Vmware Vcenter Attack
VMware vSphere / vCenter Server external attack matrix, version fingerprinting, the...
Install
npx skills add Zyrexnn/Cybermes --skill vmware-vcenter-attack -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- Design
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
VMware vSphere / vCenter Server external attack matrix, version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-exploited), default credentials, SSO configuration disclosure, vmdir LDAP enumeration, ESXi Open SLP RCE history. ONLY for vCenter / Workspace ONE / Aria instances exposed to the internet, internal-network vCenter is out of scope per the external-only boundary. Use when recon shows port 443 with vCenter banner, `/ui` redirect, `/websso/SAML2/Metadata`, or VMware product fingerprints.
When to use
Trigger when external recon shows ANY of:
- Banner: "VMware vCenter Server", "VMware vSphere Client"
- URL paths:
/ui,/ui/login,/websso/SAML2/Metadata,/sdk,/mob(Managed Object Browser) - TLS cert SAN includes
vcenter/vsphere/vcsa/psc/vmware - Workspace ONE Access / Identity Manager:
/SAAS,/SAAS/auth,/SAAS/login,/SAAS/horizon - VMware Aria / vRealize:
/vco,/vco-controlcenter,/orchestrator,/lcm/api/v1 - Horizon View:
/portal,/admin
Do NOT use for:
- Internal-network vCenter (out of scope, external boundary discipline)
- Pure ESXi hypervisor exposed without management plane (rare on internet; flag as separate finding)
Step 1, Version fingerprinting
TARGET="vcenter.target.com"
# Build info endpoint (often public; revealing exact patch level)
curl -sk "https://$TARGET/sdk/vimServiceVersions.xml"
# UI build (visible in page source)
curl -sk "https://$TARGET/ui/login" | grep -oE 'build[^"]{0,40}'
curl -sk "https://$TARGET/ui/" | grep -oE 'vsphere[^"]{0,40}'
# REST API version (vSphere 7+)
curl -sk "https://$TARGET/api/appliance/system/version"
# Cert metadata
echo | openssl s_client -connect "$TARGET:443" -servername "$TARGET" 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alt"
# SSO Admin Service (info disclosure)
curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"
curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local"
Map build → version → CVE applicability via VMware advisories (vmware.com/security/advisories).
