How to Hack VMware vCenter Server in 60 Seconds

Presented at DEF CON 20 (2012), July 27, 2012, 3:30 p.m. (20 minutes).

This talk will discuss some ways to gain control over the virtual infrastructure through vCenter's services. I will describe a few non-dangerous bugs (they were 0-days when we found them), but if we can use all of them together, we will get administrative access to vCenter which means to the whole virtual network.

Presenters:

• Alexander Minozhenko - Senior Penetration Tester, ERPScan
  Alexander Minozhenko works in the leading IT security company ERPScan as penetration tester. Alexander graduated in 2012 from St. Petersburg National Research University ITMO, faculty of computer science. Also he likes to participate in CTF competition. Twitter: @al3xmin

Links:

• https://defcon.org/html/defcon-20/dc-20-speakers.html#Minozhenko
• https://infocon.org/cons/DEF CON/DEF CON 20/DEF CON 20 video and slides/DEF CON 20 - Alexander Minozhenko - How to Hack VMware vCenter Server in 60 Seconds - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=BthhesrBHfg

Similar Presentations:

• DEF CON 23 (2015) / Exploring Layer 2 Network Security in Virtualized Environments
• ToorCamp 2014 / Virtual Machine Detection Using OS Status Changes
• CanSecWest 2024 / URB Excalibur: The New VMware All-Platform VM Escapes