Skip to content

Commit 0b0f9cd

Browse files
committed
Land rapid7#19409, Add additional Linux VM fingerprints
Improve a bit modules/post/linux/gather/checkvm.rb
2 parents 84ffa52 + debb010 commit 0b0f9cd

File tree

1 file changed

+38
-1
lines changed

1 file changed

+38
-1
lines changed

modules/post/linux/gather/checkvm.rb

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ def initialize(info = {})
1818
This module attempts to determine whether the system is running
1919
inside of a virtual environment and if so, which one. This
2020
module supports detection of Hyper-V, VMWare, VirtualBox, Xen,
21-
and QEMU/KVM.
21+
Bhyve and QEMU/KVM.
2222
},
2323
'License' => MSF_LICENSE,
2424
'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'],
@@ -154,6 +154,10 @@ def run
154154
product_name = read_file('/sys/class/dmi/id/product_name')
155155
if product_name
156156
case product_name.gsub("\n", ' ')
157+
when /bhyve/i
158+
vm = 'Bhyve'
159+
when /qemu/i
160+
vm = 'Qemu'
157161
when /vmware/i
158162
vm = 'VMware'
159163
when /virtualbox/i
@@ -175,6 +179,8 @@ def run
175179
case bios_vendor.gsub("\n", ' ')
176180
when /^xen/i
177181
vm = 'Xen'
182+
when /innotek GmbH/i
183+
vm = 'VirtualBox'
178184
end
179185
end
180186
end
@@ -199,6 +205,37 @@ def run
199205
end
200206
end
201207
end
208+
if !vm
209+
xen_type = read_file('/sys/hypervisor/type')
210+
if xen_type
211+
if xen_type == 'xen'
212+
vm = 'Xen'
213+
end
214+
end
215+
end
216+
217+
# Check device tree
218+
if !vm
219+
compatible = read_file('/proc/device-tree/compatible')
220+
if compatible
221+
if compatible.include? 'qemu'
222+
vm = 'Qemu/KVM'
223+
end
224+
end
225+
end
226+
if !vm
227+
compatible = read_file('/proc/device-tree/hypervisor/compatible')
228+
if compatible
229+
case compatible
230+
when /linux,kvm/i
231+
vm = 'Qemu/KVM'
232+
when /xen/i
233+
vm = 'Xen'
234+
when /vmware/i
235+
vm = 'VMware'
236+
end
237+
end
238+
end
202239

203240
# Check Processes
204241
if !vm

0 commit comments

Comments
 (0)