎如Ansible、Terraform、Chef等。我开始编写它时正在阅读《Hands-On AWS Penetration Testing with Kali Linux》（https://www.amazon.com/Hands-Penetration-Testing-Kali-Linux/dp/1789136725）并基于Pacu（https://github.com/RhinoSecurityLabs/pacu）。

演讲：

BlackHat Europe 2021: https://www.blackhat.com/eu-21/arsenal/schedule/index.html#nebula-a-case-study-in-penetrating-something-as-soft-as-a-cloud-25174

当前涵盖：

AWS、Azure（Graph和Management API）以及DigitalOcean的枚举、利用和后期利用

目前有53个模块覆盖：

侦察
枚举
利用
清理

版本3.0包括：

通过客户端-团队服务器架构进行团队协作
所有请求都需要认证（当然除了认证请求本身）
所有信息都存储在MongoDB服务器中，并可通过命令访问。当然，信息在此之前必须已被枚举，但这允许你不枚举某个特定对象

安装

服务器

Nebula使用python3.11编写。它使用boto3库访问AWS。要安装，只需进入teamserver目录并构建容器：``` $ docker build -t nebula-teamserver .

然后，只需使用docker运行它：```
$ docker run -it nebula-teamserver -dH <database host> -du <database user> -dp <database password> -dn <database name> --p <teamserver password>
------------------------------------------------------------
           _   _      _           _
          | \ | |    | |         | |
          |  \| | ___| |__  _   _| | __ _
          | . ` |/ _ \ '_ \| | | | |/ _` |
  _______ | |\  |  __/ |_) | |_| | | (_| |
 |__   __||_| \_|\___|_.__/ \__,_|_|\__,_|
    | | ___  __ _ _ __ ___  ___  ___ _ ____   _____ _ __
    | |/ _ \/ _` | '_ ` _ \/ __|/ _ \ '__\ \ / / _ \ '__|
    | |  __/ (_| | | | | | \__ \  __/ |   \ V /  __/ |
    |_|\___|\__,_|_| |_| |_|___/\___|_|    \_/ \___|_|
-------------------------------------------------------------
37 aws          0 gcp           4 azure         0 office365
0 docker        0 kubernetes    4 misc          11 azuread
4 digitalocean
-------------------------------------------------------------
60 modules      6 cleanup               0 detection
19 enum         5 exploit               2 persistence
1 listeners     0 lateral movement      7 detection bypass
7 privesc       10 reconnaissance       2 stager        0 postexploitation
1 misc

[*] Port is busy. Is a MongoDB instance running there? [y/N] y
------------------------------------------------------------
[*] JWT Secret Key set to: '<secret value>'
[*] Database Server set to: '<db host>:<db port>'
[*] Database set to: '<db name>'
[*] Teamserver IP address is '<teamserver host>'
[*] User 'cosmonaut' was created!
[*] API Server set to: '<api host>:<api port>'
------------------------------------------------------------

客户端

与客户端 client 相同。只需转到 client 目录并构建容器：``` $ docker build -t nebula-client .

然后，只需使用 docker 运行它：```
$ docker run -it nebula-client -ah <api host> -p <teamserver password> -b
-------------------------------------------------------------
37 aws          0 gcp           4 azure         0 office365
0 docker        0 kubernetes    4 misc          13 azuread
4 digitalocean
-------------------------------------------------------------
62 modules      6 cleanup               0 detection
19 enum         5 exploit               2 persistence
1 listeners     0 lateral movement      7 detection bypass
7 privesc       10 reconnaissance       2 stager
1 misc          2 initialaccess         0 postexploitation
-------------------------------------------------------------

[*] Importing sessions found on ~/.aws
[*] No sessions found on ~/.aws
()()(Nebula) >>>

使用```

                                                  ...........
                                          ...''''''''''''''...
                                       ..'''''...........''''''............
                                     ..''''..             ...'''''''''''''''...
                                   ..'''..                   ..............'''''..
                                  .''''.          .;loddool:'.              ..''''..
                                 ..'''.          .;clokXWWMWNKkl;.             .''''.
                                 .'''.      .',,'..    ';dNMMMMMWKko;.           .'''..
                                .''''.   .cx0NWWNX0koc;,'cKMMMMMMMMMWXOo:.        .''''....
                                .'''.   .',',:oONMMMMMWNNNWMMMMMMWKk0WMMWXx'       .''''''''...
                               ..'''.          .,dXMMMMMMMMMMMMMNOl',oONWWd.        .......'''''..
                            ...'''''..   :o'      cXMMMMMMMMMMMMMWNXKKXNWWKxc,.             ..''''..
                          ..''''....     oNKl'. ..oXMMMMMMMMMMMMMMMMMMMMMMMMMNKOdc,..         ..''''.
                        ..''''..         ,OWWX0O0XWMMMMMMMMMMMMMMMMMMWWWWMMMMMMMMMWXOxooxk:.    ..'''.
     ..'''''''''''''''''''''.             .l0NMMMMMMMMMMMMMMMMMMMMN0dc;;;coONMMMMMMMMMMMMMK:     ..'''.
     .......................                .,dXMMMMMMMMMMMMMMMMMMWX0ko:.  .;OWMMMMMMMMMMMWx.     .'''.
                                              .oWMMMMMMMMMMMMMMWNXXXWMMWKd'  .:lccclodOXWMWd.      .'''.
         ,lc'    ..................   ',.    .,OWMMMMMMMMMMMMXx:'...:0WMMMKl.      .. .'oKO,       .'''.
        ,0MWx.  .''''''''''''''''''.  ;OKOOOO0NWMMMMMMMMMMMMNl.     .cdoox0XOl;'....... ...        .'''.
        .;ol'    ...................   ;kXWMMMMMMMMMMMMMMMMMWx.          .:0WNKkdo:.  ...         .'''.
       ....................              .:ldxk0XWMMMMMMMMMMMW0o'        .';;,.         ....     ..'''.
     ;k00000000000000000000x'                  ..;lkXWMMMMMMMMMWXkc.                            ..'''.
    .lXWWWWWWWWWWWWWWWWWWMMWKl.                     ;OWMMMMMMMMMMMWKx:.                       ..''''.
      .,,,,,,,,,,,,,,,,,:kNMMW0o,.                  'kWMMMMMMMMMMMMMMWKd,.                  ..''''..
                         .:ONMMMNKkdlc:::::::::ccldkKWMMMMMMMMMMMMMMMMMMNOl'    ...........'''''..
                           .,oOXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXkc....''''''''''...
                              .':ldkO0000000000000000000000000000000000000000Ox:.  ........
                                     ...........................................


                               _        _______  ______            _        _______
                              ( (    /|(  ____ \(  ___ \ |\     /|( \      (  ___  )
                              |  \  ( || (    \/| (   ) )| )   ( || (      | (   ) |
                              |   \ | || (__    | (__/ / | |   | || |      | (___) |
                              | (\ \) ||  __)   |  __ (  | |   | || |      |  ___  |
                              | | \   || (      | (  \ \ | |   | || |      | (   ) |
                              | )  \  || (____/\| )___) )| (___) || (____/\| )   ( |
                              |/    )_)(_______/|/ \___/ (_______)(_______/|/     \|
                                                    Because Clouds are so AWSome

Nebula

最受欢迎

Nebula

安装

服务器

客户端

使用```