Open-source virtualization platform Proxmox VE has become a favorite among IT teams for its flexibility, simplicity, and robust performance.
However, a new offensive research project, LOLPROX, highlights how the same built-in management tools can be weaponized for stealthy hypervisor-level attacks that often evade detection.
The Rise of Living-Off-The-Land Hypervisor Abuse
Security researcher Andy Gill (ZephrSec) detailed in his recent publication that Proxmox, built on Debian Linux, blends traditional Linux privilege escalation techniques with virtualization-specific commands.
This combination, according to Gill, creates a unique attack surface in which gaining control of the hypervisor could compromise every virtual machine (VM) it manages.
LOLPROX (“Living Off The Land Proxmox”) catalogs native Proxmox binaries and management commands that adversaries could use post-compromise, much like how the LOLBAS and LOLESXi projects document legitimate admin tools that can serve malicious ends.
Because these utilities are enabled by default, offensive actions executed through them often blend seamlessly with regular administrative activity.
The Proxmox architecture includes components such as pve-cluster, pve-qemu-kvm, pve-container, and pmxcfs, which synchronize configuration and manage VM lifecycles.
These components, especially the /etc/pve cluster filesystem, which is replicated across nodes, can be abused to propagate configuration changes or create persistence across hosts with minimal visibility.
vsock, Guest Agents, and Silent Control
Two mechanisms stand out as primary stealth enablers vsock (AF_VSOCK) and the QEMU Guest Agent.
The vsock protocol provides a direct communication channel between host and guest systems that entirely bypasses network stacks and firewalls.
Unlike SSH or RDP, vsock-based interactions do not generate network logs, making them invisible to traditional monitoring tools such as Zeek, Suricata, or NetFlow analytics.
The QEMU Guest Agent, designed for legitimate system management, poses an even greater risk when misused.
Suppose a VM has the feature enabled (agent: 1), commands can be executed directly on the guest OS from the host without user interaction or network activity.
Attackers can retrieve files, execute commands, or implant persistence while leaving minimal traces activity that defenders rarely monitor.
Additionally, Proxmox features such as snapshots, backups, and logical volume access can facilitate offline data extraction, memory acquisition, or ransomware operations at scale.
Techniques using eBPF tracing or QEMU block filters further enable attackers to intercept or manipulate data I/O without leaving clear forensic footprints.
Ultimately, LOLPROX illustrates that a compromised Proxmox host equals complete control over its virtual environment.
For defenders, the key lies in enhanced monitoring of Proxmox’s task logs, validating QEMU binaries, and auditing loaded kernel modules to detect unauthorized behaviors before adversaries go unnoticed in virtual infrastructures.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
