Docker and VM

There are many comparison between Docker and Virtual Machine in term of architecture. 

Here're some summary on operational between Docker and Virtual Machine, based on my own understanding.

	VM	Docker
Compatibility	👍	👌
Virtualization	👍	👌
Security	👍	👌
Size	👌	👍
Performance	👌	👍
Scalability	👌	👍

 

Windows Virtual Machines

Here're the 2 ways to actually get a pre-made Windows Virtual Machine directly from Microsoft. Note that this isn't a permanent solution. 

The first is the Microsoft Edge Developer page under Tools and then VMS. You can choose between Windows 8, 8.1, and 10. For VM platform, we can choose between VirtualBox, Vagrant, VMware, HyperV, and Parallels (Mac).

For Windows 11 VM, we need to head over to the Windows 11 development environment page. Again, we can choose between 4 different virtualization software options. Note the expiration date!

Microsoft recommends to save a "snapshot" of the VM. But this only works for the first method.

Links:

• https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
• https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/
• How to Legally Download a Windows Virtual Machine

Managing VMware Player Like Pro

After I have setup my headless VMware Player, I want to be able to manage my virtual machines like sysadm. 

Next I need to get the command line to manage (start/stop/restart) my VM.

 

Here are part of the batch file script for me to manage my VMware Player.

set vmrun="C:\Program Files (x86)\VMware\VMware Player\vmrun.exe"
set vmjt="c:\users\sysadm\Documents\Virtual Machines\zf\zf.vmx" 

 

To start my VM without GUI (headless mode):

%vmrun% -T player start %vmx% nogui

To reboot my VM without GUI:

%vmrun% -T player reset %vmx% soft

To power off my VM without GUI:

%vmrun% -T player stop %vmx% soft

For Vmware Workstation Pro or Vmware Fusion, you can take snapshot without GUI:

$ vmrun -T ws (or fusion) snapshot /path/to/vm/my.vmx my_snapshot 

Links:

•  https://www.xmodulo.com/how-to-launch-vmware-player-vms-without-gui.html
  

Improper Authentication CVE-2021-21994

Improper authentication vulnerability found at VMware cloud_foundation and ESXi.

 [*] Searching cve-[['2021-21994']] vulnerability definitions within Kenna.VI+....


[ CVE Description ]
 [*] CVE_ID : CVE-2021-21994
 [_] Desc   : SFCB (Small Footprint CIM Broker) as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB authentication by sending a specially crafted request.

 [_] C:2021-01-04 / P:2021-07-13 / L:2021-07-16
 [*] Vuln Risk           : 29.6943
 [*] Exploited [trend]   : 0 [holding]
 [_] Exploit/likehood    : False/0.5843% confidence

 [*] Malware sample : 0
 [*] Exploits/POC   : [0]
 [_] Fixes          : [0]
 [_] Threat Actors  : [0]
 [_] CVSS2 / CVSS3  : [ 6.8 / 9.8 ]

 [_] Vuln Products  : [8]

[ CVE Malware Family Info : None ]

[ High_Profile_Vulnerability ]
 [!!!]   CVE-2021-21994 (29.6943) : []


 ** [5] threads completed [2 tasks] / [2.06 KB] within [2.01 sec].

Update on the VMware vCenter

Remember the 2 critical vulnerabilities for VMware earlier at  https://myseq.blogspot.com/2021/06/two-critical-vulnerabilties-at-vsphere.html

Here's the update:

$ ./kvi-cli.py -v cve 2021-21985 2021-21986 -z


 [*] Searching cve-[['2021-21985', '2021-21986']] vulnerability definitions within Kenna.VI+....


[ CVE Description ]
 [*] CVE_ID : CVE-2021-21985
 [_] Desc   : The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

[ Kenna.VM Summary ]
 [*] Vuln Risk              : 92.7286
 [*] Easily_Exploit         : True
 [*] Malware_Exploit        : False
 [*] Popular_Target         : False
 [*] Active_Internet_Breach : True

[ Kenna.VI+ ]
 [*] Successful_Exploitations  : 1
 [*] Velocity (D/W/M)          : 0/0/1
 [*] Daily_Trend               : holding
 [*] Pre_NVD                   : True [_FALSE_]
 [*] RCE                       : [_TRUE_] False
 [*] Predicted_Exploitable     : 1 (0.3460% confidence)

[ Kenna.VI+ Details ]
 [_] Created_at    : 2021-01-04T23:00:01Z
 [_] Published     : 2021-05-26T15:15:00Z
 [_] Last_Modified : 2021-06-03T14:19:00Z

[ Links / References ]
 [*] Malware sample : 0
 [_] Exploits/POC [1]:
     [ --> ]   created_at : 2021-06-05T15:00:00Z
     [ --> ]  external_id : kenna.CVE-2021-21985
     [ --> ]         name : CVE-2021-21985: Vcenter Server CVE-2021-21985 RCE PAYLOAD
     [ --> ]       source : kenna
     [ --> ]          url : https://www.iswin.org/2021/06/02/Vcenter-Server-CVE-2021-21985-RCE-PAYLOAD/

 [_] Fixes [5]:
     [ --> ]  external_id : 216260
     [ --> ]          url : https://www.vmware.com/security/advisories/VMSA-2021-0010.html
     [ --> ]      product : vcenter
     [ --> ] published_at : 2021-05-26T13:34:51Z

     [ --> ]  external_id : 216261
     [ --> ]          url : https://www.vmware.com/security/advisories/VMSA-2021-0010.html
     [ --> ]      product : vcenter
     [ --> ] published_at : 2021-05-26T13:34:51Z

     [ --> ]  external_id : 216259
     [ --> ]          url : https://www.vmware.com/security/advisories/VMSA-2021-0010.html
     [ --> ]      product : vcenter
     [ --> ] published_at : 2021-05-26T13:34:51Z

     [ --> ]  external_id : vmsa-2021-0010-cve-2021-21985-vcenter
     [ --> ]          url : None
     [ --> ]      product : None
     [ --> ] published_at : 2021-05-25T00:00:00Z

     [ --> ]  external_id : 730102
     [ --> ]          url : https://www.vmware.com/security/advisories/VMSA-2021-0010.html
     [ --> ]      product : vcenter
     [ --> ] published_at : 2021-06-03T23:50:38Z

 [_] Threat Actors [0]:
     [ --> ] None

[ CVSS2 / CVSS3  Details ]

                | Impact   |   |                | CVSS_Access
================+==========+===+================+==============
   Availability | Complete |   |     Complexity | Low
Confidentiality | Complete |   |         Vector | Network
      Integrity | Complete |   | Authentication | None required

              | CVSS_V2 | CVSS_V3
==============+=========+========
   Base Score |  10.000 |   9.800
Exploit_Score |  10.000 |   3.900
 Impact_Score |  10.000 |   5.900
     Temporal |   7.400 |    None

 [*] CVSS v2 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C
 [*] CVSS v3 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C


[ Others ]
 [*] Vulnerable Products [55] :
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:1b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:1c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u2c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u2a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u2:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u1b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1e:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1g:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2g:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3f:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3k:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3n:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3f:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3g:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3j:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3l:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u2:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u2a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3m:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*


[ CVE Malware Family Info : None ]

[ CVE History : CVE-2021-21985 ]
 [*] ID              : 2931038
 [*] Vuln Risk Score : 93
 [*] History         : 2

   [**] changed_at : 2021-05-26T04:13:12.000Z
   [**]       from : 25
   [**]         to : 37

   [**] changed_at : 2021-06-06T04:04:24.000Z
   [**]       from : 37
   [**]         to : 93


[ CVE Description ]
 [*] CVE_ID : CVE-2021-21986
 [_] Desc   : The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted plug-ins without authentication.

[ Kenna.VM Summary ]
 [*] Vuln Risk              : 37.0796
 [*] Easily_Exploit         : False
 [*] Malware_Exploit        : False
 [*] Popular_Target         : False
 [*] Active_Internet_Breach : False

[ Kenna.VI+ ]
 [*] Successful_Exploitations  : 0
 [*] Velocity (D/W/M)          : 0/0/0
 [*] Daily_Trend               : holding
 [*] Pre_NVD                   : True [_FALSE_]
 [*] RCE                       : True [_FALSE_]
 [*] Predicted_Exploitable     : 0 (0.1303% confidence)

[ Kenna.VI+ Details ]
 [_] Created_at    : 2021-01-04T23:00:01Z
 [_] Published     : 2021-05-26T15:15:00Z
 [_] Last_Modified : 2021-06-03T14:19:00Z

[ Links / References ]
 [*] Malware sample : 0
 [_] Exploits/POC [0]:
     [ --> ] None
 [_] Fixes [4]:
     [ --> ]  external_id : 216260
     [ --> ]          url : https://www.vmware.com/security/advisories/VMSA-2021-0010.html
     [ --> ]      product : vcenter
     [ --> ] published_at : 2021-05-26T13:34:51Z

     [ --> ]  external_id : 216261
     [ --> ]          url : https://www.vmware.com/security/advisories/VMSA-2021-0010.html
     [ --> ]      product : vcenter
     [ --> ] published_at : 2021-05-26T13:34:51Z

     [ --> ]  external_id : 216259
     [ --> ]          url : https://www.vmware.com/security/advisories/VMSA-2021-0010.html
     [ --> ]      product : vcenter
     [ --> ] published_at : 2021-05-26T13:34:51Z

     [ --> ]  external_id : vmsa-2021-0010-cve-2021-21986-vcenter
     [ --> ]          url : None
     [ --> ]      product : None
     [ --> ] published_at : 2021-05-25T00:00:00Z

 [_] Threat Actors [0]:
     [ --> ] None

[ CVSS2 / CVSS3  Details ]

                | Impact   |   |                | CVSS_Access
================+==========+===+================+==============
   Availability | Complete |   |     Complexity | Low
Confidentiality | Complete |   |         Vector | Network
      Integrity | Complete |   | Authentication | None required

              | CVSS_V2 | CVSS_V3
==============+=========+========
   Base Score |  10.000 |   9.800
Exploit_Score |  10.000 |   3.900
 Impact_Score |  10.000 |   5.900
     Temporal |   7.400 |    None

 [*] CVSS v2 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C
 [*] CVSS v3 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C


[ Others ]
 [*] Vulnerable Products [55] :
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:1b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:1c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u2c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u2a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u2:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u1b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1e:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u1g:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u2g:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3f:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3k:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.5:u3n:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3b:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3f:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3g:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3j:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1c:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u1d:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3l:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u2:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:7.0:u2a:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:vcenter_server:6.7:u3m:*:*:*:*:*:*
     [ --> ] cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*


[ CVE Malware Family Info : None ]

[ CVE History : CVE-2021-21986 ]
 [*] ID              : 2931039
 [*] Vuln Risk Score : 37
 [*] History         : 3

   [**] changed_at : 2021-05-26T04:13:12.000Z
   [**]       from : 25
   [**]         to : 30

   [**] changed_at : 2021-05-27T04:16:24.000Z
   [**]       from : 30
   [**]         to : 44

   [**] changed_at : 2021-06-04T04:19:46.000Z
   [**]       from : 44
   [**]         to : 37

[ High_Profile_Vulnerability ]
 [!!!]   CVE-2021-21985 (92.7286) : ['hpv_exploited', 'hpv_poc']
 [!!!]   CVE-2021-21986 (37.0796) : []


 ** [5] threads completed [6 tasks] / [11.54 KB] within [4.85 sec].

4 alerts on Pivotal Software, Vmware

References changed for 4 CVE found at Pivotal software and VMware today. All of them are released by Oracle.

• https://www.oracle.com/security-alerts/cpuApr2021.html

 [*] Searching cve-[['2021-22112', '2020-5413', '2019-3773', '2020-5407']] vulnerability definitions within Kenna.VI+....


[ CVE Description ]
 [*] CVE_ID : CVE-2021-22112
 [_] Desc   : Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.

 [_] C:2021-01-04 / P:2021-02-23 / L:2021-06-14
 [*] Vuln Risk           : 31.4038
 [*] Exploited [trend]   : 0 [holding]
 [_] Exploit/likehood    : False/0.0030% confidence

 [*] Malware sample : 0
 [*] Exploits/POC   : [0]
 [_] Fixes          : [1]
 [_] Threat Actors  : [0]
 [_] CVSS2 / CVSS3  : [ 9.0 / 8.8 ]

 [_] Vuln Products  : [2]

[ CVE Malware Family Info : None ]


[ CVE Description ]
 [*] CVE_ID : CVE-2020-5413
 [_] Desc   : Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.

 [_] C:2020-01-03 / P:2020-07-31 / L:2021-06-14
 [*] Vuln Risk           : 33.0384
 [*] Exploited [trend]   : 0 [holding]
 [_] Exploit/likehood    : False/0.0297% confidence

 [*] Malware sample : 0
 [*] Exploits/POC   : [0]
 [_] Fixes          : [0]
 [_] Threat Actors  : [0]
 [_] CVSS2 / CVSS3  : [ 7.5 / 9.8 ]

 [_] Vuln Products  : [2]

[ CVE Malware Family Info : None ]


[ CVE Description ]
 [*] CVE_ID : CVE-2019-3773
 [_] Desc   : Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

 [_] C:2019-01-21 / P:2019-01-18 / L:2021-06-14
 [*] Vuln Risk           : 32.5156
 [*] Exploited [trend]   : 0 [holding]
 [_] Exploit/likehood    : False/0.0463% confidence

 [*] Malware sample : 0
 [*] Exploits/POC   : [0]
 [_] Fixes          : [0]
 [_] Threat Actors  : [0]
 [_] CVSS2 / CVSS3  : [ 7.5 / 9.8 ]

 [_] Vuln Products  : [2]

[ CVE Malware Family Info : None ]


[ CVE Description ]
 [*] CVE_ID : CVE-2020-5407
 [_] Desc   : Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.

 [_] C:2020-01-03 / P:2020-05-13 / L:2021-06-14
 [*] Vuln Risk           : 27.5046
 [*] Exploited [trend]   : 0 [holding]
 [_] Exploit/likehood    : False/0.0117% confidence

 [*] Malware sample : 0
 [*] Exploits/POC   : [0]
 [_] Fixes          : [0]
 [_] Threat Actors  : [0]
 [_] CVSS2 / CVSS3  : [ 6.5 / 8.8 ]

 [_] Vuln Products  : [1]

[ CVE Malware Family Info : None ]

[ High_Profile_Vulnerability ]
 [!!!]   CVE-2021-22112 (31.4038) : []
 [!!!]    CVE-2020-5413 (33.0384) : []
 [!!!]    CVE-2019-3773 (32.5156) : []
 [!!!]    CVE-2020-5407 (27.5046) : []


 ** [5] threads completed [8 tasks] / [8.59 KB] within [10.65 sec].

Headless Vmware Workstation Player

To run your VMware Workstation Player (16) in headless mode, here is the configurations.

First,  shutdown all the VMware Virtual Machines, then edit the VMware preference file below:

• (Linux) $HOME/.vmware/preferences
• (Windows) %HOMEPATH%\AppData\Roaming\VMWare\preferences.ini
  

Next, append the following lines at the bottom of the files.

pref.vmplayer.exit.vmAction = "disconnect"  
pref.vmplayer.confirmOnExit = "FALSE"

 

My Notes on VMware Products

Short/quick notes about VMware products : ESX, ESXi, vCenter, vSphere/client.

ESX/ESXi

• Both are hypervisor that allowsus to manage VM on physcal host.
• ESXi operates independently from general purpose OS. Thus simplifies management (Linux-based consoles), better security, and smaller footprint (32MB).
• ESX must be installed on top a general purpose OS (Windows or Linux).
  
• A virtual representation of the processing and memory resources of a physical machine runnign ESXi is kwnon as a host.
• Two or more ESXi can be grouped into a cluster for resource pools management.
  

VMware vCenter Server

• Can be installed as virtural machine on top of ESXi server.
  
• Allows for centralized management of all virtual infrastructure : hosts and VMs.
• Allows to optimize routine operations on large-scale infrastructure.
• Running on Photon OS, Windows OS (discontinued) or Linux-based appliance.
  
• Allow single sign-on, inventory (VMs, hosts, datastores, networks) search, notification, and host profile configurations.
• Scalability: run up to 2000 hosts and 35000 VMs.
• Enterprise features : vMotion, VMware High Availability, Vmware Update Manager, Vmware Distrubuted Resource Scheduler (DSR).
• RBAC, performance monitoring and
  

 vSphere and vSphere client/HTML5

• vSphere is a suite that contains ESX, ESXi, vCenter, vSphere client, and used as a modern software-defined data center (SDDC).
  
• vSphere client/HTML5 - used to access ESXi (small env) and vCenter (large env) for management.
• vSphere client is replaced by HTML5-based vSphere in vSphere 6.7
  

 Links:

• https://www.mustbegeek.com/difference-between-vsphere-esxi-and-vcenter/
• https://www.nakivo.com/blog/vmware-esxi-vs-vsphere-vs-vcenter-key-differences/
  

Installation/Uninstallation of VMware Player Hangs

If you are like me, where the installation or uninstallation of VMware Player keeps hang/fail, then you are lucky here.

I used to install VMware Player and then I upgrade to VMware Workstation 7.1 (trial). After the trial expire, and I'm planning to uninstall VMware Workstation and keeps only VMware Player (which is free).

I tried multiple times, the uninstallation process keeps hang (forever). Then I try to download the latest copy of VMware Player, and wish I could install to override it. It doesn't work.


Then I tried to be a "good-boy" and follow the installation instruction (manual way) provided by VMware at the following URL:

• http://faq.sanbarrow.com/index.php?solution_id=1113

Same thing happens. I even tried install the new copy using command line as below:

VMware-player-4.0.0-471780.exe /z "action"="install"

Still fails. :-(

Then I also tried extract the installation EXE to a temporary folder:

VMware-player-4.0.0-471780.exe /e tempdir

And then double click the MSI to install it. End up the same shit happens.


Finally, when I about to give up on VMware, I found 1 last thing to do before switching to VirtualBox.

1. start regedit.exe
2. Browse to the following sub-key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
3. You should see keys named 0, 1, 2, 3 and 4. In my case I had a folder named "L" before the 0.
4. Remove the key with "L" (actually it is  "└", unicode #2514)

It works like a charm now.

P/s: This is due to Microsoft screws up the registry Internet Zone settings in the registry. With the "└" key, it cause Javascript not to be called from an application.