PowerCLI : Scripting the Workaround for OpenSLP vulnerability

With the recent vulnerability raised by VMware for vCenter and ESXi hosts , it is considered critical for the VMware environment.

However, addressing such situation with short timeline is so difficult and huge manual effort is required.

PowerCLI is powerful enough to handle such situations. This script below will be able to connect to the vCenter , gather all ESXi hosts inside and further connect to them over CLI for implementation.

Credit : LUC Dekens

#Script to Workaround the ESXi OpenSLP Vulnerability - KB76372.

#Powershell v3.0 and above required.

 
$vCenterServer = <vCenter Server Name here>

Connect-VIServer $vCenterServer

$esxhostlist = Get-VMHost

Foreach ($esx in $esxhostlist)

{

      Write-host "Enabling SSH in $esx"

      Get-VMHost $esx | Get-VMHostService |  where{$_.Key -eq 'TSM-SSH'} | Start-VMHostService - 
      Confirm:$false | Out-Null

      Write-host "Executing SLP Vulnerability Fix in $esx "

      Write-host "---------------------------------------------------------------------------"

      $cmdsub = @'

      /etc/init.d/slpd stop;

      /etc/init.d/slpd status;

      esxcli network firewall ruleset set -r CIMSLP -e 0;

      chkconfig slpd off;

      chkconfig --list | grep slpd;

      '@

      $secPswd = ConvertTo-SecureString '<ROOT PASSSWORD HERE>' -AsPlainText -Force

      $cred = New-Object System.Management.Automation.PSCredential ('root', $secPswd)

      $session = New-SSHSession -ComputerName $esx.Name -Credential $cred –AcceptKey

      Invoke-SSHCommand -SSHSession $session -Command $cmdSub | Select -ExpandProperty Output

      Remove-SSHSession -SSHSession $session | Out-Null

      Write-host "---------------------------------------------------------------------------"

      Get-VMHost $esx | Get-VMHostService | where{$_.Key -eq 'TSM-SSH'} | Stop-VMHostService - 
      Confirm:$false | Out-Null

 }

Disconnect-VIServer $vCenterServer -Confirm:$false