ESXi is VMware's type-1 hypervisor: the vmkernel runs on the hardware, and each virtual machine is backed by a user-space vmx process that emulates its devices. Offensively it is attacked from two directions. From inside a guest, the target is the vmx device emulation, a memory-safety escape to the host. From the host or management network, the targets are the datastores that hold every VM's disks and the management services that give a host shell. ESXi is a high-value target because one host runs many VMs, so host compromise exposes all of them.
# from a guest: emulated device inventory (escape surface)
lspci -nn; lsusb
# from the network: ESXi management surface
nmap -p 22,443,427,902 <esxi-host> # SSH, host UI/API, CIM/SLP, vmx authd
curl -sk https://<esxi-host>/ # host client / API reachable
Subtopics#
- Guest-to-host escape: breaking out of a VM through emulated devices.
- Datastore and VMDK theft: stealing virtual disks and their data.
- Host access and shell: obtaining execution on the ESXi host.
- Known escape exploits: the recurring device-model escapes.