LOLPROX Uncovers Hidden Exploitation Paths for Stealthy Hypervisor Attacks

Open-source virtualization platform Proxmox VE has become a favorite among IT teams for its flexibility, simplicity, and robust performance.

However, a new offensive research project, LOLPROX, highlights how the same built-in management tools can be weaponized for stealthy hypervisor-level attacks that often evade detection.

The Rise of Living-Off-The-Land Hypervisor Abuse

Security researcher Andy Gill (ZephrSec) detailed in his recent publication that Proxmox, built on Debian Linux, blends traditional Linux privilege escalation techniques with virtualization-specific commands.

This combination, according to Gill, creates a unique attack surface in which gaining control of the hypervisor could compromise every virtual machine (VM) it manages.

LOLPROX (“Living Off The Land Proxmox”) catalogs native Proxmox binaries and management commands that adversaries could use post-compromise, much like how the LOLBAS and LOLESXi projects document legitimate admin tools that can serve malicious ends.

Because these utilities are enabled by default, offensive actions executed through them often blend seamlessly with regular administrative activity.

The Proxmox architecture includes components such as pve-cluster, pve-qemu-kvm, pve-container, and pmxcfs, which synchronize configuration and manage VM lifecycles.

These components, especially the /etc/pve cluster filesystem, which is replicated across nodes, can be abused to propagate…