八大常用渗透测试工具SharpStrike基于C实现的后渗透漏洞利用工具

导读关于SharpStrikeSharpStrike是一款基于C#开发的后渗透工具，该工具可以使用CIM或WMI来查询远程系统。除此之外，该工具还可以使用研究人....

关于SharpStrike

SharpStrike是一款基于C#开发的后渗透工具，该工具可以使用CIM或WMI来查询远程系统。除此之外，该工具还可以使用研究人员提供的凭证信息或使用当前的用户会话。

注意：SharpStrike中的某些命令将使用PowerShell结合WMI以实现其功能。

SharpStrike可以帮助广大研究人员收集关于目标远程系统的数据、执行命令以及提取数据等等。该工具允许使用WMI或CIM来跟远程系统进行连接，而CIM的使用则需要我们获取到目标系统的管理员权限。

解决方案架构

SharpStrike由三个主组件构成：

服务层：提供核心功能并由UI层使用（cs、ExecuteWMI.cs、ExecuteCIM.cs）；

模型：包含整个项目所有共享的数据类型；

用户接口：GUI/命令行终端；

工具安装

我们可以选择直接使用该项目【Releases页面】所提供的预构建版本，不过这个版本是在调式模式下构建的。

手动构建

首先，我们需要使用下列命令将该项目源码克隆至本地：

git clone https://github.com/iomoath/SharpStrike.git

接下来，在Visual Studio中加载项目中的SharpStrike.sln文件。

选择顶部菜单中的“构建”项，然后构建解决方案。

此时将会生成两个版本的SharpStrike，即带有GUI界面的WinForms和命令行终端应用程序，每一个版本都实现的是相同的功能。

工具使用命令行终端版本

SharpStrike.exe --helpSharpStrike.exe --show-commandsSharpStrike.exe --show-examplesSharpStrike.exe -c ls_domain_adminsSharpStrike.exe -c ls_domain_users_listSharpStrike.exe -c cat -f "c:\users\user\desktop\file.txt" -s [remote IP address]SharpStrike.exe -c cat -f "c:\users\user\desktop\file.txt" -s [remote IP address] -u [username] -d [domain] -p [password] -cSharpStrike.exe -c command_exec -e "quser" -s [remote IP address] -u [username] -d [domain] -p [password]

GUI版本

show-commandsshow-examplesls_domain_adminsls_domain_users_listcat -f "c:\users\user\desktop\file.txt" -s [remote IP address]cat -f "c:\users\user\desktop\file.txt" -s [remote IP address] -u [username] -d [domain] -p [password]command_exec -e "quser" [remote IP address] -u [username] -d [domain] -p [password]

功能介绍文件操作

cat - Reads the contents of a filecopy - Copies a file from one location to anotherdownload** - Download a file from the targeted machinels - File/Directory listing of a specific directorysearch - Search for a file on a userupload** - Upload a file to the targeted machine

横向活动

command_exec** - Run a command line command and receive the output. Run with nops flag to disable PowerShelldisable_wdigest - Sets the registry value for UseLogonCredential to zeroenable_wdigest - Adds registry value UseLogonCredentialdisable_winrm** - Disables WinRM on the targeted systemenable_winrm** - Enables WinRM on the targeted systemreg_mod - Modify the registry on the targeted machinereg_create - Create the registry value on the targeted machinereg_delete - Delete the registry on the targeted machineremote_posh** - Run a PowerShell script on a remote machine and receive the outputsched_job - Not implimented due to the Win32_ScheduledJobs accessing an outdated APIservice_mod - Create, delete, or modify system servicesls_domain_users*** - List domain users ls_domain_users_list*** - List domain users sAMAccountName ls_domain_users_email*** - List domain users email address ls_domain_groups*** - List domain user groups ls_domain_admins*** - List domain admin users ls_user_groups*** - List domain user with their associated groupsls_computers*** - List computers on current domain

进程操作

process_kill - Kill a process via name or process id on the targeted machineprocess_start - Start a process on the targeted machineps - Process listing

系统操作

active_users - List domain users with active processes on the targeted systembasic_info - Used to enumerate basic metadata about the targeted systemdrive_list - List local and network drivesshare_list - List network sharesifconfig - Receive IP info from NICs with active network connectionsinstalled_programs - Receive a list of the installed programs on the targeted machinelogoff - Log users off the targeted machinereboot (or restart) - Reboot the targeted machinepower_off (or shutdown) - Power off the targeted machinevacant_system - Determine if a user is away from the systemedr_query - Query the local or remote system for EDR vendors

日志操作

logon_events - Identify users that have logged onto a system * All PowerShell can be disabled by using the --nops flag, although some commands will not execute (upload/download, enable/disable WinRM)** Denotes PowerShell usage (either using a PowerShell Runspace or through Win32_Process::Create method)*** Denotes LDAP usage - "root\directory\ldap" namespace

工具使用演示GUI版本使用

参考文献

项目地址

SharpStrike：【GitHub传送门】

【网络安全学习攻略】