{"vulnerability": "CVE-2020-3992", "sightings": [{"uuid": "29619e66-078a-4af0-acdd-bc92f134038d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:20.000000Z"}, {"uuid": "3c920f20-e70a-4f87-9ca0-76f1e0db40b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "48496ba6-cec1-40b7-b5ca-3e07a210bc01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970899", "content": "", "creation_timestamp": "2024-12-24T20:21:27.254278Z"}, {"uuid": "3fb90483-d48e-45a4-b0af-ce205058641a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:48.000000Z"}, {"uuid": "2fcffb7d-4370-41cf-9702-962ac84b3e87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-3992", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bb82a999-e6ea-4328-a873-eb36674501cf", "content": "", "creation_timestamp": "2026-02-02T12:29:06.722068Z"}, {"uuid": "cc38baa0-f2d5-476a-9e46-b8693fa4c242", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/8758", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1a\u6f0f\u6d1e\u5229\u7528\n\u63cf\u8ff0\uff1aCVE-2019-5544\u548cCVE-2020-3992\u6f0f\u6d1e\u5229\u7528\u811a\u672c\nURL\uff1ahttps://github.com/vpxuser/VMware-ESXI-OpenSLP-Exploit\n\n\u6807\u7b7e\uff1a#\u6f0f\u6d1e\u5229\u7528", "creation_timestamp": "2024-10-16T12:53:08.000000Z"}, {"uuid": "9064642a-5580-4f2a-bcf5-3178d205eef4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/ics_cert/670", "content": "\u06cc\u06a9 \u062f\u0631\u0628 \u067e\u0634\u062a\u06cc \u067e\u0627\u06cc\u062a\u0648\u0646 \u06a9\u0647 \u0642\u0628\u0644\u0627\u064b \u0645\u0633\u062a\u0646\u062f \u0646\u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0633\u0631\u0648\u0631\u0647\u0627\u06cc VMware ESXi \u0631\u0627 \u0647\u062f\u0641 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0628\u0647 \u0647\u06a9\u0631\u0647\u0627 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0648\u06cc \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0646\u0646\u062f.\n\n\u06cc\u06a9 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u062c\u062f\u06cc\u062f \u062f\u0631 \u0633\u0631\u0648\u0631 VMware ESXi \u062a\u0648\u0633\u0637 \u0645\u062d\u0642\u0642\u0627\u0646 Juniper Networks \u067e\u06cc\u062f\u0627 \u0634\u062f. \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0645\u062d\u0642\u0642\u0627\u0646 \u0646\u062a\u0648\u0627\u0646\u0633\u062a\u0646\u062f \u062f\u0642\u06cc\u0642\u0627\u064b \u062a\u0639\u06cc\u06cc\u0646 \u06a9\u0646\u0646\u062f \u06a9\u0647 \u0633\u0631\u0648\u0631 \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0645\u062d\u062f\u0648\u062f\u06cc\u062a \u0630\u062e\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u06af\u0632\u0627\u0631\u0634\u060c \u0686\u06af\u0648\u0646\u0647 \u0628\u0647 \u062e\u0637\u0631 \u0627\u0641\u062a\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\u0645\u062d\u0642\u0642\u0627\u0646 \u0628\u0631 \u0627\u06cc\u0646 \u0628\u0627\u0648\u0631\u0646\u062f \u06a9\u0647 CVE-2019-5544 \u0648 CVE-2020-3992 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u062f\u0631 \u0633\u0631\u0648\u06cc\u0633 ESXi OpenSLP \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f.\n\n\u0639\u0644\u06cc\u0631\u063a\u0645 \u0627\u06cc\u0646 \u0648\u0627\u0642\u0639\u06cc\u062a \u06a9\u0647 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0627\u0632 \u0646\u0638\u0631 \u0641\u0646\u06cc \u0646\u06cc\u0632 \u0642\u0627\u062f\u0631 \u0628\u0647 \u062d\u0645\u0644\u0647 \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0648 \u06cc\u0648\u0646\u06cc\u06a9\u0633 \u0627\u0633\u062a\u060c \u062a\u062d\u0644\u06cc\u0644\u06af\u0631\u0627\u0646 \u062a\u0631\u06a9\u06cc\u0628\u06cc \u0627\u0632 \u0646\u0634\u0627\u0646\u0647 \u0647\u0627 \u0645\u0639\u062a\u0642\u062f\u0646\u062f \u06a9\u0647 \u0627\u06cc\u0646 \u0628\u062f\u0627\u0641\u0632\u0627\u0631 \u0628\u0647 \u0637\u0648\u0631 \u062e\u0627\u0635 \u0628\u0631\u0627\u06cc \u062d\u0645\u0644\u0647 \u0628\u0647 ESXi \u062a\u0648\u0633\u0639\u0647 \u06cc\u0627\u0641\u062a\u0647 \u0627\u0633\u062a.\n\n\u062f\u0631\u067e\u0634\u062a\u06cc \u062c\u062f\u06cc\u062f \u067e\u0627\u06cc\u062a\u0648\u0646 \u0647\u0641\u062a \u062e\u0637 \u0628\u0647 \"/etc/rc.local.d/local.sh\" ESXi \u0627\u0636\u0627\u0641\u0647 \u0645\u06cc \u06a9\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0637\u0648\u0644 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f \u0628\u0627\u0642\u06cc \u0645\u06cc \u0645\u0627\u0646\u0646\u062f \u0648 \u062f\u0631 \u0647\u0646\u06af\u0627\u0645 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0627\u062c\u0631\u0627 \u0645\u06cc \u0634\u0648\u0646\u062f. \u0645\u0639\u0645\u0648\u0644\u0627 \u0627\u06cc\u0646 \u0641\u0627\u06cc\u0644 \u062e\u0627\u0644\u06cc \u0627\u0633\u062a.\n\n\u06cc\u06a9\u06cc \u0627\u0632 \u062e\u0637\u0648\u0637\u060c \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u067e\u0627\u06cc\u062a\u0648\u0646 \"/store/packages/vmtools.py\" \u0631\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a\u06cc \u06a9\u0647 \u062a\u0635\u0627\u0648\u06cc\u0631 \u062f\u06cc\u0633\u06a9 \u0645\u0627\u0634\u06cc\u0646 \u0645\u062c\u0627\u0632\u06cc\u060c \u06af\u0632\u0627\u0631\u0634\u200c\u0647\u0627 \u0648 \u0645\u0648\u0627\u0631\u062f \u062f\u06cc\u06af\u0631 \u062f\u0631 \u0622\u0646 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f\u060c \u0627\u062c\u0631\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644\u060c \u0646\u0627\u0645 \u0641\u0627\u06cc\u0644 \u0648 \u0645\u06a9\u0627\u0646 /store/packages/vmtools.py \u0628\u0647 \u06af\u0648\u0646\u0647\u200c\u0627\u06cc \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u0634\u06a9\u06cc \u062f\u0631 \u0645\u0648\u0631\u062f \u0645\u06cc\u0632\u0628\u0627\u0646 \u0645\u062c\u0627\u0632\u06cc\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u062c\u0627\u062f \u0646\u06a9\u0646\u062f.\n\n\u0644\u0627\u0632\u0645 \u0628\u0647 \u0630\u06a9\u0631 \u0627\u0633\u062a \u06a9\u0647 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u067e\u0627\u06cc\u062a\u0648\u0646 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647\u060c \u06a9\u0631\u0627\u0633 \u067e\u0644\u062a\u0641\u0631\u0645 \u0627\u0633\u062a \u0648 \u0628\u0627 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0627\u0646\u062f\u06a9 \u06cc\u0627 \u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u06cc\u0627 \u0633\u0627\u06cc\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc \u0645\u0634\u0627\u0628\u0647 \u06cc\u0648\u0646\u06cc\u06a9\u0633 \u0642\u0627\u0628\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\u0627\u06cc\u0646 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a \u06cc\u06a9 \u0648\u0628 \u0633\u0631\u0648\u0631 \u0631\u0627 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc POST \u0645\u062d\u0627\u0641\u0638\u062a \u0634\u062f\u0647 \u0628\u0627 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0631\u0627 \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u062f\u060c \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0634\u0627\u0645\u0644 \u06cc\u06a9 \u0628\u0627\u0631 \u0641\u0631\u0645\u0627\u0646 \u06a9\u062f\u06af\u0630\u0627\u0631\u06cc \u0634\u062f\u0647 \u067e\u0627\u06cc\u0647 \u06f6\u06f4 \u0628\u0627\u0634\u062f \u06cc\u0627 \u06cc\u06a9 \u067e\u0648\u0633\u062a\u0647 \u0645\u0639\u06a9\u0648\u0633 \u0631\u0648\u06cc \u0645\u06cc\u0632\u0628\u0627\u0646 \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n\n\u067e\u0648\u0633\u062a\u0647 \u0645\u0639\u06a9\u0648\u0633 \u0628\u0627\u0639\u062b \u0645\u06cc\u200c\u0634\u0648\u062f \u0633\u0631\u0648\u0631 \u0622\u0633\u06cc\u0628\u200c\u062f\u06cc\u062f\u0647 \u0628\u0627 \u0646\u0648\u06cc\u0633\u0646\u062f\u0647 \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0631\u0642\u0631\u0627\u0631 \u06a9\u0646\u062f\u060c \u06a9\u0647 \u0628\u0647 \u062f\u0648\u0631 \u0632\u062f\u0646 \u0645\u062d\u062f\u0648\u062f\u06cc\u062a\u200c\u0647\u0627\u06cc \u0641\u0627\u06cc\u0631\u0648\u0627\u0644 \u06a9\u0645\u06a9 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06cc\u0627 \u0628\u0627 \u0627\u062a\u0635\u0627\u0644 \u0634\u0628\u06a9\u0647 \u0645\u062d\u062f\u0648\u062f \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u0645\u062d\u0642\u0642\u0627\u0646 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f\u0646\u062f \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0647\u0645\u0686\u0646\u06cc\u0646 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u067e\u0631\u0648\u06a9\u0633\u06cc \u0645\u0639\u06a9\u0648\u0633 ESXi HTTP \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0627\u062f\u0646\u062f \u062a\u0627 \u0627\u0645\u06a9\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u0631\u0627\u06cc \u0628\u0631\u0642\u0631\u0627\u0631\u06cc \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 \u0648\u0628 \u0633\u0631\u0648\u0631 \u062a\u0639\u0628\u06cc\u0647 \u0634\u062f\u0647 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u06a9\u0646\u062f.\n\n\u0627\u0632 \u0622\u0646\u062c\u0627\u06cc\u06cc \u06a9\u0647 \u0641\u0627\u06cc\u0644 \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0631\u0627\u06cc \u062a\u0646\u0638\u06cc\u0645 \u0627\u06cc\u0646 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u062c\u062f\u06cc\u062f\u060c \"/etc/vmware/rhttpproxy/endpoints.conf\" \u0646\u06cc\u0632 \u067e\u0633 \u0627\u0632 \u0631\u0627\u0647 \u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f \u067e\u0634\u062a\u06cc\u0628\u0627\u0646 \u06af\u06cc\u0631\u06cc \u0648 \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc \u0645\u06cc \u0634\u0648\u062f\u060c \u0647\u0631\u06af\u0648\u0646\u0647 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0631 \u0622\u0646 \u062d\u0641\u0638 \u0645\u06cc \u0634\u0648\u062f.\n\n\u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0628\u0631\u0627\u06cc \u06cc\u0627\u0641\u062a\u0646 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0633\u0627\u0632\u0634\u060c \u0648\u062c\u0648\u062f \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0630\u06a9\u0631 \u0634\u062f\u0647 \u062f\u0631 \u0628\u0627\u0644\u0627 \u0648 \u062e\u0637\u0648\u0637 \u0627\u0636\u0627\u0641\u06cc \u0631\u0627 \u062f\u0631 \u0641\u0627\u06cc\u0644 \"local.sh\" \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f.\n\n\u0647\u0645\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u06a9\u0647 \u062f\u0631 \u0637\u0648\u0644 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u0646\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0647 \u062f\u0642\u062a \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f \u062a\u0627 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0645\u0634\u06a9\u0648\u06a9 \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f \u0648 \u0631\u0648\u06cc \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0635\u062d\u06cc\u062d \u062a\u0646\u0638\u06cc\u0645 \u0634\u0648\u0646\u062f.\n\n\u062f\u0631 \u0646\u0647\u0627\u06cc\u062a\u060c \u0645\u062f\u06cc\u0631\u0627\u0646 \u0628\u0627\u06cc\u062f \u062a\u0645\u0627\u0645 \u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0634\u0628\u06a9\u0647 \u0648\u0631\u0648\u062f\u06cc \u0631\u0627 \u0628\u0647 \u0645\u06cc\u0632\u0628\u0627\u0646\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0639\u062a\u0645\u0627\u062f \u0645\u062d\u062f\u0648\u062f \u06a9\u0646\u0646\u062f \u0648 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0648\u062c\u0648\u062f \u06a9\u0647 \u0628\u0647 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0628\u0631\u0627\u06cc \u0628\u0647 \u062e\u0637\u0631 \u0627\u0646\u062f\u0627\u062e\u062a\u0646 \u0627\u0648\u0644\u06cc\u0647 \u0631\u0633\u06cc\u062f\u06af\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0628\u0627\u06cc\u062f \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a \u0627\u0639\u0645\u0627\u0644 \u0634\u0648\u0646\u062f.\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2022-12-15T08:27:22.000000Z"}, {"uuid": "126be2d6-db42-4a30-bef1-fb4ee3de5fd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "https://t.me/poxek/1789", "content": "VMware ESXI OpenSLP PoCs\nCVE-2020-3992 \u0418 CVE-2019-5544\n\u041f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e \u043d\u0430 ESXI, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 VMware Workstation. \u041d\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u043e\u043b\u0435 srvtype (service:VMwareInfrastructure).\nhttps://github.com/dgh05t/VMware_ESXI_OpenSLP_PoCs\n\n\u0414\u043d\u0435\u0432\u043d\u0438\u043a \u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430 \ud83d\udee1", "creation_timestamp": "2022-06-21T15:00:39.000000Z"}, {"uuid": "57ce750a-3770-430b-921c-651b1de2d519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "Telegram/OWG8M4ZWTuqEvJ4GOpQDjKmAbX2h_7iznrPl5JoimAU_bNY", "content": "", "creation_timestamp": "2023-02-04T16:53:00.000000Z"}, {"uuid": "d87b6d1d-4c04-430a-8deb-dc3587a6f708", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/arpsyndicate/1894", "content": "#ExploitObserverAlert\n\nCVE-2020-3992\n\nDESCRIPTION: Exploit Observer has 11 entries related to CVE-2020-3992. OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.\n\nFIRST-EPSS: 0.228610000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-18T02:38:25.000000Z"}, {"uuid": "8a43d2f1-c1da-4d9a-8a99-2a4ea853b1ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "https://t.me/MrVGunz/1089", "content": "Successive / repetition\nCVE-2023-27532 : Veeam Backup and Replication\nPOC : https://github.com/horizon3ai/CVE-2023-27532\nPOC : https://github.com/sfewer-r7/CVE-2023-27532\nCVE-2023-32315 : Openfire\nPOC : https://github.com/tangxiaofeng7/CVE-2023-32315-Openfire-Bypass\nCVE-2021-21974 & CVE-2020-3992: VMware ESXi OpenSLP\n1 : https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9\n2 : https://blog.ovhcloud.com/ransomware-targeting-vmware-esxi/\n3 : https://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\nPOC : https://github.com/Shadow0ps/CVE-2021-21974\nPOC : https://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2021-21974.py", "creation_timestamp": "2024-05-09T11:31:16.000000Z"}, {"uuid": "423d433e-e07e-419e-95df-7a1217e12437", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/true_secator/3820", "content": "\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0440\u0430\u043d\u0435\u0435 \u043d\u0435\u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 Python, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b VMware ESXi, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u041d\u043e\u0432\u044b\u0439 \u043c\u0430\u043b\u0432\u0430\u0440\u044c \u0431\u044b\u043b \u043d\u0430\u0439\u0434\u0435\u043d\u00a0\u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 VMware ESXi \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 Juniper Networks. \u041e\u0434\u043d\u0430\u043a\u043e \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u0430\u043c \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0442\u043e\u0447\u043d\u043e \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c, \u043a\u0430\u043a \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u044b\u043b \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0438\u0437-\u0437\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442, \u0447\u0442\u043e \u0434\u043b\u044f \u043c\u043e\u0433\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f CVE-2019-5544 \u0438 CVE-2020-3992 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 ESXi OpenSLP.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0438 Unix, \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u043e \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0447\u0442\u043e \u043e\u043d\u043e \u0431\u044b\u043b\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043f\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 ESXi.\n\n\u041d\u043e\u0432\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 Python \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0435\u043c\u044c \u0441\u0442\u0440\u043e\u043a \u0432 \u00ab/etc/rc.local.d/local.sh\u00bb ESXi, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u043c\u0435\u0436\u0434\u0443 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435. \u041e\u0431\u044b\u0447\u043d\u043e \u044d\u0442\u043e\u0442 \u0444\u0430\u0439\u043b \u0431\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0441\u0442.\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u0441\u0442\u0440\u043e\u043a \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 Python \u00ab/store/packages/vmtools.py\u00bb \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435, \u0433\u0434\u0435 \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u0438\u0441\u043a\u043e\u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d, \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u0438 \u043c\u043d\u043e\u0433\u043e\u0435 \u0434\u0440\u0443\u0433\u043e\u0435. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0438\u043c\u044f \u0444\u0430\u0439\u043b\u0430 \u0438 \u0435\u0433\u043e \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 /store/packages/vmtools.py \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u044b \u0442\u0430\u043a, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0439 \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0445\u043e\u0441\u0442\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0421\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0432 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 Python \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043a\u0440\u043e\u0441\u0441-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435\u043d\u043d\u044b\u043c \u0438 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u043b\u0438 \u0432\u043e\u0432\u0441\u0435 \u0431\u0435\u0437 \u043d\u0438\u0445 \u0432 Linux \u0438\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 UNIX-\u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u0421\u043a\u0440\u0438\u043f\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043e\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0435\u043c POST-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0435 base-64 \u0438\u043b\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0442\u043d\u0443\u044e \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435.\n\n\u041e\u0431\u0440\u0430\u0442\u043d\u0430\u044f \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441 \u0430\u0432\u0442\u043e\u0440\u043e\u043c, \u0447\u0442\u043e \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430 \u0438\u043b\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435\u043c.\n\n\u0420\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e HTTP-\u043f\u0440\u043e\u043a\u0441\u0438 ESXi, \u0447\u0442\u043e\u0431\u044b \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u0441\u0432\u044f\u0437\u0438 \u0441 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u044b\u043c \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n\n\u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u044d\u0442\u043e\u0439 \u043d\u043e\u0432\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u00ab/etc/vmware/rhttpproxy/endpoints.conf\u00bb, \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u0430\u044f \u043a\u043e\u043f\u0438\u044f \u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043b\u044e\u0431\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u043d\u0435\u043c \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432, \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0445 \u0432\u044b\u0448\u0435, \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0442\u0440\u043e\u043a \u0432 \u0444\u0430\u0439\u043b\u0435 \u00ablocal.sh\u00bb, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.\n\n\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044e\u0449\u0438\u0435\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435, \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0442\u0449\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u044b \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u044b \u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c.\n\n\u041d\u0430\u043a\u043e\u043d\u0435\u0446, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0432\u0441\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u043c\u0438 \u0445\u043e\u0441\u0442\u0430\u043c\u0438, \u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0435 \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438, \u0434\u043e\u043b\u0436\u043d\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435.", "creation_timestamp": "2022-12-13T16:00:08.000000Z"}, {"uuid": "2ca0ec40-7cf6-4eab-baff-087cb14e34be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/true_secator/4055", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u043e\u0432\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 ransomware ESXiArgs \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u044f\u0435\u0442 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d VMware ESXi.\n\n\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a CERT-FR \u0438 CISA \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f\u00a0\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c ESXi, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0442\u044b\u0441\u044f\u0447\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 VMware, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 CVE-2021-21974, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0435\u0449\u0435 \u0434\u0432\u0430 \u0433\u043e\u0434\u0430 \u043d\u0430\u0437\u0430\u0434. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 OpenSLP.\n\n\u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 VMware \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e CVE-2021-21974, \u043d\u043e \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0438 0-day \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c.\n\n\u0412 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, GreyNoise \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0433\u043e\u0434\u044b \u0432 ESXi \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 OpenSLP \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438 \u043b\u044e\u0431\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u043c\u043e\u0433\u043b\u0430 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 ESXiArgs,\u00a0\u0432\u043a\u043b\u044e\u0447\u0430\u044f CVE-2020-3992 \u0438 CVE-2019-5544.\n\n\u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f ESXiArgs \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0431\u044b\u043b \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a CISA \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b\u0439 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b\u00a0\u0431\u0435\u0437 \u0443\u043f\u043b\u0430\u0442\u044b \u0432\u044b\u043a\u0443\u043f\u0430.\n\n\u0412\u0441\u0435 \u0434\u0435\u043b\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f ransomware, \u043a\u0430\u043a \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b, \u0431\u044b\u043b\u0430 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0412\u041c \u0438 \u043d\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043b\u043e\u0441\u043a\u0438\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0434\u0430\u043d\u043d\u044b\u043c\u0438. \n\n\u0423\u0442\u0438\u043b\u0438\u0442\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043d\u0435\u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043f\u043b\u043e\u0441\u043a\u0438\u0445 \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u0412 \u043e\u0431\u0440\u0430\u0437\u0446\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0448\u0442\u0430\u043c\u043c\u0430 size_step \u0441\u043a\u0440\u0438\u043f\u0442\u0430 encrypt.sh \u0438\u043c\u0435\u043b \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 1, \u0448\u0438\u0444\u0440\u0443\u044f 1 \u041c\u0411 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u043f\u0443\u0441\u043a 1 \u041c\u0411 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u042d\u0442\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0444\u0430\u0439\u043b\u0430\u0445, \u0447\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u043b\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c \u0438\u0445 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0441\u0442\u0430\u043b\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0434\u0430\u0436\u0435 \u0441 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 SLP. \u0422\u0430\u043a\u0436\u0435 \u0432 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0431\u044d\u043a\u0434\u043e\u0440 vmtool.py.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0437\u0430\u043f\u0438\u0441\u043a\u0430 \u043e \u0432\u044b\u043a\u0443\u043f\u0435 ESXiArgs \u043f\u0435\u0440\u0435\u0441\u0442\u0430\u043b\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u0430\u0434\u0440\u0435\u0441\u0430 BTC.\u00a0\u0416\u0435\u0440\u0442\u0432\u0430\u043c \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c\u0441\u044f \u0441 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430\u043c\u0438 TOX, \u0430 \u0441\u0443\u043c\u043c\u0430 \u0432\u044b\u043a\u0443\u043f\u0430 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 2 \u0431\u0438\u0442\u043a\u043e\u0439\u043d\u0430.\n\n\u0412 \u0446\u0435\u043b\u043e\u043c \u0438\u043c\u0435\u044e\u0449\u0438\u0435\u0441\u044f \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442 \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u044e\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0443\u0442\u0435\u043a\u0448\u0435\u043c \u0432 2021 \u0433\u043e\u0434\u0443 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 Babuk.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0442\u0430\u0440\u0433\u0435\u0442\u0438\u043d\u0433 \u0438 \u043d\u0438\u0437\u043a\u0430\u044f \u0441\u0443\u043c\u043c\u0430 \u0432\u044b\u043a\u0443\u043f\u0430 \u0434\u0430\u044e\u0442 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0430\u0433\u0430\u0442\u044c, \u0447\u0442\u043e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u043c\u0438 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u041e\u0441\u0442\u0430\u0432\u0438\u0432 \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b \u0430\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u0438, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Rapid7 \u0431\u043e\u043b\u044c\u0448\u0435 \u0432\u043e\u043b\u043d\u0443\u0435\u0442 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u043a\u0430\u0440\u0442\u0438\u043d\u0430.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 Project Sonar, \u043f\u043e\u0447\u0442\u0438 19 000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 ESXi \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f CVE-2021-21974.\n\n\u041f\u0440\u0438 \u0442\u043e\u043c, \u0447\u0442\u043e \u0440\u0435\u0441\u0435\u0440\u0447\u0435\u0440\u044b \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0438 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b ESXi, \u043d\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439 ESXiArgs, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CVE-2021-21974.\n\n\u041a \u0438\u0445 \u0447\u0438\u0441\u043b\u0443, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 RansomExx2, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Rust.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c, \u043a\u0440\u043e\u043c\u0435 \u043a\u0430\u043a \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e IP-\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430, \u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d.", "creation_timestamp": "2023-02-10T18:10:06.000000Z"}, {"uuid": "af635a58-9736-4f8c-8788-93f4e820d7f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "exploited", "source": "https://t.me/true_secator/1384", "content": "\u0416\u0443\u0440\u043d\u0430\u043b\u0438\u0441\u0442\u044b ZDNet \u0441\u043e\u043e\u0431\u0449\u0430\u044e\u0442, \u0447\u0442\u043e \u0441 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u0441\u0442\u0430\u043b\u0438 \u043f\u043e\u044f\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 ransomware RansomExx \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445.\n\n\u0418\u043c\u0435\u044e\u0449\u0438\u0435\u0441\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0432\u0438\u0434\u0435\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0443\u044e\u0442, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 CVE-2019-5544 \u0438 CVE-2020-3992 \u0432 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0435 VMware ESXi, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u0437\u044f\u0442\u044c \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u043f\u043e\u0434 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b SLP \u0435\u0441\u043b\u0438 \u043e\u043d \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0442\u043e\u0439 \u0436\u0435 \u0441\u0435\u0442\u0438. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0445\u0430\u043a\u0435\u0440\u044b \u0448\u0438\u0444\u0440\u0443\u044e\u0442 \u0432\u0441\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0436\u0435\u0441\u0442\u043a\u0438\u0435 \u0434\u0438\u0441\u043a\u0438.\n\nRansomExx - \u044d\u0442\u043e \u0442\u0435 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b\u0438  \u0431\u0440\u0430\u0437\u0438\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0441\u0430\u043c\u043e\u043b\u0435\u0442\u043e\u0432 Embraer, \u0411\u0440\u0430\u0437\u0438\u043b\u044c\u0441\u043a\u0438\u0439 \u0432\u0435\u0440\u0445\u043e\u0432\u043d\u044b\u0439 \u0441\u0443\u0434, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u043a\u043e\u0433\u043e IT-\u0433\u0438\u0433\u0430\u043d\u0442\u0430 Tyler Technologies, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u0430\u043f\u043b\u0430\u0442\u0438\u043b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043a\u0443\u043f.\n\n\u041a\u0440\u043e\u043c\u0435 RansomExx, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 \u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d \u0437\u0430\u044f\u0432\u0438\u043b \u0432\u043b\u0430\u0434\u0435\u043b\u0435\u0446 ransomware Babuk Locker.\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 VMWare ESXi.", "creation_timestamp": "2021-02-02T11:03:16.000000Z"}, {"uuid": "60787e3b-ccb2-4ca9-b903-4d3d717317ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/information_security_channel/41151", "content": "VMware Patches Critical Code Execution Vulnerability in ESXi\nhttp://feedproxy.google.com/~r/Securityweek/~3/QIKvfsUqS4I/vmware-patches-critical-code-execution-vulnerability-esxi\n\nVMware this week informed customers that it has patched several vulnerabilities in its ESXi, Workstation, Fusion and NSX-T products, including a critical flaw that allows arbitrary code execution.\nThe critical vulnerability, identified as CVE-2020-3992, has been described as a use-after-free issue that affects the OpenSLP service in ESXi.\nread more (https://www.securityweek.com/vmware-patches-critical-code-execution-vulnerability-esxi)", "creation_timestamp": "2020-10-21T17:43:33.000000Z"}, {"uuid": "d3bd993a-ad26-4f52-a4fe-0bce524a6037", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "exploited", "source": "https://t.me/xakep_ru/10338", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VMWare ESXi \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0438\u0441\u043a\u043e\u0432\n\n\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u044b \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 VMWare ESXi (CVE-2019-5544 \u0438 CVE-2020-3992) \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043c\u0430\u0448\u0438\u043d\u044b.\n\nhttps://xakep.ru/2021/02/03/esxi-ransomware/", "creation_timestamp": "2021-02-03T21:05:11.000000Z"}, {"uuid": "d9150b2e-2742-4b22-8d4c-a03681bf07cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "exploited", "source": "https://t.me/vxunderground/309", "content": "1. \u0414\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043e\u0431\u0440\u0430\u0437\u0446\u044b APT \u0433\u0440\u0443\u043f\u043f\u044b Naikon\n\n\u0418\u043d\u0444\u0430\n\u0421\u043a\u0430\u0447\u0430\u0442\u044c\n\n2. \u0414\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043c\u0430\u043b\u0432\u0430\u0440\u044c Darkside && Defray777 - \u043f\u043e\u0434 \u043b\u0438\u043d\u0443\u043a\u0441, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 VMware ESX CVE-2019-5544/ CVE-2020-3992\n\n\u0424\u0430\u0439\u043b:BGH_ESXiExploitMalware.zip\n\nhttps://vxug.fakedoma.in/tmp/\n\n3. \u041c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b Intrusion Truth \u043e \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 APT\n\nhttps://vxug.fakedoma.in/tmp/IntrusionTruth/", "creation_timestamp": "2022-05-15T17:42:57.000000Z"}, {"uuid": "74af5c9d-c42a-440b-bee6-e95acaac8166", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "https://t.me/arvin_club/6422", "content": "Decrypt your.vmdk affected by CVE-2020-3992 \n\u0645\u062a\u0648\u062f\u06cc \u0628\u0631\u0627\u06cc \u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u0641\u0627\u06cc\u0644 \u0647\u0627 \u0628\u0631\u0627\u06cc \u062e\u06cc\u0644\u06cc\u0627 \u06a9\u0627\u0631 \u06a9\u0631\u062f\u0647 \u0648 \u0628\u0631\u0627\u06cc \u0628\u0639\u0636\u06cc\u0627 \u0646\u0647\nhttps://enes.dev", "creation_timestamp": "2023-02-04T05:57:18.000000Z"}, {"uuid": "145a1833-1643-4c0a-9f1a-af3327970cf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2822", "content": "#Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC for CVE-2021-27249/CVE-2021-27250)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2021-03-06T08:43:32.000000Z"}, {"uuid": "bf7f7959-5509-45aa-9e71-2c217f29ef7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/LearnExploit/4625", "content": "Decrypt your *.vmdk affected by CVE-2020-3992\n\nRead Here \n\n#VMware \n\u2014\u2014\u2014\u2014\u2014\u2014\n0Day.Today\n@LearnExploit\n@Tech_Army", "creation_timestamp": "2023-05-20T00:25:59.000000Z"}, {"uuid": "abf69a08-c121-47f7-8c9d-3fe2549854d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/cibsecurity/15420", "content": "\u203c CVE-2020-3992 \u203c\n\nOpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-20T20:49:28.000000Z"}, {"uuid": "f0d50df5-29b6-41c2-9345-6d4953e98074", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msurrdktk42x", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2020-3992: OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-\u2026\nCVSS 9.8 \u00b7 EPSS 83.0% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2020-3992\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-12T09:08:35.175478Z"}, {"uuid": "057490a3-7cf1-46d9-919f-f6c0ed33283d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/hacking_Attack/80218", "content": "Black Hat Ethical Hacking\nNew Python malware backdoors VMware ESXi servers for remote access\n\nNew Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.\n\nThe new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.\n\nThey believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi\u2019s OpenSLP service.\n\nWhile the malware is technically capable of targeting Linux and Unix systems, too, Juniper\u2019s analysts found multiple indications it was designed for attacks against ESXi.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside \u201c/etc/rc.local.d/local.sh,\u201d one of the few ESXi files that survive between reboots and is executed at startup.\n\nUsually, that file is empty, apart from some advisory comments and an exit statement.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png \n<figcaptionAdditional lines added on ESXi file (Juniper Networks) \nOne of those lines launches a Python script saved as \u201c/store/packages/vmtools.py,\u201d in a directory that stores VM disk images, logs, and more.\n\nThe script\u2019s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.\n\n\u201cWhile the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,\u201d explains Juniper Networks\u2019 report.\n\n\u201cThe name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.\u201d\n\n\u201cThe file begins with a VMware copyright consistent with publicly available \u00a0 examples and is taken character-for-character from an existing Python file provided by VMware.\u201d\n\nThis script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.\n\nThe reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.\n\nOne of the threat actors\u2019 actions observed by Juniper\u2019s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.\n\nBecause the file used for setting this new configuration, \u201c/etc/vmware/rhttpproxy/endpoints.conf,\u201d is also backed up and restored after reboot, any modifications on it are persistent.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt \u200bMitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the \u201clocal.sh\u201d file.\n\nAll configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]", "creation_timestamp": "2026-09-01T20:01:14.055367Z"}, {"uuid": "1408c4f7-579e-4884-8ef9-5317680bfa5f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7f822a3d-f714-404c-8fcb-c1fbea69c625", "content": "", "creation_timestamp": "2026-06-19T12:47:52.603068Z"}, {"uuid": "80a03a0d-641f-4f2e-83ff-ed081426c4da", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9c1df497-4d2a-411c-9f38-03dd58b4c0e1", "content": "", "creation_timestamp": "2026-06-23T14:04:27.474327Z"}, {"uuid": "1699d5fd-1df6-4fc1-879d-978c7fd46b0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/pleyades_it/8451", "content": "\u2757\ufe0fOperadores de #ransomware est\u00e1n explotando dos #vulnerabilidades de VMWare ESXi (CVE-2019-5544 y CVE-2020-3992) para cifrar discos duros virtuales.\nhttps://bit.ly/3oIGyae", "creation_timestamp": "2026-07-12T22:00:16.692343Z"}, {"uuid": "012ea2ab-fb9b-4095-93a9-6cf61510f4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/pleyades_it/8451", "content": "\u2757\ufe0fOperadores de #ransomware est\u00e1n explotando dos #vulnerabilidades de VMWare ESXi (CVE-2019-5544 y CVE-2020-3992) para cifrar discos duros virtuales.\nhttps://bit.ly/3oIGyae", "creation_timestamp": "2026-07-13T00:00:40.527197Z"}, {"uuid": "ecb48f19-9763-4f8c-81af-aefafdd7708c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "exploited", "source": "https://t.me/pleyades_it/8451", "content": "\u2757\ufe0fOperadores de #ransomware est\u00e1n explotando dos #vulnerabilidades de VMWare ESXi (CVE-2019-5544 y CVE-2020-3992) para cifrar discos duros virtuales.\nhttps://bit.ly/3oIGyae", "creation_timestamp": "2026-07-14T00:00:51.769121Z"}, {"uuid": "0b62355e-9562-45bd-923d-efc0c9a8593b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/cissp/2545", "content": "https://kb.vmware.com/s/article/76372\n\nVMSA-2021-0002 (CVE-2021-21974)\nhttps://www.vmware.com/security/\nadvisories/VMSA-2021-0002.html\n\nVMSA-2020-0023 (CVE-2020-3992)\nhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html\n\nVMSA-2019-0022 (CVE-2019-5544)\nhttps://www.vmware.com/security/advisories/VMSA-2019-0022.html\n\n\nhttps://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "creation_timestamp": "2026-09-01T17:00:58.955899Z"}, {"uuid": "faf240cb-43e6-4b94-8fb0-b366e97c4baa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/cissp/2443", "content": "Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2026-09-01T17:01:01.707900Z"}, {"uuid": "ebd6d05c-2e6f-4a04-85ea-775274c6a973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/hacking_Attack/80218", "content": "Black Hat Ethical Hacking\nNew Python malware backdoors VMware ESXi servers for remote access\n\nNew Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.\n\nThe new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.\n\nThey believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi\u2019s OpenSLP service.\n\nWhile the malware is technically capable of targeting Linux and Unix systems, too, Juniper\u2019s analysts found multiple indications it was designed for attacks against ESXi.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside \u201c/etc/rc.local.d/local.sh,\u201d one of the few ESXi files that survive between reboots and is executed at startup.\n\nUsually, that file is empty, apart from some advisory comments and an exit statement.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png \n<figcaptionAdditional lines added on ESXi file (Juniper Networks) \nOne of those lines launches a Python script saved as \u201c/store/packages/vmtools.py,\u201d in a directory that stores VM disk images, logs, and more.\n\nThe script\u2019s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.\n\n\u201cWhile the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,\u201d explains Juniper Networks\u2019 report.\n\n\u201cThe name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.\u201d\n\n\u201cThe file begins with a VMware copyright consistent with publicly available \u00a0 examples and is taken character-for-character from an existing Python file provided by VMware.\u201d\n\nThis script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.\n\nThe reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.\n\nOne of the threat actors\u2019 actions observed by Juniper\u2019s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.\n\nBecause the file used for setting this new configuration, \u201c/etc/vmware/rhttpproxy/endpoints.conf,\u201d is also backed up and restored after reboot, any modifications on it are persistent.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt \u200bMitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the \u201clocal.sh\u201d file.\n\nAll configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]", "creation_timestamp": "2026-09-02T01:01:31.424320Z"}, {"uuid": "6af2bd8b-c755-4de6-ab21-3d9a8dee8aff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/cissp/2545", "content": "https://kb.vmware.com/s/article/76372\n\nVMSA-2021-0002 (CVE-2021-21974)\nhttps://www.vmware.com/security/\nadvisories/VMSA-2021-0002.html\n\nVMSA-2020-0023 (CVE-2020-3992)\nhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html\n\nVMSA-2019-0022 (CVE-2019-5544)\nhttps://www.vmware.com/security/advisories/VMSA-2019-0022.html\n\n\nhttps://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "creation_timestamp": "2026-09-02T01:04:49.738772Z"}, {"uuid": "4b486668-6418-4063-b9ca-512224d09572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/cissp/2443", "content": "Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2026-09-02T01:04:51.839199Z"}, {"uuid": "0378cf02-80b0-43ad-ac3e-d59391e5c98b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/hacking_Attack/80218", "content": "Black Hat Ethical Hacking\nNew Python malware backdoors VMware ESXi servers for remote access\n\nNew Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.\n\nThe new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.\n\nThey believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi\u2019s OpenSLP service.\n\nWhile the malware is technically capable of targeting Linux and Unix systems, too, Juniper\u2019s analysts found multiple indications it was designed for attacks against ESXi.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside \u201c/etc/rc.local.d/local.sh,\u201d one of the few ESXi files that survive between reboots and is executed at startup.\n\nUsually, that file is empty, apart from some advisory comments and an exit statement.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png \n<figcaptionAdditional lines added on ESXi file (Juniper Networks) \nOne of those lines launches a Python script saved as \u201c/store/packages/vmtools.py,\u201d in a directory that stores VM disk images, logs, and more.\n\nThe script\u2019s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.\n\n\u201cWhile the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,\u201d explains Juniper Networks\u2019 report.\n\n\u201cThe name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.\u201d\n\n\u201cThe file begins with a VMware copyright consistent with publicly available \u00a0 examples and is taken character-for-character from an existing Python file provided by VMware.\u201d\n\nThis script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.\n\nThe reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.\n\nOne of the threat actors\u2019 actions observed by Juniper\u2019s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.\n\nBecause the file used for setting this new configuration, \u201c/etc/vmware/rhttpproxy/endpoints.conf,\u201d is also backed up and restored after reboot, any modifications on it are persistent.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt \u200bMitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the \u201clocal.sh\u201d file.\n\nAll configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]", "creation_timestamp": "2026-09-05T03:00:04.944227Z"}, {"uuid": "dedae973-9259-4bc7-9487-a7e45f1ec686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/hacking_Attack/80218", "content": "Black Hat Ethical Hacking\nNew Python malware backdoors VMware ESXi servers for remote access\n\nNew Python malware backdoors VMware ESXi servers for remote accessPost Views: 78 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.VMware ESXi is a virtualization platform commonly used in the enterprise to host numerous servers on one device while using CPU and memory resources more effectively.\n\nThe new backdoor was discovered by Juniper Networks researchers, who found the backdoor on a VMware ESXi server. However, they could not determine how the server was compromised due to limited log retention.\n\nThey believe the server may have been compromised using the CVE-2019-5544 and CVE-2020-3992 vulnerabilities in ESXi\u2019s OpenSLP service.\n\nWhile the malware is technically capable of targeting Linux and Unix systems, too, Juniper\u2019s analysts found multiple indications it was designed for attacks against ESXi.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Backdoor operationThe new python backdoor adds seven lines inside \u201c/etc/rc.local.d/local.sh,\u201d one of the few ESXi files that survive between reboots and is executed at startup.\n\nUsually, that file is empty, apart from some advisory comments and an exit statement.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/lines.png \n<figcaptionAdditional lines added on ESXi file (Juniper Networks) \nOne of those lines launches a Python script saved as \u201c/store/packages/vmtools.py,\u201d in a directory that stores VM disk images, logs, and more.\n\nThe script\u2019s name and location make Juniper Networks believe that the malware operators intend to target VMware ESXi servers specifically.\n\n\u201cWhile the Python script used in this attack is cross-platform and can be used with little or no modification on Linux or other UNIX-like systems, there are several indications that this attack was designed specifically to target ESXi,\u201d explains Juniper Networks\u2019 report.\n\n\u201cThe name of the file and its location, /store/packages/vmtools.py, was chosen to raise little suspicion on a virtualization host.\u201d\n\n\u201cThe file begins with a VMware copyright consistent with publicly available \u00a0 examples and is taken character-for-character from an existing Python file provided by VMware.\u201d\n\nThis script launches a web server that accepts password-protected POST requests from the remote threat actors. These requests can carry a base-64 encoded command payload or launch a reverse shell on the host.\n\nThe reverse shell makes the compromised server initiate the connection with the threat actor, a technique that often helps bypass firewall restrictions or works around limited network connectivity.\n\nOne of the threat actors\u2019 actions observed by Juniper\u2019s analysts was to change the ESXi reverse HTTP proxy configuration to allow remote access to communicate with the planted webserver.\n\nBecause the file used for setting this new configuration, \u201c/etc/vmware/rhttpproxy/endpoints.conf,\u201d is also backed up and restored after reboot, any modifications on it are persistent.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt \u200bMitigatingTo determine if this backdoor has impacted your ESXi servers, check for the existence of the files mentioned above and the additional lines in the \u201clocal.sh\u201d file.\n\nAll configuration files that persist reboots should be scrutinized for suspicious changes and reversed to the correct [...]", "creation_timestamp": "2026-09-06T00:01:00.497414Z"}, {"uuid": "3f78ecc6-451d-44ee-8a78-c0a072fffec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/cissp/2545", "content": "https://kb.vmware.com/s/article/76372\n\nVMSA-2021-0002 (CVE-2021-21974)\nhttps://www.vmware.com/security/\nadvisories/VMSA-2021-0002.html\n\nVMSA-2020-0023 (CVE-2020-3992)\nhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html\n\nVMSA-2019-0022 (CVE-2019-5544)\nhttps://www.vmware.com/security/advisories/VMSA-2019-0022.html\n\n\nhttps://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "creation_timestamp": "2026-09-11T16:00:06.598563Z"}, {"uuid": "5caa67c4-0c2f-45f4-a024-bfec3e9bc26f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2443", "content": "Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2026-09-11T18:00:05.177853Z"}, {"uuid": "a24f3a7c-e5f5-4b79-9c72-8b8b3f3c37ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2443", "content": "Threat_Research\n1. Emails Disclosure on WordPress\nhttps://www.gosecure.net/blog/2021/03/02/emails-disclosure-on-wordpress\n\n2. Pre-Auth RCE in VMware ESXI (PoC for CVE-2020-3992, CVE-2021-21974)\nhttps://www.zerodayinitiative.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi\n\n3. A Preauth RCE to Root Chain on D-Link DAP-2020 (PoC)\nhttps://suid.ch/research/DAP-2020_Preauth_RCE_Chain.html", "creation_timestamp": "2026-09-12T00:00:33.387747Z"}, {"uuid": "274695a1-6604-4f85-b58c-fd29565ff928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-3992", "type": "seen", "source": "https://t.me/cissp/2545", "content": "https://kb.vmware.com/s/article/76372\n\nVMSA-2021-0002 (CVE-2021-21974)\nhttps://www.vmware.com/security/\nadvisories/VMSA-2021-0002.html\n\nVMSA-2020-0023 (CVE-2020-3992)\nhttps://www.vmware.com/security/advisories/VMSA-2020-0023.html\n\nVMSA-2019-0022 (CVE-2019-5544)\nhttps://www.vmware.com/security/advisories/VMSA-2019-0022.html\n\n\nhttps://www.crowdstrike.com/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/", "creation_timestamp": "2026-09-12T00:00:37.721342Z"}]}