vCenter Server is the management plane for a vSphere environment: it inventories and controls many ESXi hosts and all their virtual machines through a web UI and API. Compromising vCenter is compromising the whole estate, because it can run commands in guests, access every datastore, and administer every host. The offensive surface is the management services themselves: enumerating the inventory and exposed endpoints, abusing the Single Sign-On token and identity system, and exploiting the recurring pre-authentication vulnerabilities in vCenter's many bundled services.
# vCenter exposes a web UI/API and several supporting services
nmap -p 443,5480,902,2012,2014 <vcenter> # UI/API, VAMI, authd, vpxd services
curl -sk https://<vcenter>/ui/ # vSphere client
curl -sk https://<vcenter>/sdk/vimServiceVersions.xml # API version/discovery
Subtopics#
- Enumeration: mapping the inventory, hosts, and services.
- SSO and token abuse: the Single Sign-On identity and token system.
- Known management exploits: the recurring pre-auth service vulnerabilities.