VMware™ hypervisor fingerprinting

Disclaimer
I.INTRODUCTION
II. Virtual HARDWARE CLUES
	Determining if the Guest OS is running over a VMware hypervisor
	Determining Hypervisor Product & Version
		BIOS Release Date/Address/Size
		Guest SDK ( for vSphere >= 6.0 )
		vmware-checkvm
		Backdoor command (0Ah - Get VMware version)
		dmidecode
	Virtual Devices list (Guest API)
	Other Stats and Properties
		Physical CPU Speed
		Ballooning information
		Raw information
	Kernel Modules (vsock, vmw_vsock_vmci, vmwgfx, vmw_vmci)
	PCI information
	CPU INFO
	Advanced low-level tools: VMW
	Advanced low-level tools:  VM_BACKDUMP
	Other tools: VSOCKETS_NC
	Disabling some clues
III. Networking Clues
	ESXi MAC addresses
	NMAP Service Scans
		NMAP scan for a host running Windows 7 with VMware Player
		NMAP scan for a system with a VMware MAC address
		NMAP scan for a Kali Linux Guest OS (running over VMware Player)
		NMAP scan for a Nested ESXi Host (running over VMware Player)
		NMAP scan for a VMware Network Device (running over VMware Player)
		NMAP scan for a Kali Linux Guest OS (running over VMware ESXi 6.0)
		NMAP scan for a VMware ESXi Host (checking for “VMware Authentication Daemon”)
		NMAP scan for a VMware ESXi Host (checking for “VMware ESXi Server httpd”)
		NMAP scan for a VMware “dnsmasq 2.51” Network Device (running over VMware Player)
		NMAP scan VMware workstation/PLAYER @ MICROSOFT WINDOWS
	ESXi Web Servers Scans
		ESXi Web Server SHA1 fingerprint [36]
		ESXi Web Server Certificate Details [36]
		ESXi Web Services (VIM API)
	VMware Workstation/Player services
		vmauthd ( VMware Authentication Daemon, VMware Player or ESXi Server)
IV. Nested virtualization
V. Guest-side reporting about Hypervisor
	Report example - Kali Linux Guest (over ESXi 6.0 hypervisor)
VI. Future Work
References
Annex  A – More report examples
	Report example - Kali Linux Guest (over VMware Player 7 hypervisor)
	Report example – ESXi 6.0 Guest Hypervisor (Nested over VMware Player 7 hypervisor)
About the author