vSphere Development Guide 6 - vCenter SAML Certificates

0x00 Preface

---

A recent exploitation technique I learned: Using administrator privileges on vCenter to extract the IdP certificate from /storage/db/vmware-vmdir/data.mdb, create a SAML request for an administrator user, and finally authenticate using the vCenter server to obtain a valid administrator cookie.

Intuitive understanding: From local administrator privileges on vCenter to administrator access to the VCSA management panel.

Learning materials:

https://www.horizon3.ai/compromising-vcenter-via-saml-certificates/

https://github.com/horizon3ai/vcenter_saml_login

This article will improve the code based on the learning materials, enhance its versatility, and provide defense recommendations in conjunction with exploitation ideas.

0x01 Introduction

---

This article will cover the following:

• Method reproduction
• Script optimization
• Exploitation ideas
• Defense Recommendations

0x02 Method Reproduction

---

Testing on Kali System

Install Openssl:

1. Obtain Database File from vCenter

Path: /storage/db/vmware-vmdir/data.mdb

vCenter Administrator Privileges Required

2. Run the Script

Download URL:

https://github.com/horizon3ai/vcenter_saml_login/blob/main/vcenter_saml_login.py

Command Parameter Example:

Command Line Return Result:

3. Log in to the VCSA management panel

Access https://192.168.1.1/ui

Set Cookie: JSESSIONID=XX533CDFA344DE842517C943A1AC7611

Successfully logged into the management panel as administrator

0x03 Script Optimization

---

Typically, the size of data.mdb is at least 20MB

To reduce interaction traffic, choose to modify vcenter_saml_login.py to be usable directly under vCenter

Note:

Python is installed by default on vCenter

Specifically, the following issues need to be considered when modifying the script:

1. Remove the reference to the third-party package bitstring

The approach I adopted is to streamline the content of the third-party package bitstring and directly insert it into the Python script

2. Avoid using f-string formatting

Python 3.6 introduced a new f-string formatting feature

vCenter 6.7 uses Python 3.5.6, which does not support the 'f' prefix for formatted string literals

The approach I adopted was to use the format method for string formatting

For example:

Replaced with:

The complete code has been uploaded to GitHub at the following address:

An open-source project

vCenter_ExtraCertFromMdb.py can be uploaded to vCenter and executed directly. After execution, the following four important parameters will be obtained:

• domain, displayed in the command line
• idp_cert, saved as idp_cert.txt
• trusted_cert_1, saved as trusted_cert_1.txt
• trusted_cert_2, saved as trusted_cert_2.txt

Next, a SAML request can be created for the administrator user on any host, using the vCenter server for authentication to obtain a valid administrator cookie. The complete code has been uploaded to GitHub at the following address:

An open-source project

Parameter description is as follows:

• target: URL of the VCSA management panel
• hostname: Corresponds to the CN in the certificate Subject attribute of the VCSA management panel
• domain: Can be obtained from data.mdb using vCenter_ExtraCertFromMdb.py
• idp_cert path: Can be obtained from data.mdb using vCenter_ExtraCertFromMdb.py
• trusted_cert_1 path: Can be obtained from data.mdb using vCenter_ExtraCertFromMdb.py
• trusted_cert_2 path: Can be obtained from data.mdb using vCenter_ExtraCertFromMdb.py

0x04 Exploitation Approach

---

1. From vCenter local administrator privileges to VCSA management panel administrator access

Prerequisite: Gained vCenter local administrator privileges through a vulnerability

Exploitation effect:

Obtain administrator access to the VCSA management panel, enabling interaction with virtual machines manageable by vCenter

Note:

At this point, administrator users can also be added via the LDAP database using the method described in 'vSphere Development Guide 5 - LDAP', enabling interaction with virtual machines manageable by vCenter.

2. Obtain data.mdb from vCenter backup files

Prerequisite: Need to obtain the correct data.mdb file

Exploitation effect:

Gain administrator access to the VCSA management panel, enabling interaction with virtual machines manageable by vCenter

0x05 Defense Recommendations

---

1. Apply patches to prevent attackers from obtaining vCenter local administrator privileges

2. Avoid leakage of vCenter backup files in use

0x06 Summary

---

This article introduces optimization ideas for vcenter_saml_login, enhances its generality, and provides defense recommendations based on exploitation approaches.