Spoofing Task Manager - Win 10 - VMware

Discussion in 'Virtualization' started by ShivatheScamDestroyer, Apr 2, 2020.

  1. ShivatheScamDestroyer

    ShivatheScamDestroyer MDL Novice

    Mar 24, 2020
    3
    0
    0
    #1 ShivatheScamDestroyer, Apr 2, 2020
  2. digimon420

    digimon420 MDL Novice

    May 27, 2017
    6
    3
    0
    #2 digimon420, Apr 2, 2020
    What vmx params are you currently using? Workstation or vSphere, and if vSphere, vCenter?
     
  3. ShivatheScamDestroyer

    ShivatheScamDestroyer MDL Novice

    Mar 24, 2020
    3
    0
    0
    #3 ShivatheScamDestroyer, Apr 4, 2020 (OP)
    Thanks for your reply Digimon. I'm running Workstation and the the .vmx file is as follows:

    .encoding = "windows-1252"
    displayName = "Wilber"
    config.version = "8"
    virtualHW.version = "14"
    mks.enable3d = "TRUE"
    pciBridge0.present = "TRUE"
    pciBridge4.present = "TRUE"
    pciBridge4.virtualDev = "pcieRootPort"
    pciBridge4.functions = "8"
    pciBridge5.present = "TRUE"
    pciBridge5.virtualDev = "pcieRootPort"
    pciBridge5.functions = "8"
    pciBridge6.present = "TRUE"
    pciBridge6.virtualDev = "pcieRootPort"
    pciBridge6.functions = "8"
    pciBridge7.present = "TRUE"
    pciBridge7.virtualDev = "pcieRootPort"
    pciBridge7.functions = "8"
    vmci0.present = "TRUE"
    hpet0.present = "TRUE"
    usb.vbluetooth.startConnected = "TRUE"
    guestOS = "windows7-64"
    nvram = "Wilber.nvram"
    virtualHW.productCompatibility = "hosted"
    powerType.powerOff = "soft"
    powerType.powerOn = "soft"
    powerType.suspend = "soft"
    powerType.reset = "soft"
    tools.syncTime = "FALSE"
    sound.autoDetect = "TRUE"
    sound.virtualDev = "hdaudio"
    sound.fileName = "-1"
    sound.present = "TRUE"
    numvcpus = "2"
    cpuid.coresPerSocket = "2"
    memsize = "4096"
    mem.hotadd = "TRUE"
    scsi0.virtualDev = "lsisas1068"
    scsi0.present = "TRUE"
    sata0.present = "TRUE"
    scsi0:0.fileName = "Wilber-000003.vmdk"
    scsi0:0.present = "TRUE"
    sata0:1.deviceType = "cdrom-raw"
    sata0:1.fileName = "auto detect"
    sata0:1.present = "TRUE"
    usb.present = "TRUE"
    ehci.present = "TRUE"
    svga.graphicsMemoryKB = "1048576"
    ethernet0.connectionType = "nat"
    ethernet0.addressType = "generated"
    ethernet0.virtualDev = "e1000"
    serial0.fileType = "thinprint"
    serial0.fileName = "thinprint"
    floppy0.fileType = "device"
    floppy0.fileName = ""
    ethernet0.present = "TRUE"
    serial0.present = "TRUE"
    extendedConfigFile = "Wilber.vmxf"
    floppy0.clientDevice = "FALSE"
    numa.autosize.cookie = "20001"
    numa.autosize.vcpu.maxPerVirtualNode = "2"
    uuid.bios = "56 4d ae 75 e8 7a eb a1-40 df e1 8b 3a a0 9f a6"
    uuid.location = "56 4d ae 75 e8 7a eb a1-40 df e1 8b 3a a0 9f a6"
    migrate.hostlog = ".\Wilber-bf151e0f.hlog"
    scsi0:0.redo = ""
    pciBridge0.pciSlotNumber = "17"
    pciBridge4.pciSlotNumber = "21"
    pciBridge5.pciSlotNumber = "22"
    pciBridge6.pciSlotNumber = "23"
    pciBridge7.pciSlotNumber = "24"
    scsi0.pciSlotNumber = "160"
    usb.pciSlotNumber = "32"
    ethernet0.pciSlotNumber = "33"
    sound.pciSlotNumber = "34"
    ehci.pciSlotNumber = "35"
    vmci0.pciSlotNumber = "36"
    sata0.pciSlotNumber = "37"
    scsi0.sasWWID = "50 05 05 65 e8 7a eb a0"
    ethernet0.generatedAddress = "00:0c:29:a0:9f:a6"
    ethernet0.generatedAddressOffset = "0"
    vmci0.id = "983605158"
    monitor.phys_bits_used = "43"
    vmotion.checkpointFBSize = "8388608"
    vmotion.checkpointSVGAPrimarySize = "268435456"
    softPowerOff = "FALSE"
    usb:1.speed = "2"
    usb:1.present = "TRUE"
    usb:1.deviceType = "hub"
    usb:1.port = "1"
    usb:1.parent = "-1"
    floppy0.autodetect = "TRUE"
    sata0:1.autodetect = "TRUE"
    tools.remindInstall = "FALSE"
    toolsInstallManager.updateCounter = "3"
    toolsInstallManager.lastInstallError = "0"
    svga.guestBackedPrimaryAware = "TRUE"
    checkpoint.vmState.readOnly = "FALSE"
    checkpoint.vmState = ""
    SMBIOS.reflectHost = "TRUE"
    floppy0.present = "FALSE"
    gui.lastPoweredViewMode = "fullscreen"
    svga.vramSize = "268435456"
    sata0:1.startConnected = "FALSE"
    guestOS.detailed.data = ""
    usb:0.present = "TRUE"
    usb:0.deviceType = "hid"
    usb:0.port = "0"
    usb:0.parent = "-1"
    unity.wasCapable = "TRUE"
    cleanShutdown = "TRUE"
    ​
     
  4. digimon420

    digimon420 MDL Novice

    May 27, 2017
    6
    3
    0
    #4 digimon420, Apr 13, 2020
    Last edited: Apr 13, 2020
    Apologies on the delayed response.
    Using the following should work, as far as your original concern goes, but know there are 1000x ways to tell if you're virtualized.

    {
    hypervisor.cpuid.v0 FALSE
    (workstation keep the syntax though, so [hypervisor.cpuid.v0 = "FALSE"])

    Also, if you want, add:
    monitor_control.restrict_backdoor FALSE
    {

    Use as a placeholder basically so it doesn't get autoremoved. Change to true and it blocks the link that vmware-tools will create for various *stuff*. Only real pitfall is vCenter will whine like it loves to do.

    Side note, I would get off the e1000, and at least use the e1000e which will still show as an Intel adapter.

    sauce: mattson I think his name is. Dev who created the nettulip driver to run ESXi inside Hyper-V. If you search their crappy forums, or visit the nested section, you'll see him popup. They're older posts as he dones't work there anymore, but everything is still valid, and he drops a lot of various hints at vmx params like that backdoor one.