skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

vmware-vcenter-attack

Fingerprint exposed VMware vCenter versions and probe pre-authentication CVEs.

1.1k|191|Updated Jun 24, 2026
Search Tags:#red-team#virtualization#penetration-testing#vmware#offensive-security#vcenter#cve-exploitation
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill vmware-vcenter-attack-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vmware-vcenter-attack
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/vmware-vcenter-attack
Command: npx skills add https://github.com/uphiago/recon-skills --skill vmware-vcenter-attack-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the high risk of unpatched, internet-exposed VMware vCenter, vSphere, Workspace ONE, and Aria management infrastructure, a common high-value target in external penetration tests and red team engagements that often runs outdated versions with critical pre-authentication remote code execution vulnerabilities enabling full takeover of the virtualization plane and all hosted workloads.

Core Features & Use Cases

  • CVE Exploitation Matrix: Covers 10+ high-impact pre-auth CVEs including CVE-2021-21972, CVE-2021-21985, CVE-2022-22954, CVE-2023-34048, and CVE-2024-37085, with step-by-step safe probes, validation logic, and explicit sign-off requirements for exploitation steps.
  • Recon & Fingerprinting: Identifies VMware product banners, exact version build numbers, and exposed management endpoints (Managed Object Browser, SSO, vSphere REST API) to confirm target scope and CVE applicability.
  • Use Case: For example, during an external engagement, if recon reveals a vCenter Server banner on port 443, use this skill to fingerprint the version, probe for unpatched critical CVEs, and gain full control of the virtualization plane including all hosted VMs, datastores, and ESXi hosts.

Quick Start

Use the vmware-vcenter-attack skill to assess the internet-exposed vCenter instance at target.example.com for unpatched critical CVEs and potential full virtualization plane takeover, following all external-only scope and explicit exploitation sign-off rules.

Frequently Asked Questions about vmware-vcenter-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit internet-exposed VMware vCenter during an authorized penetration test?▼

VMware vCenter CVE exploitation covers 10+ high-impact pre-authentication vulnerabilities including CVE-2021-21972, CVE-2021-21985, CVE-2022-22954, CVE-2023-34048, and CVE-2024-37085. These CVEs enable remote code execution and full takeover of unpatched vCenter, vSphere, Workspace ONE, and Aria infrastructure without requiring valid user credentials.

How do I fingerprint a vCenter Server version from external reconnaissance?▼

Fingerprinting a vCenter Server version involves identifying VMware product banners, exact version build numbers, and exposed management endpoints like the Managed Object Browser, SSO, and vSphere REST API. This confirms target scope and CVE applicability during external reconnaissance of internet-exposed infrastructure.

Can I enumerate vmdir LDAP data on an exposed vCenter instance without authentication?▼

Yes, you can enumerate vmdir LDAP data on an exposed vCenter instance without authentication. The skill supports vmdir LDAP enumeration alongside default credential testing to map identities and validate access paths into the VMware vSphere management infrastructure during red team operations.

How do I access virtual machine and datastore resources after compromising vCenter?▼

After compromising vCenter, you access virtual machine and datastore resources via the vSphere REST API. This post-exploitation phase allows full control of the virtualization plane, including all hosted VMs, datastores, and ESXi hosts managed by the compromised vCenter Server instance.

What are the limitations when testing VMware Workspace ONE and Aria instances externally?▼

Limitations when testing VMware Workspace ONE and Aria instances externally include the requirement for explicit exploitation sign-off before executing attack steps and strict adherence to external-only scope. The skill applies only to internet-exposed management infrastructure identified during authorized external penetration tests and red team engagements.

Related Skills

Explore More Software Engineering Skills→
pdparchitectpdparchitect
13

vmware-vcenter-attack

Assess internet-exposed VMware vCenter appliances for vulnerabilities and misconfigurations.

Community
Advanced
kettleofketchupkettleofketchup

vsphere

Manage VMware vSphere and ESXi infrastructure via govc, Ansible, esxcli, and REST APIs.

Community
Intermediate
rahmatullahbossrahmatullahboss

Windows Privilege Escalation

Detect and exploit privilege escalation paths in Windows environments.

Community
Advanced
cybersecwomancybersecwoman
5

vmware-vcenter-attack

Identify and simulate attacks on VMware vCenter Server and Workspace ONE vulnerabilities.

Community
Advanced