VMware vCenter任意文件读取漏洞_vmware directory service 漏洞-CSDN博客

本文链接：https://blog.csdn.net/caiqiiqi/article/details/109092083

参考：

https://twitter.com/ptswarm/status/1316016337550938122
【安全风险通告】VMware vCenter任意文件读取漏洞安全风险通告

安装：
https://blog.csdn.net/shida_csdn/article/details/82863169
https://www.miensi.com/352.html

安装有点麻烦，算了。

下载：
https://my.vmware.com/en/web/vmware/downloads/details?downloadGroup=VC650A&productId=614&rPId=53000

尝试这种方式下载：
https://my.vmware.com/group/vmware/downloads/details?downloadGroup=VC70U1C&productId=974
在这里插入图片描述
发现无权限下载。

7 版本的最新版下载方式：
https://www.vmware.com/cn/try-vmware.html
https://my.vmware.com/cn/group/vmware/evalcenter?p=vsphere-eval-7
在这里插入图片描述

在这里插入图片描述

Linux命令行和图形界面的安装方式：
https://www.altaro.com/vmware/vcenter-server-appliance-6-5-u1-linux/
Windows图形化界面安装：
https://digitalthoughtdisruption.com/2020/09/21/how-to-install-deploy-vcenter-server-appliance-vcsa-7-0-c/

Demo

在6.5版本利用成功：
在这里插入图片描述

排错

503 Service Unavailable (Failed to connect to endpoint: [class Vmacore::Http::LocalServiceSpec:0x000001c34bf226a0] _serverNamespace = /ui action = Allow _port = 5090)

参考：
https://kb.vmware.com/s/article/67818?lang=zh_CN
https://kb.vmware.com/s/article/76719
https://kb.vmware.com/s/article/2121043?lang=zh_CN
https://kb.vmware.com/s/article/59731

使用这个命令查看service：

C:\Program Files\VMware\vCenter Server\bin>service-control --status --all

发现vsphere-ui这个service已经停止：

C:\Program Files\VMware\vCenter Server\bin>service-control --status --all
2021-02-26T02:01:00.825Z   Error: state of svc: VMWareAfdService rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.830Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.837Z   Error: state of svc: vmware-cis-config rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.843Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.849Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.867Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.876Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.884Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.890Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.896Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.903Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.909Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.916Z   Error: state of svc: VMwareDNSService rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.925Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.933Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.944Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.953Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.972Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.981Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:00.991Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.002Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.012Z   Error: state of svc: VMwareSTS rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.021Z   Error: state of svc: VMWareDirectoryService rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.033Z   Error: state of svc: VMWareCertificateService rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.043Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.053Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.061Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.074Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.081Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.090Z   Error: state of svc: VMwareIdentityMgmtService rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.101Z   Error: state of svc: vmon rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

2021-02-26T02:01:01.110Z   Error: state of svc: vmware-psc-client rc : 4, stdout: , stderr: Could not open pipe. Win32ErrCode: 5

Stopped:
 EsxAgentManager VMWareCAMService VMwareComponentManager VServiceManager content-library mbcs rhttpproxy vPostgres vapiEndpoint vimPBSM vmonapi vmsyslogcollector vmware-autodeploy-waiter vmware-imagebuilder vmware-license vmware-network-coredump vmware-perfcharts vmwareServiceControlAgent vpxd vpxd-svcs vsan-health vsphere-ui vspherewebclientsvc

在这里插入图片描述

原因

是部署插件的这个类DirectApiBundleDeployer在插件启动的时候出现了缓存错误，使得部署插件失败

解决方式

vCenter Server 6.7版本已解决。
下载6.7：https://my.vmware.com/en/group/vmware/downloads/info/slug/datacenter_cloud_infrastructure/vmware_vsphere/6_7
或者7.0：
https://my.vmware.com/en/group/vmware/downloads/info/slug/datacenter_cloud_infrastructure/vmware_vsphere/7_0

缓解措施

在确保vsphere-ui这个service停止之后，删除或重命名HTML5 client的work目录：

VCSA: /usr/lib/vmware-vsphere-ui/server/work
VC for Windows: C:\ProgramData\VMware\vCenterServer\runtime\vsphere-ui\server\work

重命名了，然后重新启动：

service-control --start vsphere-ui

结果依然出错：
在这里插入图片描述
继续另外一招：

VCSA: /etc/vmware/vsphere-ui
VC for Windows: C:\ProgramData\VMware\vCenterServer\cfg\vsphere-ui
打开webclient.properties文件：
加入这个属性：

pickup.deployer=true

VMware故障排除流程

图片：
https://kb.vmware.com/servlet/rtaImage?eid=ka05G0000010JGm&feoid=00Nf400000Tyi5C&refid=0EMf40000037Tlv
链接资源：
https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.troubleshooting.doc/GUID-F7638736-6B19-41DA-88C5-6F510254FE99.html

vCenter重启步骤

Windows:
https://kb.vmware.com/s/article/1003895?lang=zh_CN
在这里插入图片描述

在这里插入图片描述

Linux:
https://kb.vmware.com/s/article/2109887?lang=zh_CN

Windows查看进程的命令行参数

wmic process where caption="java.exe" get caption,commandline /value

在这里插入图片描述

vCenter卸载方式

https://docs.vmware.com/cn/VMware-vSphere/6.5/com.vmware.vsphere.install.doc/GUID-390546F8-A394-495E-A353-53261AAFEC87.html