.. /pvesh
Star

Discovery
Account Enumeration
Permission Enumeration
Execution
Collection
Persistence
Privilege Escalation

pvesh is the Proxmox VE API shell tool that provides command-line access to the entire Proxmox API. It can manage VMs, containers, storage, users, permissions, and all cluster resources. Adversaries with administrative access can use pvesh to enumerate the entire infrastructure, modify configurations, and execute privileged operations.

Paths

Resources

Acknowledgements

Discovery

  1. Lists all nodes in the Proxmox cluster with CPU, memory, and disk usage statistics.

    pvesh get /nodes --output-format=json-pretty
    Use Case Enumerate all nodes in the cluster to understand the infrastructure scope and identify targets.
    Privileges Required Administrator
    Operating System Proxmox VE

    Procedural Examples

    ATT&CK Technique T1082

  2. Lists all virtual machines across all cluster nodes with their status, memory, and disk allocation.

    pvesh get /cluster/resources --type vm --output-format=json-pretty
    Use Case Enumerate all VMs in the cluster to identify high-value targets for data theft or ransomware deployment.
    Privileges Required Administrator
    Operating System Proxmox VE

    Procedural Examples

    ATT&CK Technique T1082

  3. List storage content including VM images, backups, and ISO files.

    pvesh get /nodes/{node}/storage/{storage}/content --output-format=json-pretty
    Use Case Discover backup files and VM disk images for potential exfiltration or tampering.
    Privileges Required Administrator
    Operating System Proxmox VE
    ATT&CK Technique T1082

Account Enumeration

  1. Lists all users configured in Proxmox VE with their realm, enabled status, and expiration.

    pvesh get /access/users --output-format=json-pretty
    Use Case Enumerate user accounts to identify potential targets for credential attacks or privilege escalation.
    Privileges Required Administrator
    Operating System Proxmox VE

    Procedural Examples

    ATT&CK Technique T1087.001

Permission Enumeration

  1. Lists all access control list entries showing user/group permissions on resources.

    pvesh get /access/acl --output-format=json-pretty
    Use Case Map out the permission structure to identify overly permissive configurations or escalation paths.
    Privileges Required Administrator
    Operating System Proxmox VE
    ATT&CK Technique T1069.001

Execution

  1. Execute arbitrary commands on a VM through the QEMU guest agent.

    pvesh get /nodes/{node}/qemu/{vmid}/agent/exec --command "whoami"
    Use Case Lateral movement by executing commands on guest VMs without network access.
    Privileges Required Administrator
    Operating System Proxmox VE
    ATT&CK Technique T1059
    Tags
    Lateral MovementGuest Agent Abuse

Collection

  1. Read files from a VM through the QEMU guest agent.

    pvesh get /nodes/{node}/qemu/{vmid}/agent/file-read --file /etc/passwd
    Use Case Exfiltrate sensitive files from guest VMs without network access or authentication.
    Privileges Required Administrator
    Operating System Proxmox VE
    ATT&CK Technique T1005

  2. Create a snapshot of a VM that can be used to restore or analyze later.

    pvesh create /nodes/{node}/qemu/{vmid}/snapshot --snapname backdoor
    Use Case Create snapshots before deploying malware to enable rollback, or snapshot target VMs for offline analysis.
    Privileges Required Administrator
    Operating System Proxmox VE
    ATT&CK Technique T1074.001

Persistence

  1. Create a new local user account in Proxmox VE.

    pvesh create /access/users --userid attacker@pve --password secret123
    Use Case Persistence by creating a backdoor account with administrative access.
    Privileges Required Administrator
    Operating System Proxmox VE
    ATT&CK Technique T1136.001

Privilege Escalation

  1. Grant full administrative privileges to a user on all resources.

    pvesh create /access/acl --path / --roles Administrator --users attacker@pve
    Use Case Privilege escalation by granting admin rights to a controlled account.
    Privileges Required Administrator
    Operating System Proxmox VE
    ATT&CK Technique T1098