{"id":64625,"date":"2023-02-08T09:19:50","date_gmt":"2023-02-08T01:19:50","guid":{"rendered":"https:\/\/version-2.com.sg\/?p=63560"},"modified":"2024-09-13T16:31:45","modified_gmt":"2024-09-13T08:31:45","slug":"finding-vmware-esxi-assets","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2023\/02\/finding-vmware-esxi-assets\/","title":{"rendered":"Finding VMware ESXi assets"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Popular hypervisor ESXi has been in the news recently due to fresh targeting by a new strain of ransomware. Known as ESXiArgs<\/a>, this ransomware leverages a 2-year old heap overflow issue in the OpenSLP service that can be leveraged to gain remote code execution on exploitable targets (CVE-2021-21974<\/a>). Many vulnerable public-facing ESXi servers have already been affected by this malware (currently over 1,900 via Censys search results).<\/p>\n

What is the impact? <\/i><\/a><\/h2>\n

Targets of this new ransomware campaign are older ESXi servers running certain versions of 6.5, 6.7, or 7 releases and also have the OpenSLP service enabled (it has not been enabled by default in ESXi releases since 2021). Upon successful exploitation of CVE-2021-21974, the ESXiArgs ransomware will encrypt a number of file types on the target system, including VM-related files with extensions .vmxf, .vmx, .vmdk, .vmsd, and .nvram. Ransom notes are saved as HTML files on compromised systems for admins and users to subsequently discover. While some of these ransom notes claim to have stolen data from vulnerable targets, no data exfiltration has been observed at this time<\/a>.<\/p>\n

Are updates available? <\/i><\/a><\/h2>\n

VMware made patches available<\/a> when the OpenSLP heap-overflow vulnerability was initially reported in 2021. The following ESXi releases have been patched against this attack vector currently being exploited by the ESXiArgs campaign:<\/p>\n