Nebula 是一个云和（希望如此）DevOps 渗透测试框架。它为每个提供者和每个功能构建了模块。截至 2021 年 4 月，它仅涵盖 AWS，但目前是一个正在进行的项目，并有望继续发展以测试 GCP、Azure、Kubernetes、Docker 或 Ansible、Terraform、Chef 等自动化引擎。
目前涵盖：
-
S3 存储桶名称暴力破解
-
IAM、EC2、S3 和 Lambda 枚举
-
IAM、EC2 和 S3 漏洞利用
-
自定义 HTTP 用户代理
目前有50个模块：
-
侦察
-
枚举
-
开发
-
清理
1、从 Github 克隆 Nebula Repo 并拉取 Nebula Docker 镜像：
git clone https://github.com/gl4ssesbo1/Nebuladocker pull gl4ssesbo1/nebula:latest
然后通过以下方式运行 main.py：
docker run -v Nebula:/app -ti gl4ssesbo1/nebula:latest main.py2、从 Github 克隆 Nebula Repo 并在本地构建 Docker 镜像：
git clone https://github.com/gl4ssesbo1/Nebuladocker build -t nebula
然后通过以下方式运行 main.py：
docker run -v Nebula:/app -ti nebula main.pyNebula用python3.8编码，它使用 boto3 库来访问 AWS、只需安装 python 3.8+ 并从requirements.txt安装所需的库。
python3.8 -m pip install -r requirements.txt 然后安装会话管理器插件。这是 SSM 模块所必需的：
curl "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_64bit/session-manager-plugin.deb" -o "session-manager-plugin.deb"dpkg -i session-manager-plugin.deb
在 Windows 设备上，由于没有安装 less，我从https://github.com/jftuga/less-Windows得到了一个 预构建的二进制文件保存在目录 less_binary 中。只需将该目录添加到 PATH 环境变量中就可以了。
然后运行main.py
python3.8 ./main.py.main.py -b-------------------------------------------------------------50 aws 0 gcp 0 azure 0 office3650 docker 0 kubernetes-------------------------------------------------------------50 modules 2 cleanup 0 detection41 enum 6 exploit 0 persistence0 listeners 0 lateral movement 0 detection bypass0 privesc 1 reconnaissance 0 stager------------------------------------------------------------->>>
>>> helpHelp Command: Description:------------help Show help for all the commandshelp credentials Show help for credentialshelp module Show help for moduleshelp workspace Show help for credentialshelp user-agent Show help for credentialsModule Commands Description-----------show modules List all the modulesshow enum List all Enumeration modulesshow exploit List all Exploit modulesshow persistence List all Persistence modulesshow privesc List all Privilege Escalation modulesshow reconnaissance List all Reconnaissance modulesshow listener List all Reconnaissance modulesshow cleanup List all Enumeration modulesshow detection List all Exploit modulesshow detectionbypass List all Persistence modulesshow lateralmovement List all Privilege Escalation modulesshow stager List all Reconnaissance modulesuse module <module> Use a module.options Show options of a module you have selected.run Run a module you have selected. Eg: 'run <module name>'search Search for a module via pattern. Eg: 'search s3'back Unselect a moduleset <option> Set option of a module. Need to have the module used first.unset <option> Unset option of a module. Need to have the module used first.commands Description-----------set user-agent windows Set a windows client user agentset user-agent linux Set a linux client user agentset user-agent custom Set a custom client user agentshow user-agent Show the current user-agentunset user-agent Use the user agent that boto3 producesWorkspace Commands Description-----------create workspace <wp> Create a workspaceuse workspace <wp> Use one of the workspacesremove workspace <wp> Remove a workspace
模块：
()()(AWS) >>> show modulescleanup/aws_iam_delete_access_key Delete access key of a user by providingit.cleanup/aws_iam_delete_login_profile Delete access of a user to the ManagementConsoleenum/aws_ec2_enum_elastic_ips Lists User data of an Instance provided.Requires Secret Key and Access Key of an IAM that has accessto it.enum/aws_ec2_enum_images List all ec2 images. Needs credentials of anIAM with DescribeImages right. Output is dumpled on a file.It takes a sh*tload of time, unfortunately. And boy, is it ahuge output.enum/aws_ec2_enum_instances Describes instances attribues: Instances, VCP,Zones, Images, Security Groups, Snapshots, Subnets, Tags,Volumes. Requires Secret Key and Access Key of an IAM thathas access to all or any of the API calls:DescribeAvailabilityZones, DescribeImages,DescribeInstances, DescribeKeyPairs, DescribeSecurityGroups,DescribeSnapshots, DescribeSubnets, DescribeTags,DescribeVolumes, DescribeVpcs
本文始发于微信公众号（Khan安全攻防实验室）：云渗透安全 - Nebula 自动化测试
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论