VMs Looking for a VMware Vcenter Data Exfilteration Technique

[molotov477]

Hello, I was looking for guidance on what is the most quickest way to exfilterate data from a Vcenter, I have admin access on a Vcenter WebUI, I can log in, see the datastores, copy and move, delete and even download them as zip from the browser onto the machine I am accessing it from, the issue is that the machine is sitting on a private network, so I am connecting to the network via RDP onto a Windows Machine that has access to the Web UI of Vcenter, so if I want to exfil the data stores or entire VMs or vmdk files, how can I go about it,

the architecture is as following,

RDP to Windows Machine > Web UI VCenter

I have tried to download a vmdk file in zip format, but then due to large size 150GB, moving it out from the Windows system was a headache, what other options do I have? Directly from Vcenter or from the Windows Machine I download the zip file onto?

Thanks

 

[molotov477]

Hello, still looking for some guidance

 

[Sec13B]

try and see of your login work also ssh .
if your login is good :
use cmd : find / -name "*.vmx"
default is /vmfs/volumes

maybe this will help you :

GitHub - mbadanoiu/CVE-2024-22274: CVE-2024-22274: Authenticated Remote Code Execution in VMware vCenter Server

CVE-2024-22274: Authenticated Remote Code Execution in VMware vCenter Server - mbadanoiu/CVE-2024-22274

github.com

 

[molotov477]

try and see of your login work also ssh .
if your login is good :
use cmd : find / -name "*.vmx"
default is /vmfs/volumes

maybe this will help you :

GitHub - mbadanoiu/CVE-2024-22274: CVE-2024-22274: Authenticated Remote Code Execution in VMware vCenter Server

CVE-2024-22274: Authenticated Remote Code Execution in VMware vCenter Server - mbadanoiu/CVE-2024-22274

github.com

The login is valid for ssh but the issue is that it is not exposed over the internet, so either I have to make a pivot from the windows machine and then try to exfiltrate data.

I will have to double check on the ssh as it allowed me to login but it said that my user was not allowed to run ssh commands on it for some reason.

 

[Sec13B]

it is intranet ?

 

[molotov477]

Yes, it is on intranet, but the CVE you have mentioned, i think will be helpful for me, I will try it out and see how that works for me. Thanks for sharing it.

 

[Sec13B]

if is intranet , everything drag and copy from your sandbox.
or search for the out local dns who can allow use the internet.
about ssh :
after login ssh try sudo su or sudo admin , give you direct root

 

[detroit_clock]

Mount a local path to RDPing windows machine, then download the VMs to that folder.

 

[molotov477]

Mount a local path to RDPing windows machine, then download the VMs to that folder.

Thank you for mentioning that, that was one of the options I was considering doing.