SharpStrike：基于C#实现的后渗透漏洞利用工具

关于SharpStrike

SharpStrike是一款基于C#开发的后渗透工具，该工具可以使用CIM或WMI来查询远程系统。除此之外，该工具还可以使用研究人员提供的凭证信息或使用当前的用户会话。

注意：SharpStrike中的某些命令将使用PowerShell结合WMI以实现其功能。

SharpStrike可以帮助广大研究人员收集关于目标远程系统的数据、执行命令以及提取数据等等。该工具允许使用WMI或CIM来跟远程系统进行连接，而CIM的使用则需要我们获取到目标系统的管理员权限。

解决方案架构

SharpStrike由三个主组件构成：

服务层：提供核心功能并由UI层使用（cs、ExecuteWMI.cs、ExecuteCIM.cs）；

模型：包含整个项目所有共享的数据类型；

用户接口：GUI/命令行终端；

工具安装

我们可以选择直接使用该项目【Releases页面】所提供的预构建版本，不过这个版本是在调式模式下构建的。

手动构建

首先，我们需要使用下列命令将该项目源码克隆至本地：

git clone https://github.com/iomoath/SharpStrike.git

接下来，在Visual Studio中加载项目中的SharpStrike.sln文件。

选择顶部菜单中的“构建”项，然后构建解决方案。

此时将会生成两个版本的SharpStrike，即带有GUI界面的WinForms和命令行终端应用程序，每一个版本都实现的是相同的功能。

工具使用

命令行终端版本

SharpStrike.exe --helpSharpStrike.exe --show-commandsSharpStrike.exe --show-examplesSharpStrike.exe -c ls_domain_adminsSharpStrike.exe -c ls_domain_users_listSharpStrike.exe -c cat -f "c:\users\user\desktop\file.txt" -s [remote IP address]SharpStrike.exe -c cat -f "c:\users\user\desktop\file.txt" -s [remote IP address] -u [username] -d [domain] -p [password] -cSharpStrike.exe -c command_exec -e "quser" -s [remote IP address] -u [username] -d [domain] -p [password]

GUI版本

show-commandsshow-examplesls_domain_adminsls_domain_users_listcat -f "c:\users\user\desktop\file.txt" -s [remote IP address]cat -f "c:\users\user\desktop\file.txt" -s [remote IP address] -u [username] -d [domain] -p [password]command_exec -e "quser" [remote IP address] -u [username] -d [domain] -p [password]

功能介绍

文件操作

cat                          -  Reads the contents of a filecopy                         -  Copies a file from one location to anotherdownload**                   -  Download a file from the targeted machinels                           -  File/Directory listing of a specific directorysearch                       -  Search for a file on a userupload**                     -  Upload a file to the targeted machine

横向活动

command_exec**               -  Run a command line command and receive the output. Run with nops flag to disable PowerShelldisable_wdigest              -  Sets the registry value for UseLogonCredential to zeroenable_wdigest               -  Adds registry value UseLogonCredentialdisable_winrm**              -  Disables WinRM on the targeted systemenable_winrm**               -  Enables WinRM on the targeted systemreg_mod                      -  Modify the registry on the targeted machinereg_create                   -  Create the registry value on the targeted machinereg_delete                   -  Delete the registry on the targeted machineremote_posh**                -  Run a PowerShell script on a remote machine and receive the outputsched_job                    -  Not implimented due to the Win32_ScheduledJobs accessing an outdated APIservice_mod                  -  Create, delete, or modify system servicesls_domain_users***           - List domain users                                 ls_domain_users_list***      - List domain users sAMAccountName                  ls_domain_users_email***     - List domain users email address                   ls_domain_groups***          - List domain user groups                           ls_domain_admins***          - List domain admin users                           ls_user_groups***            - List domain user with their associated groupsls_computers***              - List computers on current domain

进程操作

process_kill                 -  Kill a process via name or process id on the targeted machineprocess_start                -  Start a process on the targeted machineps                           -  Process listing

系统操作

active_users                 -  List domain users with active processes on the targeted systembasic_info                   -  Used to enumerate basic metadata about the targeted systemdrive_list                   -  List local and network drivesshare_list                   -  List network sharesifconfig                     -  Receive IP info from NICs with active network connectionsinstalled_programs           -  Receive a list of the installed programs on the targeted machinelogoff                       -  Log users off the targeted machinereboot (or restart)          -  Reboot the targeted machinepower_off (or shutdown)      -  Power off the targeted machinevacant_system                -  Determine if a user is away from the systemedr_query                    -  Query the local or remote system for EDR vendors

日志操作

logon_events                 -  Identify users that have logged onto a system* All PowerShell can be disabled by using the --nops flag, although some commands will not execute (upload/download, enable/disable WinRM)** Denotes PowerShell usage (either using a PowerShell Runspace or through Win32_Process::Create method)*** Denotes LDAP usage - "root\directory\ldap" namespace

工具使用演示

GUI版本使用

参考文献

项目地址

SharpStrike：【GitHub传送门】

【网络安全学习攻略】