The dump function of SharpSphere allows operators to dump LSASS from any powered on VM managed by vCenter or ESXI, without needing to authenticate to the guest OS and without needing VMware Tools to be installed.

Deployed by all Fortune 500 & Fortune Global 100 companies*, you’re pretty much guaranteed to come up against vSphere on your offensive engagments.

C2 over RDP with mapped drives is nothing new, however this post will show how SharpRDP and C3 can be used in tandem through a Cobalt Strike beacon to provide C2 when only 3389 is accessible.