The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous shell commands using curl, openssl, and ldapsearch to interact with remote targets.\n- [DATA_EXFILTRATION]: Instructions are included to list and download VMDK files and snapshots from vCenter datastores, which may contain sensitive credentials.\n- [CREDENTIALS_UNSAFE]: The skill documents default passwords for various VMware products, such as 'vmware'.\n- [PERSISTENCE]: The skill describes techniques that result in persistent access, such as dropping SSH authorized_keys or deploying webshells via exploit payloads.\n- [INDIRECT_PROMPT_INJECTION]: The skill fetches content from external, untrusted targets via curl and processes the output, creating a surface for potential injection.\n
Ingestion points: Multiple curl commands target the user-provided $TARGET variable in Steps 1, 3, 4, 6, 7, 8, 9, and 10.\n
Boundary markers: No explicit markers or instructions to treat external output as untrusted data are provided.\n
Capability inventory: The skill utilizes curl, bash, openssl, xmllint, and ldapsearch.\n
Sanitization: No sanitization or validation of the remote server's response is performed before processing.\n- [DYNAMIC_EXECUTION]: Step 4 contains an exploit payload for CVE-2022-22954 that utilizes FreeMarker's Execution utility to run arbitrary OS commands.

vmware-vcenter-attack