{"id":114,"date":"2016-08-12T16:32:35","date_gmt":"2016-08-12T14:32:35","guid":{"rendered":"https:\/\/aves-it.nl\/?p=114"},"modified":"2016-08-12T22:04:57","modified_gmt":"2016-08-12T20:04:57","slug":"are-you-vulnerable-to-flip-feng-shui-powercli-tells-you","status":"publish","type":"post","link":"https:\/\/aves-it.nl\/en\/2016\/08\/12\/are-you-vulnerable-to-flip-feng-shui-powercli-tells-you\/","title":{"rendered":"Are you vulnerable to Flip Feng Shui? PowerCLI tells you!"},"content":{"rendered":"<p>Trying to find out if you are vulnerable to <a href=\"https:\/\/www.vusec.net\/projects\/flip-feng-shui\/\">Flip Feng Shui<\/a> on your VMware platform?<\/p>\n<p>PowerCLI can tell you with a few commands.<\/p>\n<p>As VMware tells us in<a href=\"https:\/\/kb.vmware.com\/selfservice\/microsites\/search.do?language=en_US&amp;cmd=displayKC&amp;externalId=2097593\"> https:\/\/kb.vmware.com\/selfservice\/microsites\/search.do?language=en_US&amp;cmd=displayKC&amp;externalId=2097593<\/a> that TPS is enabled under certain circumstances only in recent releases.<\/p>\n<p>Specifically: If Mem.ShareForceSalting is 0, or if it is set to 1 and sched.mem.pshare.salt is not set, or if Mem.ShareForceSalting is set to 2, and sched.mem.pshare.salt or vc.uuid are not unique.<\/p>\n<p>So how do we check this?<\/p>\n<p>First: Mem.ShareForceSalting.<\/p>\n<pre>Get-VMHost|Get-AdvancedSetting -Name Mem.ShareForceSalting|ft Entity,Name,Value -AutoSize<\/pre>\n<p>Second: sched.mem.pshare.salt.<\/p>\n<pre>Get-VM|Get-AdvancedSetting -Name sched.mem.pshare.salt<\/pre>\n<p>And lastly: vc.uuid.<\/p>\n<pre>Get-VM|Get-AdvancedSetting -Name vc.uuid<\/pre>\n<p>So, you are vulnerable to Flip Feng Shui if:<\/p>\n<ol>\n<li>Mem.ShareForceSalting is set to 0<\/li>\n<li>Mem.ShareForceSalting is set to 1 and sched.mem.pshare.salt is not set on every VM<\/li>\n<li>Mem.ShareForceSalting is set to 2, and sched.mem.pshare.salt is not absent or unique for every VM<\/li>\n<li>Mem.ShareForceSalting is set to 2 and vc.uuid is not absent or unique for every VM<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Good luck finding out!<\/p>","protected":false},"excerpt":{"rendered":"<p>Trying to find out if you are vulnerable to Flip Feng Shui on your VMware platform? PowerCLI can tell you with a few commands. As VMware tells us in https:\/\/kb.vmware.com\/selfservice\/microsites\/search.do?language=en_US&amp;cmd=displayKC&amp;externalId=2097593 that TPS is enabled under certain circumstances only in recent<span class=\"ellipsis\">&hellip;<\/span><\/p>\n<div class=\"read-more\"><a href=\"https:\/\/aves-it.nl\/en\/2016\/08\/12\/are-you-vulnerable-to-flip-feng-shui-powercli-tells-you\/\">Read more &#8250;<\/a><\/div>\n<p><!-- end of .read-more --><\/p>","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[26],"tags":[28,29,27],"_links":{"self":[{"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/posts\/114"}],"collection":[{"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/comments?post=114"}],"version-history":[{"count":3,"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/posts\/114\/revisions"}],"predecessor-version":[{"id":118,"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/posts\/114\/revisions\/118"}],"wp:attachment":[{"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/media?parent=114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/categories?post=114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aves-it.nl\/en\/wp-json\/wp\/v2\/tags?post=114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}