27 lines
746 B
Markdown

# VMware ESX / vCenter Pentesting
{{#include ../../banners/hacktricks-training.md}}
## Enumeration
```bash
nmap -sV --script "http-vmware-path-vuln or vmware-version" -p <PORT> <IP>
msf> use auxiliary/scanner/vmware/esx_fingerprint
msf> use auxiliary/scanner/http/ms15_034_http_sys_memory_dump
```
## Bruteforce
```bash
msf> auxiliary/scanner/vmware/vmware_http_login
```
如果你发现有效凭据,可以使用更多 metasploit scanner modules 来获取信息。
### 参见
Linux LPE 通过 VMware Tools service discovery (CWE-426 / CVE-2025-41244):
{{#ref}}
../../linux-hardening/privilege-escalation/vmware-tools-service-discovery-untrusted-search-path-cve-2025-41244.md
{{#endref}}
{{#include ../../banners/hacktricks-training.md}}