Proxmox's control surface is the REST API and web UI served by pveproxy on port 8006, with the pvesh CLI as a local client. Authentication uses a login ticket (a signed token in a cookie) or an API token, and authorization is a role/permission system over a path hierarchy. Reaching this surface with sufficient rights is estate control: open a VM console, run commands via the guest agent, enter containers, create and restore backups, attach disks, and open a node shell. Flaws in ticket or token handling, or privilege escalation within the role system, give that control without any guest escape.
Drive the API#
# authenticate for a ticket, or use an API token directly
curl -sk -d 'username=root@pam&password=<pw>' https://<node>:8006/api2/json/access/ticket
# API token form (no login needed)
H='Authorization: PVEAPIToken=user@realm!tokenid=<secret>'
curl -sk -H "$H" https://<node>:8006/api2/json/cluster/resources # all VMs/cts/nodes
# act: run a command inside a VM via the guest agent
curl -sk -H "$H" -XPOST https://<node>:8006/api2/json/nodes/<node>/qemu/<vmid>/agent/exec \
-d 'command=id'
# or enter a container / open a node shell through the API
Control actions#
With management access an attacker can:
- execute in VMs via the guest agent, and in containers via pct/exec endpoints
- create/restore vzdump backups and attach/clone disks (data access, see disk theft)
- open the node's shell (termproxy/vncshell) for direct root on the host
- read cluster config, users, tokens, and storage definitions
Permissions are path-scoped, so a limited token still enables whatever its role allows.
Exploitation notes#
- API tokens are bearer credentials scoped by role; a found token (in scripts, CI, or config) acts with its permissions directly, no password needed, so hunt for
PVEAPITokenstrings. - The guest-agent exec endpoint runs commands inside a VM from the management plane, and the termproxy/vncshell endpoints open a node root shell, so management access converts to host and guest execution.
- Enumerate the role grants: a non-root user or token with VM or node privileges may still allow console access, backup restore, or disk attach that reach data;
access/permissionsshows the scope. - Fingerprint the Proxmox version for any ticket/token or privilege-escalation advisory in the management stack.