# ESXi Exploitation in the Wild

Attacker toolkit chained HGFS info leak, VMCI OOB write, and ESXi arbitrary write to escape a guest VM and backdoor the hypervisor via VSOCK.

- Payout: Real-world hack
- Severity: critical
- Program: VMware ESXi
- Credited: Huntress
- Disclosed: 2026-01-07
- CVE: CVE-2025-22226, CVE-2025-22224, CVE-2025-22225
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/esxi-vm-escape-exploit
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-esxi-vm-escape-exploit
- Tags: domain:infra impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:linux tech:windows technique:chained technique:reverse-engineering vuln:memory-corruption vuln:privilege-escalation vuln:sandbox-escape

**Target:** VMware ESXi hypervisor (VMX process, VMCI/HGFS devices)
**Root cause:** HGFS out-of-bounds read leaks VMX memory (CVE-2025-22226); a TOCTOU in VMCI causes an out-of-bounds write enabling VMX code execution (CVE-2025-22224); an arbitrary write in ESXi escapes the VMX sandbox to the kernel (CVE-2025-22225).
**Steps:**
1. Disable VMCI drivers: `devcon.exe disable "PCI\VEN_15AD&DEV_0740"` and `devcon.exe disable "ROOT\VMWVMCIHOSTDEV"` to gain exclusive I/O port access
2. Load unsigned driver via BYOD: `kdu.exe -prv 1 -map MyDriver.sys` bypassing DSE
3. Query host version via VMware Guest SDK `guestlib.stat.get text session`, look up build in 155-entry offset table
4. Enable HGFS drag-and-drop via backdoor RPC `tools.capability.hgfs_server toolbox-dnd 1`, send crafted ~50KB payload `4F 4B 20 00 ... A5 C5 00 00 A4 C5 00 00 ...` to trigger OOB read leaking VMX pointer
5. Validate leaked pointer bits 8-11 against offset table, compute `vmxBase = leakedPtr - 0x01590300`
6. Write stage1/stage2 shellcode and ELF backdoor into VMX memory via 95-byte header on backdoor channels (cmd type 2 write, type 3 read)
7. Overwrite VMX function pointer with shellcode address, send VMCI message to trigger execution
8. Shellcode 2 writes /var/run/a, appends `ftp stream tcp nowait root /var/run/a a ++group=host/vim/vimuser/terminal/ssh` to /var/run/inetd.conf, SIGHUP inetd, connects 127.0.0.1:21, then restores inetd.conf
9. Connect from guest VM via `client.exe 2:10000` over VSOCK to VSOCKpuppet backdoor
**How found:** Huntress incident response analyzed dropped binaries: MAESTRO orchestrator, MyDriver.sys, VSOCKpuppet, and client.exe. Behavior (HGFS leak, VMCI corruption, kernel shellcode) matched VMSA-2025-0004 CVEs. PDB paths revealed Chinese-language dev folder '全版本逃逸--交付' dated 2024-02-19, predating disclosure by over a year, indicating a zero-day.
**Exploitation:** Initial access via compromised SonicWall VPN, lateral movement with stolen Domain Admin account via RDP to backup then primary DC. Toolkit deployed on DC; disables VMCI drivers, loads unsigned kernel driver via KDU, uses HGFS leak + VMCI corruption + arbitrary write to escape VMX sandbox, drops VSOCKpuppet backdoor listening on VSOCK port 10000, and connects from a guest Windows VM using client.exe (GetShell Plugin) for interactive root shell on the hypervisor. Firewall rules blocked external egress while preserving internal connectivity; data staged with WinRAR for exfiltration.
**Escalation:** Chained three CVEs (info leak -> memory corruption -> sandbox escape) to go from guest VM to full hypervisor kernel control, then used VSOCK to evade network monitoring and inetd hijack for root execution.
**Insight:** VSOCK/VMCI channels between guest and hypervisor bypass firewalls and IDS entirely; hunt for hypervisor backdoors by checking `lsof -a` for SOCKET_VMCI entries on ESXi hosts and dumping process memory since filenames are hidden. Also, offset-table exploits reveal target build via Guest SDK version queries—monitor for anomalous `guestlib.stat` calls.