cea-sec / sanzu

Graphical remote desktop solution
GNU General Public License v3.0
179 stars 27 forks source link

Windows ivshmem #113

Open serpilliere opened 1 year ago

serpilliere commented 1 year ago

Add ivshmem image exfiltration for windows sanzu_server The guest needs the ivshmem driver provided by redhat. Howto install here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/virtualization_host_configuration_and_guest_installation_guide/form-virtualization_host_configuration_and_guest_installation_guide-para_virtualized_drivers-mounting_the_image_with_virt_manager

The host needs ivshmem activation. For Libvirt, add this to the vm configuration:

<shmem name='test' role='master'>
       <model type='ivshmem-plain'/>
       <size unit='M'>128</size>
</shmem>

For qemu, add this to the command line:

     -device ivshmem-plain,memdev=hostmem \
     -object memory-backend-file,size=128M,share=on,mem-path=/dev/shm/test,id=hostmem \

The server is launched with:

sanzu_server -f sanzu.toml -i -e null

The client with:

RUST_LOG=debug sanzu_client  ip port  -i /dev/shm/test