SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsvmware-vcenter-attack

vmware-vcenter-attack

Security & auditing

View repository

Updated 10-28 03:52

About this skill

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

  1. Ask the user to state the exact target URL, IP, account, or resource.
  2. Ask the user to confirm written authorization and the permitted scope.
  3. Show the exact command(s) and explain their expected effect.
  4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

When to use

Trigger when external recon shows ANY of:

  • Banner: "VMware vCenter Server", "VMware vSphere Client"
  • URL paths: /ui, /ui/login, /websso/SAML2/Metadata, /sdk, /mob (Managed Object Browser)
  • TLS cert SAN includes vcenter / vsphere / vcsa / psc / vmware
  • Workspace ONE Access / Identity Manager: /SAAS, /SAAS/auth, /SAAS/login, /SAAS/horizon
  • VMware Aria / vRealize: /vco, /vco-controlcenter, /orchestrator, /lcm/api/v1
  • Horizon View: /portal, /admin

Do NOT use for:

  • Internal-network vCenter (out of scope — external boundary discipline)
  • Pure ESXi hypervisor exposed without management plane (rare on internet; flag as separate finding)

Evidence and scope

The matrix is historical research, not a current patch inventory; verify exact builds/mitigations in the vendor advisory before asserting applicability. Product-family names and TLS SANs are clues, not proof. Preserve the external-only scope here; newly discovered internal hosts or federated identity providers need separate permission. Queries returning configuration or inventory require data-access scope; do not download VM disks/snapshots or mint tokens merely to increase impact. Read-only HTTP probes can still be logged or rate-limited. Linked tools/helpers and claimed test evidence are not bundled.

Step 1 — Version fingerprinting

TARGET="vcenter.target.com"

# Build info endpoint (often public; revealing exact patch level)
curl -sk "https://$TARGET/sdk/vimServiceVersions.xml"

# UI build (visible in page source)
curl -sk "https://$TARGET/ui/login" | grep -oE 'build[^"]{0,40}'
curl -sk "https://$TARGET/ui/" | grep -oE 'vsphere[^"]{0,40}'

# REST API version (vSphere 7+)
curl -sk "https://$TARGET/api/appliance/system/version"

# Cert metadata
echo | openssl s_client -connect "$TARGET:443" -servername "$TARGET" 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alt"

# SSO Admin Service (info disclosure)
curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"
curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local"

Map build → version → CVE applicability via VMware advisories (vmware.com/security/advisories).

Step 2 — CVE matrix (external-exploitable, sorted by historical impact)

CVE Affected Vector Status
CVE-2024-37085 ESXi 7.0/8.0 < specific patch AD group "ESX Admins" auto-admin bypass High — Domain takeover→ESXi RCE, exploited in ransomware ops
CVE-2024-22273 ESXi/Workstation/Fusion storage controller OOB read/write — requires VM-local access (NOT a pre-auth network SSRF; see Section 9) Important (CVSS 8.1), not external pre-auth
CVE-2024-22252/53 Workstation/Fusion (not vCenter) Sandbox escape Not external
CVE-2023-34048 vCenter 7/8 < specific build DCE/RPC pre-auth heap OOB write → RCE Critical, patched 2023-10
CVE-2023-20887 Aria Operations for Networks Pre-auth command injection → RCE Critical
CVE-2023-20892 vCenter 7/8 Use-after-free in DCE/RPC High
CVE-2022-31656/31659 Workspace ONE Access 21.x Authentication bypass (31656) + authenticated command injection (31659) Critical chained
CVE-2022-22954 Workspace ONE Access Pre-auth server-side template injection (SSTI) → RCE Critical, widely exploited
CVE-2021-22005 vCenter 6.7/7.0 < build Analytics service pre-auth file upload → RCE Critical
CVE-2021-21985 vCenter 6.5/6.7/7.0 < build vSAN Health Check plugin pre-auth RCE Critical
CVE-2021-21972 vCenter 6.5/6.7/7.0 < build vRealize plugin /ui/vropspluginui/rest/services/uploadova pre-auth file upload → RCE Critical, exploited heavily
CVE-2020-3992 ESXi OpenSLP Pre-auth use-after-free → RCE Critical, ESXi ransomware vector
CVE-2019-5544 ESXi OpenSLP Pre-auth heap overflow Critical

Step 3 — CVE-2021-21972 probe (still common on stale appliances)

# Detection only — DO NOT execute the file upload without explicit scope OK
curl -sk -o /dev/null -w "%{http_code}\n" \
  "https://$TARGET/ui/vropspluginui/rest/services/uploadova"
# 405/404/401 are routing/auth observations, not proof of patch state.
# Match exact vendor product/build and mitigations; proxies can change responses.

curl -sk -o /dev/null -w "%{http_code}\n" \
  "https://$TARGET/ui/vropspluginui/rest/services/getstatus"

Public PoC by Mikhail Klyuchnikov exists; do not execute against client infra without explicit RCE-attempt sign-off.

Step 4 — CVE-2022-22954 (Workspace ONE SSTI) probe

# Stage A — detection only: reachability + baseline. No command execution yet.
curl -sk -o /tmp/wone_baseline.txt -w "%{http_code}\n" \
  "https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=probe"
# 4xx with FreeMarker/catalog-portal error template → endpoint present, candidate vulnerable.
# 404 → patched/removed. Keep the baseline body to diff against Stage B.

# Any execution-stage proof requires a separately approved plan and exact
# affected product/build. The imported shell URL was malformed/typoed and is
# deliberately omitted; do not convert a copied template directly into an RCE run.

A reflected canary plus uid= text is not by itself proof of execution; rule out input reflection with controlled expression/output differences. Prefer a harmless lab canary, record exact output and stop when the authorized evidence is sufficient.

Step 5 — Authentication boundary

There is no universal default-password table for these products/versions. Installation and lockout policies vary. Do not use breach-corpus credentials or password spray. Test only an explicitly approved owned account with the agreed attempt limit and stop at lockout/rate-limit indicators; otherwise request a least-privilege assessment account.

Step 6 — SSO / vmdir LDAP enumeration

# SSO Admin endpoint (frequently exposes domain info)
curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local" | xmllint --format -

# Extract Identity Source info
curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"

# Try anonymous LDAP bind to vmdir (port 389/636 if exposed)
ldapsearch -x -H "ldap://$TARGET:389" -b "" -s base
ldapsearch -x -H "ldap://$TARGET:389" -b "cn=Configuration,cn=vmware,cn=cis,dc=vsphere,dc=local"

Step 7 — Managed Object Browser (MOB) — frequently leaks data

curl -skI "https://$TARGET/mob"
# 401 → auth required (good for the defender)
# 200 is only a responding page; verify whether protected synthetic inventory is actually accessible without authentication before claiming disclosure.

# Auth'd MOB lets you walk the entire vSphere tree:
curl -sk -u 'administrator@vsphere.local:<pw>' "https://$TARGET/mob/?moid=ServiceInstance&doPath=content"

Step 8 — vSphere REST API enumeration (post-cred)

# Get session token
curl -sk -X POST -u 'user@vsphere.local:<pw>' "https://$TARGET/api/session"
# Returns: "<session-token>"

# List VMs
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/vm"

# List hosts
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/host"

# List datastores
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/datastore"

# Datastore file download (HUGE — VMDK files, snapshots, credentials in cloud-init)
# /folder/<path>?dsName=<ds>&dcPath=<dc>
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/folder?dsName=datastore1&dcPath=Datacenter"

Step 9 — Workspace ONE Access specific paths

# Metadata
curl -sk "https://$TARGET/SAAS/auth/saml/response"
curl -sk "https://$TARGET/SAAS/auth/wsfed/services/idp"
curl -sk "https://$TARGET/SAAS/jersey/manager/api/health"
curl -sk "https://$TARGET/catalog-portal/services/airwatch/identifiers"

# Login page
curl -sk "https://$TARGET/SAAS/login/0"

Step 10 — Aria / vRealize specific paths

# vRealize Operations Manager
curl -sk "https://$TARGET/suite-api/api/versions"
curl -sk "https://$TARGET/casa/nodes/thumbprints"

# Aria Automation
curl -sk "https://$TARGET/csp/gateway/am/api/about"
curl -sk "https://$TARGET/cluster-administration/api/health"

# vRealize Orchestrator
curl -sk "https://$TARGET/vco/api/about"
curl -sk "https://$TARGET/vco-controlcenter/api/health"

Tooling

  • vCenter-Exploit collection (multiple PoCs on GitHub for 21972, 21985, 22005)
  • Greenbone/openvas-scanner VMware NASL plugins — version detection
  • nuclei templates: vmware-vcenter-*.yaml, cve-2021-21972.yaml, cve-2022-22954.yaml
  • Metasploit modules: exploit/multi/http/vmware_vcenter_*

Detection patterns (what defenders/SOC will see)

  • Excessive 404s on /ui/vropspluginui/* — IDS signature
  • POST to /sdk from non-management IP
  • administrator@vsphere.local auth failures
  • TLS handshake fingerprint changes
  • Plugin upload to vRealize endpoint

Pair with mid-engagement-ir-detection skill — vCenter is monitored heavily in mature SOCs.

External-only boundary check

If recon reveals vCenter only via VPN (not direct internet) → STOP. That is internal infrastructure and outside the external-only AI scope per feedback_skill_boundaries. The user handles internal vCenter work directly.

Internet-exposed vCenter is unfortunately common on the perimeter — and frequently outdated by years. The 2021-21972 / 21985 / 22954 trifecta still pays in 2026 because patching cycles for hypervisor management are slow and vendor-managed.

Severity scoring guidance (red-team deliverable context)

Finding Severity
vCenter on internet, current patch Informational (attack surface note)
vCenter on internet, missing patches with public RCE Critical (entire virtualization plane compromise)
vCenter on internet + default admin password Critical (immediate full takeover)
Workspace ONE on internet, unpatched 22954 Critical
MOB anonymously accessible High (full topology disclosure)
/sdk reachable + version disclosure only Medium (info disclosure + attack-surface concentration)

Anti-patterns

  • DO NOT spray vCenter SSO — lockout is aggressive; one chance often
  • DO NOT execute file-upload PoCs without explicit OK — they create persistent webshells; cleanup overhead and audit trail
  • DO NOT confuse ESXi-management-on-internet with vCenter — different attack surfaces; ESXi Open SLP CVEs target port 427
  • DO NOT skip SSL handshake banner check — VMware exposes versions there; this is the lowest-noise initial probe

Bridge to neighboring skills

  • enterprise-vpn-attack — vCenter is frequently the post-VPN target; if VPN is breached, vCenter is the natural next pivot (but internal — defer to user)
  • m365-entra-attack — vCenter SSO sometimes federated to Entra; cred-chain bridging
  • mid-engagement-ir-detection — vCenter monitoring is sensitive; expect mid-engagement mitigations
  • redteam-report-template — vCenter findings need clear blast-radius framing (this is the virtualization plane, not just an app)

Related Skills & Chains

  • hunt-saml — vCenter Workspace ONE / VMware Identity Manager publishes SAML SP metadata at /SAAS/API/1.0/GET/metadata/idp.xml and consumes assertions at predictable ACS URLs. Chain primitive: vCenter SAML SP metadata reachable → IdP fingerprinted → hunt-saml XSW1-XSW8 against the federating IdP → forged assertion with userPrincipalName=administrator@vsphere.local → SP-impersonation as vCenter admin → full virtualization-plane takeover.
  • hunt-rce — VMware's high-impact CVE catalog (CVE-2021-21972, CVE-2021-21985, CVE-2022-22954, CVE-2023-20887) is almost entirely pre-auth RCE. Chain primitive: vCenter version fingerprint via SSL banner or /ui/login body → confirm patch level missing → hunt-rce deserialization/SSTI gadget from the matching CVE PoC → root on vCenter appliance → API-token mint → cluster-wide VM control.
  • enterprise-vpn-attack — VPN compromise + vCenter on internal-only is a natural post-VPN pivot, but external-only engagement scope sometimes forbids it. Chain primitive: VPN appliance CVE → foothold inside corp network → if scope permits, vmware-vcenter-attack becomes reachable on internal-only vCenter → datacenter takeover.
  • m365-entra-attack — Some VMware deployments federate vCenter SSO to Entra. Chain primitive: vCenter SSO discovery → AuthURL points to login.microsoftonline.com → m365-entra-attack Entra ATO on administrator@vsphere.local synced identity → SAML assertion → vCenter admin without ever brute-forcing vCenter SSO.
  • mid-engagement-ir-detection — VMware vSAN/vCenter alerting is sensitive; expect SOC to patch or block within hours of detection. Chain primitive: confirmed vCenter CVE → run mid-engagement-ir-detection baseline capture BEFORE attempting exploitation → if response patterns change mid-test, capture the SOC-patched state as a SECOND finding (defensive-action observed). Package both via redteam-report-template.

Disclosed CVEs & coordinated-disclosure citations

These are the load-bearing public references for every CVE called out in the matrix above. Every entry includes the vendor advisory, the originating researcher writeup or KEV-catalog entry, and (where public) in-the-wild exploitation references.

1. CVE-2021-21972 — vCenter vropspluginui unauthenticated arbitrary file upload (canonical pre-auth RCE)

2. CVE-2021-21985 — vCenter vSAN Health Check plug-in pre-auth RCE

3. CVE-2021-22005 — vCenter Analytics service arbitrary file upload → RCE

4. CVE-2022-22954 — Workspace ONE Access / Identity Manager FreeMarker SSTI → RCE

5. CVE-2022-22972 — Workspace ONE Access / Identity Manager / vRealize Automation Host-header authentication bypass

6. CVE-2023-20887 — VMware Aria Operations for Networks (vRealize Network Insight) pre-auth command injection → RCE

7. CVE-2023-34048 — vCenter Server DCERPC pre-auth out-of-bounds write → RCE (APT-exploited zero-day)

8. CVE-2024-37085 — ESXi Active Directory integration "ESX Admins" auth bypass (ransomware-favorite)

9. CVE-2024-22273 — ESXi / Workstation / Fusion storage controller OOB read/write

  • Note on the original ticket: This CVE was listed in the brief as "Aria SSRF," but the actual NVD record describes an ESXi/Workstation/Fusion storage-controller out-of-bounds read/write, not an Aria SSRF. The closest Aria SSRF-adjacent issue in the 2024 cycle is CVE-2023-34063 (VMSA-2024-0001) — Aria Automation missing access control allowing authenticated cross-org access; CVSSv3 9.9. Both are cited so the matrix is technically accurate.
  • Affected (CVE-2024-22273): ESXi 7.0/8.0, Workstation 17.x, Fusion 13.x. The vCenter issues in the same advisory are separate CVEs 22274/22275. Requires VM-local access with storage controllers enabled.
  • Attack flow: VM with storage controllers enabled can issue crafted I/O to trigger OOB read/write on the host → information disclosure or DoS of the host (escape not directly demonstrated). CVSS 8.1 (Important).
  • Root cause: Missing bounds check in the storage controller emulation path.
  • Disclosure: Reported by Hao Zheng (@zhz) and Jiaqing Huang (@s0duku) of TianGong Team, Legendsec @ Qi'anxin Group. Advisory VMSA-2024-0011 published 2024-05-21. Year discovered 2024, patched 2024.
  • References: https://www.vmware.com/security/advisories/VMSA-2024-0011.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-22273 ; https://www.rapid7.com/db/vulnerabilities/vmsa-2024-0011-cve-2024-22273/
  • Aria-specific companion — CVE-2023-34063 (VMSA-2024-0001): Aria Automation 8.11.x–8.14.x missing access control — authenticated actor obtains unauthorized cross-organization access to remote workflows. CVSSv3 9.9. Patched in Aria Automation 8.16. References: https://www.vmware.com/security/advisories/VMSA-2024-0001.html ; https://www.cisa.gov/news-events/alerts/2024/01/17/vmware-releases-security-advisory-aria-automation

10. CVE-2020-3992 + CVE-2021-21974 — ESXi OpenSLP pre-auth use-after-free / heap overflow (ESXiArgs ransomware vector)

Bonus: CVE-2022-31656 — Workspace ONE Access / Identity Manager / vRealize Automation auth bypass (post-22972 follow-up)

Key meta-references (cross-CVE)

These CVEs have different products, privileges and prerequisites; not all are pre-auth network issues. A current-minus-one version alone does not establish exposure or severity. Match exact advisory response matrices and observed configuration, then apply the engagement rubric.

Limitations

  • Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
  • Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
  • Validate every finding (see triage-validation) before reporting; report via report-writing. Prefer a sandbox, disposable VM, or controlled lab.

Example

# Read-only first step; confirm scope before anything active.
cat scope.txt  # target list from the authorized engagement brief

Adapted from elementalsouls/Claude-BugHunter (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.