vmware-vcenter-attack – Other skill for AI agents

> ⚠️ AUTHORIZED USE ONLY

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> Mandatory confirmation gate

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

When to use

Trigger when external recon shows ANY of:

• Banner: "VMware vCenter Server", "VMware vSphere Client"
• URL paths: /ui, /ui/login, /websso/SAML2/Metadata, /sdk, /mob (Managed Object Browser)
• TLS cert SAN includes vcenter / vsphere / vcsa / psc / vmware
• Workspace ONE Access / Identity Manager: /SAAS, /SAAS/auth, /SAAS/login, /SAAS/horizon
• VMware Aria / vRealize: /vco, /vco-controlcenter, /orchestrator, /lcm/api/v1
• Horizon View: /portal, /admin

Do NOT use for:

• Internal-network vCenter (out of scope — external boundary discipline)
• Pure ESXi hypervisor exposed without management plane (rare on internet; flag as separate finding)

---

Evidence and scope

The matrix is historical research, not a current patch inventory; verify exact builds/mitigations in the vendor advisory before asserting applicability. Product-family names and TLS SANs are clues, not proof. Preserve the external-only scope here; newly discovered internal hosts or federated identity providers need separate permission. Queries returning configuration or inventory require data-access scope; do not download VM disks/snapshots or mint tokens merely to increase impact. Read-only HTTP probes can still be logged or rate-limited. Linked tools/helpers and claimed test evidence are not bundled.

Step 1 — Version fingerprinting

TARGET="vcenter.target.com"

# Build info endpoint (often public; revealing exact patch level)
curl -sk "https://$TARGET/sdk/vimServiceVersions.xml"

# UI build (visible in page source)
curl -sk "https://$TARGET/ui/login" | grep -oE 'build[^"]{0,40}'
curl -sk "https://$TARGET/ui/" | grep -oE 'vsphere[^"]{0,40}'

# REST API version (vSphere 7+)
curl -sk "https://$TARGET/api/appliance/system/version"

# Cert metadata
echo | openssl s_client -connect "$TARGET:443" -servername "$TARGET" 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alt"

# SSO Admin Service (info disclosure)
curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"
curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local"

Map build → version → CVE applicability via VMware advisories (vmware.com/security/advisories).

---

Step 2 — CVE matrix (external-exploitable, sorted by historical impact)

| CVE | Affected | Vector | Status |

|---|---|---|---|

| CVE-2024-37085 | ESXi 7.0/8.0 < specific patch | AD group "ESX Admins" auto-admin bypass | High — Domain takeover→ESXi RCE, exploited in ransomware ops |

| CVE-2024-22273 | ESXi/Workstation/Fusion storage controller | OOB read/write — requires VM-local access (NOT a pre-auth network SSRF; see Section 9) | Important (CVSS 8.1), not external pre-auth |

| CVE-2024-22252/53 | Workstation/Fusion (not vCenter) | Sandbox escape | Not external |

| CVE-2023-34048 | vCenter 7/8 < specific build | DCE/RPC pre-auth heap OOB write → RCE | Critical, patched 2023-10 |

| CVE-2023-20887 | Aria Operations for Networks | Pre-auth command injection → RCE | Critical |

| CVE-2023-20892 | vCenter 7/8 | Use-after-free in DCE/RPC | High |

| CVE-2022-31656/31659 | Workspace ONE Access 21.x | Authentication bypass (31656) + authenticated command injection (31659) | Critical chained |

| CVE-2022-22954 | Workspace ONE Access | Pre-auth server-side template injection (SSTI) → RCE | Critical, widely exploited |

| CVE-2021-22005 | vCenter 6.7/7.0 < build | Analytics service pre-auth file upload → RCE | Critical |

| CVE-2021-21985 | vCenter 6.5/6.7/7.0 < build | vSAN Health Check plugin pre-auth RCE | Critical |

| CVE-2021-21972 | vCenter 6.5/6.7/7.0 < build | vRealize plugin /ui/vropspluginui/rest/services/uploadova pre-auth file upload → RCE | Critical, exploited heavily |

| CVE-2020-3992 | ESXi OpenSLP | Pre-auth use-after-free → RCE | Critical, ESXi ransomware vector |

| CVE-2019-5544 | ESXi OpenSLP | Pre-auth heap overflow | Critical |

---

Step 3 — CVE-2021-21972 probe (still common on stale appliances)

# Detection only — DO NOT execute the file upload without explicit scope OK
curl -sk -o /dev/null -w "%{http_code}\n" \
  "https://$TARGET/ui/vropspluginui/rest/services/uploadova"
# 405/404/401 are routing/auth observations, not proof of patch state.
# Match exact vendor product/build and mitigations; proxies can change responses.

curl -sk -o /dev/null -w "%{http_code}\n" \
  "https://$TARGET/ui/vropspluginui/rest/services/getstatus"

Public PoC by Mikhail Klyuchnikov exists; do not execute against client infra without explicit RCE-attempt sign-off.

---

Step 4 — CVE-2022-22954 (Workspace ONE SSTI) probe

# Stage A — detection only: reachability + baseline. No command execution yet.
curl -sk -o /tmp/wone_baseline.txt -w "%{http_code}\n" \
  "https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=probe"
# 4xx with FreeMarker/catalog-portal error template → endpoint present, candidate vulnerable.
# 404 → patched/removed. Keep the baseline body to diff against Stage B.

# Any execution-stage proof requires a separately approved plan and exact
# affected product/build. The imported shell URL was malformed/typoed and is
# deliberately omitted; do not convert a copied template directly into an RCE run.

A reflected canary plus uid= text is not by itself proof of execution; rule out input reflection with controlled expression/output differences. Prefer a harmless lab canary, record exact output and stop when the authorized evidence is sufficient.

---

Step 5 — Authentication boundary

There is no universal default-password table for these products/versions. Installation and lockout policies vary. Do not use breach-corpus credentials or password spray. Test only an explicitly approved owned account with the agreed attempt limit and stop at lockout/rate-limit indicators; otherwise request a least-privilege assessment account.

---

Step 6 — SSO / vmdir LDAP enumeration

# SSO Admin endpoint (frequently exposes domain info)
curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local" | xmllint --format -

# Extract Identity Source info
curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"

# Try anonymous LDAP bind to vmdir (port 389/636 if exposed)
ldapsearch -x -H "ldap://$TARGET:389" -b "" -s base
ldapsearch -x -H "ldap://$TARGET:389" -b "cn=Configuration,cn=vmware,cn=cis,dc=vsphere,dc=local"

---

Step 7 — Managed Object Browser (MOB) — frequently leaks data

curl -skI "https://$TARGET/mob"
# 401 → auth required (good for the defender)
# 200 is only a responding page; verify whether protected synthetic inventory is actually accessible without authentication before claiming disclosure.

# Auth'd MOB lets you walk the entire vSphere tree:
curl -sk -u '[email protected]:<pw>' "https://$TARGET/mob/?moid=ServiceInstance&doPath=content"

---

Step 8 — vSphere REST API enumeration (post-cred)

# Get session token
curl -sk -X POST -u '[email protected]:<pw>' "https://$TARGET/api/session"
# Returns: "<session-token>"

# List VMs
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/vm"

# List hosts
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/host"

# List datastores
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/datastore"

# Datastore file download (HUGE — VMDK files, snapshots, credentials in cloud-init)
# /folder/<path>?dsName=<ds>&dcPath=<dc>
curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/folder?dsName=datastore1&dcPath=Datacenter"

---

Step 9 — Workspace ONE Access specific paths

# Metadata
curl -sk "https://$TARGET/SAAS/auth/saml/response"
curl -sk "https://$TARGET/SAAS/auth/wsfed/services/idp"
curl -sk "https://$TARGET/SAAS/jersey/manager/api/health"
curl -sk "https://$TARGET/catalog-portal/services/airwatch/identifiers"

# Login page
curl -sk "https://$TARGET/SAAS/login/0"

---

Step 10 — Aria / vRealize specific paths

# vRealize Operations Manager
curl -sk "https://$TARGET/suite-api/api/versions"
curl -sk "https://$TARGET/casa/nodes/thumbpr

… (full content is in the download package)