VMware™ hypervisor fingerprinting

Description

In this book, we show how to determine hypervisor properties by running commands in the guest operating system, without any special privileges in the host machine running the hypervisor. This can be useful for penetration testing, information gathering, determining the best software configuration for virtualization-sensitive and virtualization-aware software. Finally, we present a reporting tool that unifies all the presented methods, by running them all in sequence and gathering the information in a useful report that can be run from any guest system. Some of the described methods can be used even if the VMware™ Tools are disabled or not installed, or if some of the methods are disabled by host configuration. Some of the methods require “root” privileges, while others do not need it. As we will see, host properties can be extracted from virtual hardware properties and from network services running in the host. These properties include: Virtualization Product and Version, CPU Reservation, Memory Reservation, Ballooning amount, as well as many others. The concept of Nested Virtualization is also analyzed. Finally, we present a reporting tool that unifies all the presented methods, by running them all in sequence and gathering the information in a useful report that can be run from any guest system. Disclaimer I.INTRODUCTION II. Virtual HARDWARE CLUES Determining if the Guest OS is running over a VMware hypervisor Determining Hypervisor Product & Version BIOS Release Date/Address/Size Guest SDK ( for vSphere >= 6.0 ) vmware-checkvm Backdoor command (0Ah - Get VMware version) dmidecode Virtual Devices list (Guest API) Other Stats and Properties Physical CPU Speed Ballooning information Raw information Kernel Modules (vsock, vmw_vsock_vmci, vmwgfx, vmw_vmci) PCI information CPU INFO Advanced low-level tools: VMW Advanced low-level tools:  VM_BACKDUMP Other tools: VSOCKETS_NC Disabling some clues III. Networking Clues ESXi MAC addresses NMAP Service Scans NMAP scan for a host running Windows 7 with VMware Player NMAP scan for a system with a VMware MAC address NMAP scan for a Kali Linux Guest OS (running over VMware Player) NMAP scan for a Nested ESXi Host (running over VMware Player) NMAP scan for a VMware Network Device (running over VMware Player) NMAP scan for a Kali Linux Guest OS (running over VMware ESXi 6.0) NMAP scan for a VMware ESXi Host (checking for “VMware Authentication Daemon”) NMAP scan for a VMware ESXi Host (checking for “VMware ESXi Server httpd”) NMAP scan for a VMware “dnsmasq 2.51” Network Device (running over VMware Player) NMAP scan VMware workstation/PLAYER @ MICROSOFT WINDOWS ESXi Web Servers Scans ESXi Web Server SHA1 fingerprint [36] ESXi Web Server Certificate Details [36] ESXi Web Services (VIM API) VMware Workstation/Player services vmauthd ( VMware Authentication Daemon, VMware Player or ESXi Server) IV. Nested virtualization V. Guest-side reporting about Hypervisor Report example - Kali Linux Guest (over ESXi 6.0 hypervisor) VI. Future Work References Annex  A – More report examples Report example - Kali Linux Guest (over VMware Player 7 hypervisor) Report example – ESXi 6.0 Guest Hypervisor (Nested over VMware Player 7 hypervisor) About the author