{"uuid": "2628ea85-2750-451e-94bd-f89eff9194d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22948", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/linux/gather/vcenter_secrets_dump.rb", "content": "{\"actions\": [{\"description\": \"Dump vCenter Secrets\", \"name\": \"Dump\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"npm \", \"Erik Wynter\", \"h00die\"], \"autofilter_ports\": null, \"autofilter_services\": null, \"check\": false, \"default_credential\": false, \"description\": \"Grab secrets and keys from the vCenter server and add them to\\n          loot. This module is tested against the vCenter appliance only;\\n          it will not work on Windows vCenter instances. It is intended to\\n          be run after successfully acquiring root access on a vCenter\\n          appliance and is useful for penetrating further into the\\n          environment following a vCenter exploit that results in a root\\n          shell.\\n\\n          Secrets include the dcAccountDN and dcAccountPassword for\\n          the vCenter machine which can be used for maniuplating the SSO\\n          domain via standard LDAP interface; good for plugging into the\\n          vmware_vcenter_vmdir_ldap module or for adding new SSO admin\\n          users. The MACHINE_SSL, VMCA_ROOT and SSO IdP certificates with\\n          associated private keys are also plundered and can be used to\\n          sign forged SAML assertions for the /ui admin interface.\", \"disclosure_date\": \"2022-04-15\", \"fullname\": \"post/linux/gather/vcenter_secrets_dump\", \"is_install_path\": true, \"mod_time\": \"2025-09-08 17:30:59 +0000\", \"name\": \"VMware vCenter Secrets Dump\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/post/linux/gather/vcenter_secrets_dump.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"linux/gather/vcenter_secrets_dump\", \"references\": [\"URL-https://github.com/shmilylty/vhost_password_decrypt\", \"CVE-2022-22948\", \"URL-https://pentera.io/blog/information-disclosure-in-vmware-vcenter/\", \"URL-https://github.com/ErikWynter/metasploit-framework/blob/vcenter_gather_postgresql/modules/post/multi/gather/vmware_vcenter_gather_postgresql.rb\", \"ATT&CK-T1003\"], \"rport\": null, \"session_types\": [\"meterpreter\", \"shell\"], \"targets\": null, \"type\": \"post\"}", "creation_timestamp": "2026-09-08T06:52:41.267482Z"}