Added vCenter version detection template

technologies/vcenter-version-detect.yaml

@@ -0,0 +1,103 @@
+id: vcenter-version-detect
+
+info:
+  name: vcenter-version-detect
+  author: elouhi
+  severity: info
+  description: Sends a POST request containing a SOAP payload to a vCenter server to obtain version information
+  reference:
+    - https://www.pwndefend.com/2021/09/23/exposed-vmware-vcenter-servers-around-the-world-cve-2021-22005/
+  tags: tech,vcenter,vmware
+requests:
+  - raw:
+      - |
+        POST /sdk/ HTTP/1.1
+        Host: {{Hostname}}
+        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
+        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+
+        <?xml version="1.0" encoding="UTF-8"?>
+        <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+           <soap:Header>
+              <operationID>00000001-00000001</operationID>
+           </soap:Header>
+           <soap:Body>
+              <RetrieveServiceContent xmlns="urn:internalvim25">
+                 <_this xsi:type="ManagedObjectReference" type="ServiceInstance">ServiceInstance</_this>
+              </RetrieveServiceContent>
+           </soap:Body>
+        </soap:Envelope>
+
+    matchers:
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: name
+        part: body
+        group: 1
+        regex:
+          - "<name>(.*?)</name>"
+
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - "<version>(.*?)</version>"
+
+      - type: regex
+        name: build
+        part: body
+        group: 1
+        regex:
+          - "<build>(.*?)</build>"
+
+      - type: regex
+        name: localeVersion
+        part: body
+        group: 1
+        regex:
+          - "<localeVersion>(.*?)</localeVersion>"
+
+
+      - type: regex
+        name: localeBuild
+        part: body
+        group: 1
+        regex:
+          - "<localeBuild>(.*?)</localeBuild>"
+
+
+      - type: regex
+        name: osType
+        part: body
+        group: 1
+        regex:
+          - "<osType>(.*?)</osType>"
+
+      - type: regex
+        name: productLineId
+        part: body
+        group: 1
+        regex:
+          - "<productLineId>(.*?)</productLineId>"
+
+      - type: regex
+        name: apiType
+        part: body
+        group: 1
+        regex:
+          - "<apiType>(.*?)</apiType>"
+
+      - type: regex
+        name: apiVersion
+        part: body
+        group: 1
+        regex:
+          - "<apiVersion>(.*?)</apiVersion>"