id: vmware-authentication-daemon

info:
  name: VMware Authentication Daemon Detection
  author: pussycat0x
  severity: info
  description: |
    vmauthd is the VMWare authentication daemon that is included with many VMWare products, including ESX(i), and Workstation.
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"VMware Authentication Daemon"
  tags: network,vmware,authenticated,detect,detection,tcp
tcp:

  - inputs:
      - data: "\n"
    host:
      - "{{Hostname}}"
    port: 902

    matchers:
      - type: word
        words:
          - "ServerDaemonProtocol:SOAP"
          - "MKSDisplayProtocol:VNC"
        condition: and

    extractors:
      - type: regex
        regex:
          - "VMware Authentication Daemon Version ([0-9.]+)"
# digest: 4a0a00473045022100ee97edb5176e71434bcfe1af9b52f18412cfcfa8318c25bbf7a631d88fcb7a4002205d21c49e855f50b26cdc39c3152024628a6c22fa3f42c8c3a1fd7b150044609e:922c64590222798bb761d5b6d8e72950