network-security-lab

🔬 Network Security Lab A controlled virtual environment simulating real-world attack and defense scenarios 📋 Overview This lab simulates a real-world penetration test and defensive hardening exercise in a fully isolated virtual environment. It demonstrates the full offensive security lifecycle —...

VMware-CVE-2022-22954-Command-Injector

VMware-CVE-2022-22954-Command-Injector Proof of Concept for exploiting VMware CVE-2022-22954 How it works This simple Python script makes a GET request to the specified URL appended with /catalog-portal/ui/oauth/verify?error=&deviceUdid= and then followed by a URL encoded version of this string:...

Log4j-Vulnerability

Log4j Vulnerability Tutorial: https://youtu.be/PNDBjoT83zA Tutorial: https://cryptodeeptech.ru/log4j-vulnerability Background on Log4j Alibaba Cloud Security Team publicly disclosed a critical vulnerability CVE-2021-44228 enabling unauthenticated remote code execution against multiple versions of...

vcenter-log4j

VMware vCenter log4j workaround Script to workaround VMware vCenter log4j vulnerability CVE-2021-44228, as per the VMware KB article. 2021-12-13 02:09 UTC - Added Secure Token & Identity Management services 2021-12-13 12:46 UTC - Added PSC Client for 6.5 - see below VMware have released a python...

CVE-2021-22006

CVE-2021-22005 - Subida de archivos a RCE en VMWare vCenter Server Analizar Uso ------------------------------------------------------------- CVE-2021-22005 - VMWare vCenter Server File Upload to RCE Github: https://github.com/r0ckysec Twitter: https://twitter.com/r0cky6861636b Author: r0cky...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Tested against VMware VCSA 6.7 create ssh keypair ssh-keygen -t rsa -f vcsa.key -N '' create tarbal with ../../../../../home/vsphere-ui/.ssh/authorizedkeys python2 evilarc.py -d 5 -p 'home/vsphere-ui/.ssh' -o unix -f evil.tar authorizedkeys mv evil.tar evil.ova uploa...

libvmdk

libvmdk es una biblioteca para acceder al formato VMware Virtual Disk VMDK. Información del proyecto: Estado: alpha Licencia: LGPL-3.0-or-later Formatos de archivo extent admitidos para lectura: RAW flat COWD versión 1 sparse VMDK versiones 1, 2 y 3 sparse Características admitidas del formato...

VMInjector

V M I n j e c t o r c 2012 by Marco Batista Con licencia GPLv3 consulte el archivo LICENSE Resumen: VMInjector es una herramienta diseñada para omitir las pantallas de autenticación de inicio de sesión de los principales sistemas operativos que se ejecutan en VMware Workstation/Player, mediante l...

VMWare-CVE-2021-21975

VMWare-CVE-2021-21975 VMWare-CVE-2021-21975 SSRF vulnerability Youtube PoC https://www.youtube.com/watch?v=faeTl8ZPs2s Follow Youtube Twitter Telegram Vulnmachines.com...

-CVE-2022-22954-scanner

CVE-2022-22954-scanner Vulnerability Introduction VMware Workspace ONE Access formerly VMware Identity Manager enables employees to accelerate access to SaaS, web, and native mobile applications through multi-factor authentication, conditional access, and single sign-on. Affected versions: VMware...

patch-CVE-2026-11553

Parche: CVE-2026-11553 Detalles de la Vulnerabilidad CVE : CVE-2026-11553 Producto : VMware vCenter Descripción : Omisión de autenticación Gravedad : Crítica Estado del Parche: DESPLEGADO Campo| Valor ---|--- Fecha del Parche| 2026-04-28 Estado| desplegado Desplegado en| Producción Validado por|...

CVE-2021-22005-metasploit

CVE-2021-22005-metasploit the metasploit scriptPOC/EXP about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability preparation POC git clone https://github.com/TaroballzChen/CVE-2021-22005-metasploit cd CVE-2021-22005-metasploit mkdir -p...

cve-2022-31705

CVE-2022-31705 Intro https://www.vmware.com/content/vmware/vmware-published-sites/us/security/advisories/VMSA-2022-0033.html.html Test on windows vmware workstation 16.2.0, with guest os ubuntu server 22 At leat one usb device is be attached to guest machine change the 'qh-field4' in the ehci.c...

CVE-2022-22980

CVE-2022-22980 一个基于本地的 CVE-2022-22980 PoC，有关此漏洞的详细信息请参见 https://tanzu.vmware.com/security/cve-2022-22980。 运行前需要在本地安装 mongodb。 另外，我已在 dockerv 上创建了一个基于 Docker 的 Web 版 PoC。 运行 mvn spring-boot:run 或使用 IDEA 打开，并启动 AccessingDataMongodbApplication...

cve-2022-22954

CVE-2022-22954 This package detects a subset of CVE-2022-22954 attempts and exploits, generates a notice, and also includes the exploit URI and the first 4KB of the data that was sent back to the attacker as a response. While detecting this attack is more straightforward from log analysis, this...

VcenterKiller

VcenterKiller -1. Note For those setting up a vulnerable environment locally, using vckiller to verify log4j will mostly fail, because under VMware's NAT mode, the outgoing network interface in the verification module will be determined as 127.0.0.1, causing the target's LDAP Server address to...

CVE-2021-22005_PoC

CVE-2021-22005PoC CVE-2021-22005PoC getshell: https://gist.github.com/testanull/c2f6fd061c496ea90ddee151d6738d2e verify: https://github.com/knownsec/pocsuite3/blob/master/pocsuite3/pocs/20210923WEBVmwarevCenterServerFIleUploadCVE-2021-20050.py...

alexafaraday

Habilidad de Amazon Alexa para Faraday usando Flask-ASK y las API REST de VMware Este es el repositorio de GitHub para el blogpost sobre Amazon Echo, Python Flask/Flask-ASK y las API de Faraday y sus actualizaciones posteriores. Aprovechamos Flask-Ask para interactuar con la plataforma de Amazon...

cve-2021-22005-exp

cve-2021-22005-exp 0x01 Vulnerability Overview On September 21, 2021, VMware released a security advisory disclosing 19 security vulnerabilities in vCenter Server, with CVSSv3 scores ranging from 4.3 to 9.8. Among them, the most critical vulnerability is an arbitrary file upload vulnerability in...

CVE-2022-22954

CVE-2022-22954 漏洞描述 Workspace ONE Access 提供统一应用门户,通过门户可安全访问企业的所有应用，可用于单点登录。CVE-2022-22954 中，攻击者可构造恶意请求造成模板注入，执行任意代码，控制服务器。 参考文章 https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011 使用说明 批量扫描模式 python3 CVE-2022-22954.py -m scan -f 123.txt 命令执行模式...