Slp_tool to manage SLP protocol in ESXi server (2023)
SLP (Service location protocol) is a network protocol that enables network clients to discover network services in a LAN network . It is designed to provide the simple and flexible way for locate the network services need
In alternative method , Clients can still access services using alternative methods like :
• Using DNS to locate IP of servers who offer services
• Using configuration files to locate services
This method is more complex and less efficient So the SLP can offer the solution for service discovery
The SLP communication contain :
• Service agents: Devices on the network that provide services
• Directory agents: Devices on the network that act as directory agents maintain a list of registered services
• Service requests: Clients that need to locate a service send a query to the SLP directory agent
• Service response: The directory agent responds to the client with a list of available services
• Service usage: Client can use the service by contacting the service agent directly
On February 2023 , attackers were actively targeting VMware ESXi servers unpatched against a two-year-old remote code execution vulnerability to deploy a new ESXiArgs ransomware.
EsxiArgs is a ransomware attack that targets ESXI servers . It's access to the servers and encrypts the VM hosted on them . Then the attackers demand a ransom payment to decrypt data .
The security flaw is caused by a issues in OpenSLP To block incoming attacks, admins have to disable and manage the vulnerable Service Location Protocol (SLP) service on ESXi
In light of all this, I developed a PowerShell script to manage the SLP protocol in ESXi servers called SLP .
With this script, you can easily:
• Install the VMware model
• Check if SLP is activated on your ESXi server
• Stop and start SLP on your ESXi server
• Display a window with helpful information about SLP protocol and ESXi attacks using SLP protocol
This script is a powerful tool for any VMware administrator looking to manage their ESXi server more effectively. With just a few simple commands, you can ensure that SLP is activated on your server and protect against potential security threats.
If you're interested in learning more about SLP Tool and how it can benefit your VMware environment, feel free to reach out to me or check out the GitHub repository for more information.
▬▬▬▬▬ CONTACT ▬▬▬▬▬
Facebook : /HamzaAchaboune
Linkedin : /achahboune-hamza
Twitter : /HamzaAchahboun3
github : /HamzaAchahboune