Skip to main content

Want to Practice These Techniques?

Try Hackviser's interactive cyber security upskilling platform - Learn by doing!

Start Practicing Now

VMware

Default Ports: 443, 902, 903, 5480, 5989

VMware vCenter and ESXi manage virtual machines, hosts, datastores, networks, clusters, snapshots, and permissions. In pentests, a weak VMware management plane can expose critical workloads, VM consoles, datastore files, snapshots, and privileged infrastructure operations.

Common Ports​

Scan both vCenter and direct ESXi host addresses.

PortService
443/TCPvSphere Client, vCenter API, ESXi Host Client
902/TCPESXi NFC and VM console traffic
903/TCPLegacy remote console access
5480/TCPVCSA management interface
5988/TCPCIM over HTTP
5989/TCPCIM over HTTPS
427/TCP/UDPService Location Protocol
22/TCPESXi or appliance SSH

Connect​

Using Web Browser​

The browser confirms whether the target is vCenter, ESXi, or the appliance manager.

https://vcenter.target.local/ui
https://esxi01.target.local/ui
https://vcenter.target.local:5480

Using curl​

Use curl for safe fingerprinting of common web paths.

curl -k -I https://vcenter.target.local/
curl -k -I https://vcenter.target.local/ui/
curl -k -I https://esxi01.target.local/ui/
curl -k -I https://vcenter.target.local:5480/

Using govc​

govc validates vSphere API access and permissions.

export GOVC_URL='https://user:password@vcenter.target.local/sdk'
export GOVC_INSECURE=1

govc about
govc datacenter.info

Using PowerCLI​

PowerCLI is useful for Windows-based VMware administration testing.

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false
Connect-VIServer -Server vcenter.target.local
Get-View ServiceInstance
Get-Datacenter

Using REST API​

The REST API can validate credentials and enumerate inventory.

curl -k -u 'user:password' -X POST https://vcenter.target.local/rest/com/vmware/cis/session
curl -k -H 'vmware-api-session-id: SESSION_ID' https://vcenter.target.local/rest/vcenter/vm

Recon​

Service Detection with Nmap​

Scan common VMware management and host ports.

nmap -p 22,80,443,902,903,427,5480,5988,5989 -sV target.local
nmap -p 443,5480 --script http-title,http-headers,ssl-cert,ssl-enum-ciphers target.local
nmap -p 443 --script vmware-version target.local

Certificate Review​

Certificates often reveal internal hostnames, appliance names, and domains.

openssl s_client -connect vcenter.target.local:443 -servername vcenter.target.local </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
openssl s_client -connect vcenter.target.local:5480 -servername vcenter.target.local </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Product Fingerprinting​

Common VMware paths help identify vCenter, ESXi, VCSA, and disabled features.

curl -k -I https://target.local/ui/
curl -k -I https://target.local/sdk/
curl -k -I https://target.local/mob/
curl -k -I https://target.local/rest/
httpx -u https://target.local -title -tech-detect -status-code -follow-redirects

Management Surface Mapping​

Check which management interfaces are reachable from the tester network.

curl -k -s https://vcenter.target.local:5480/ | head
nmap -p 22 --script ssh2-enum-algos,ssh-hostkey esxi01.target.local
nmap -p 5988,5989 -sV esxi01.target.local

Asset Discovery​

VMware hostnames often follow predictable names.

dig vcenter.target.local
dig esxi01.target.local
printf "vcenter\nvcsa\nesxi01\nesx01\nvmhost01\n" > vmware-hosts.txt
httpx -l vmware-hosts.txt -ports 443,5480 -title -status-code -follow-redirects

Enumeration​

Authentication Enumeration​

Check login paths, SSO behavior, and SDK reachability.

curl -k -I https://vcenter.target.local/ui/
curl -k -I https://vcenter.target.local/websso/
curl -k -I https://vcenter.target.local/sdk/

Inventory Enumeration​

Inventory access shows visible datacenters, clusters, hosts, VMs, and networks.

govc ls
govc find / -type d
govc find / -type h
govc find / -type m
govc find / -type n
govc host.info
govc vm.info -json

PowerCLI Enumeration​

PowerCLI gives a readable view of VMware objects.

Get-Datacenter
Get-Cluster
Get-VMHost
Get-VM
Get-Datastore
Get-VirtualPortGroup

Permission Enumeration​

Review inherited roles and broad administrator assignments.

govc permissions.ls /
govc permissions.ls /Datacenter/vm
govc permissions.ls /Datacenter/host
govc role.ls
Get-VIRole
Get-VIPermission | Select-Object Principal,Role,Entity,Propagate

Datastore Enumeration​

Datastores can contain VM files, ISOs, exports, logs, and sensitive leftovers.

govc datastore.ls
govc datastore.info
govc datastore.ls -ds datastore1
govc datastore.ls -ds datastore1 -R | grep -Ei '\.(vmx|vmdk|nvram|iso|ova|ovf|log|txt|conf)$'

Snapshot Enumeration​

Snapshots can expose sensitive rollback points and data copies.

govc find / -type m
govc snapshot.tree -vm VM_NAME
govc vm.info VM_NAME
govc device.ls -vm VM_NAME

Event Enumeration​

Events reveal logins, administrative changes, snapshots, and console activity.

govc events -n 50
Get-Task | Sort-Object StartTime -Descending | Select-Object -First 25

Direct ESXi Enumeration​

Direct host access may bypass central vCenter assumptions.

export GOVC_URL='https://root:password@esxi01.target.local/sdk'
export GOVC_INSECURE=1

govc about
govc host.info
govc vm.info
govc datastore.ls

Attack Vectors​

Exposed Management Interfaces​

vCenter, ESXi, VCSA, SSH, and CIM should not be reachable from broad networks.

nmap -p 22,443,902,903,5480,5988,5989 --open -sV 10.10.10.0/24
httpx -l vmware-targets.txt -ports 443,5480 -title -status-code -tech-detect

Weak Credentials​

Validate only scoped credentials and avoid noisy password attacks.

export GOVC_URL='https://user:password@vcenter.target.local/sdk'
export GOVC_INSECURE=1
govc about

curl -k -u 'user:password' -X POST https://vcenter.target.local/rest/com/vmware/cis/session

Excessive Permissions​

Dangerous rights include console, datastore, snapshot, host configuration, and role management.

govc permissions.ls /
govc permissions.ls /Datacenter
govc permissions.ls / | grep -Ei 'admin|administrator|domain admins|vmware admins'

Datastore File Exposure​

Read-only datastore access can still expose sensitive VM configuration.

govc datastore.download -ds datastore1 path/to/vm/vm.vmx ./vm.vmx
grep -Ei 'guestinfo|annotation|ethernet|uuid|displayName|sched|tools' ./vm.vmx

Console and Guest Operations​

Console and guest operations privileges can become interactive VM access.

govc vm.info VM_NAME | grep -Ei 'tools|guest'
govc permissions.ls /Datacenter/vm/VM_NAME

Snapshot and Clone Abuse​

Snapshot, clone, and export rights can expose production data.

govc snapshot.tree -vm VM_NAME
govc role.ls ROLE_NAME | grep -Ei 'clone|snapshot|disk|datastore'

ESXi SSH Exposure​

SSH on ESXi should be tightly controlled and rarely exposed.

nmap -p 22 --script ssh2-enum-algos,ssh-hostkey esxi01.target.local
ssh root@esxi01.target.local

SSO and Directory Weaknesses​

AD or LDAP group mappings can grant broad vCenter privileges.

Get-VIPermission | Where-Object {$_.Principal -match "DOMAIN|@"} | Select-Object Principal,Role,Entity,Propagate
Get-VIPermission | Where-Object {$_.Role -match "Admin"} | Select-Object Principal,Entity,Propagate

Post-Exploitation​

Inventory Impact​

Summarize the visible VMware environment.

govc datacenter.info
govc find / -type h
govc find / -type m
govc datastore.ls
govc find / -type n

Permission Review​

Document root, datacenter, VM, and datastore permissions.

govc permissions.ls /
govc permissions.ls /Datacenter
govc permissions.ls /Datacenter/vm
govc permissions.ls /Datacenter/datastore

Sensitive File Review​

Search datastore listings for exports, snapshots, and memory files.

govc datastore.ls -ds datastore1 -R | grep -Ei 'backup|export|secret|password|credential|\.vmsn|\.vmem|\.ova|\.ovf|\.iso'
govc snapshot.tree -vm DomainController01
govc snapshot.tree -vm Database01

Network Mapping​

VMware inventory reveals port groups, VLAN names, and workload placement.

govc find / -type n
govc vm.info -json | jq '.VirtualMachines[] | {name: .Name, networks: .Guest.Net}'
Get-VM | Select-Object Name,@{N="Network";E={(Get-NetworkAdapter -VM $_).NetworkName}}

Evidence Collection​

Collect low-risk evidence instead of downloading disks or memory files.

govc about > vmware-about.txt
govc permissions.ls / > vmware-root-permissions.txt
govc find / -type h > vmware-hosts.txt
govc find / -type m > vmware-vms.txt

Common API Endpoints​

EndpointPurpose
/ui/vSphere Client
/sdk/vSphere SOAP API
/rest/com/vmware/cis/sessionREST session endpoint
/api/sessionNewer API session endpoint
/rest/vcenter/vmVM inventory
/mob/Managed Object Browser
:5480/VCSA management
/folder/Datastore browser path

Useful Tools​

ToolPurpose
nmapService detection
curlEndpoint checks
opensslCertificate review
govcvSphere API enumeration
PowerCLIVMware administration checks
pyvmomiPython vSphere automation
httpxWeb fingerprinting
jqJSON parsing

Security Misconfigurations​

MisconfigurationRisk
vCenter or ESXi exposed broadlyManagement-plane attack surface
Direct ESXi access from user networksCentral control bypass
Weak administrator credentialsInfrastructure compromise
Excessive root or datacenter rolesBroad VM and host control
Datastore browser exposedVM file and config leakage
VM console access too broadInteractive workload access
Snapshot or clone rights too broadProduction data copying
ESXi SSH enabled broadlyHost-level access
VCSA management exposedAppliance administration risk
Missing MFA for adminsCredential theft impact
Outdated VMware componentsKnown vulnerability exposure