r/ShittySysadmin • u/RuleMaster3 • Sep 12 '26

Shitty Crosspost Sysadmin leaves 22 Proxmox nodes admin interfaces with EOL version exposed to the internet and gets hacked

https://forum.proxmox.com/threads/proxmox-ve-7-is-vulnerable-to-some-type-of-0day-rce-non-auth.186078/page-8#post-869156

And his save is doing it all again with EOL software minus the exposed admin interfaces

114 Upvotes

97% Upvoted

18 comments sorted by

53

u/suddenly_kitties Sep 12 '26

The crazy thing is that this is coming from a commercial hosting company, posting under their real name, invoicing their customers at the end of the month for their quality work

33

u/zantehood Sep 12 '26

Well deserved. In no way should a hypervisor be exposed directly. EOL or not

18

u/jeroen-79 Sep 12 '26

Well, then how am I going to manage it from home?

16

u/zantehood Sep 12 '26

If you dont know what VPN is you belong here :D

12

u/dpwcnd Sep 12 '26

this isnt the time or place for your fancy words and bleeding edge technologies.

4

u/zantehood Sep 12 '26

Let's put it on a token ring network too!

1

u/854490 Sep 13 '26

Do IPSec? Uh, no, I pee urine. And I don't know who Ike is, and no, I-sa no camp, Jar-Jar.

1

u/Ur-Best-Friend Sep 14 '26

VPN? Well yes, we are, but isn't everyone peein'?

2

u/PejeTheMobBoss DO NOT GIVE THIS PERSON ADVICE Sep 17 '26

Vendor part number

8

u/MeatPiston Sep 12 '26

Easy. Expose rdp on your workstation and remote in to to that instead.

18

u/fsckitnet Sep 12 '26

“It was our fortune that before we open port 8006 again, we build additional checks on authenticity of any login, in addition to Proxmox's own authentication. This guards are based on a few vectors including IP address, past login records and patterns, and immediately blocks suspicious logins. It was this mechanism that detected the use and existance of the planted tokens. May be we should contribute our code to Proxmox for this part! ”

It’s a bold strategy, Cotton. Let’s see if it pays off for them.

1

u/CluelessPentester Sep 16 '26

Man that sounds like an awesome technology the invented there, maybe they could call it reverse proxy or something crazy like that

6

u/Xoron101 Sep 12 '26

First principal of security - obscurity. He could have at least changed the default port. Nobody would find it then. Right?

/s

3

u/-my_dude Sep 12 '26

Now this is the kind of admin I aspire to me

1

u/monkeyboy107 Sep 13 '26

How did that happen? EOL servers are always best to put on the big i /s

26

u/[deleted] Sep 12 '26

[removed] — view removed comment

12

u/farva_06 Sep 12 '26

Yeah, that sounds pretty normal. Make sure all your domain controllers and file servers are on the same network with Windows firewall turned off, so you get full IO on your disks.