Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
How can Logon Scripts bypass antivirus software interception, such as 360?
Logon Scripts execute before many antivirus programs during the logon sequence. By placing sensitive operations (e.g., creating environment variables via WMI) inside the Logon Script batch file, the script runs before the antivirus can intercept those calls. This allows an attacker to bypass antivirus restrictions on operations like WMI calls. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Techniques - Obtaining Net-NTLM Hash via HTTP Protocol](/news/penetration-techniques-obtaining-net-ntlm-hash-via-http-protocol) - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Pupy Exploitation Analysis - Features on Windows Platform](/news/pupy-exploitation-analysis-features-on-windows-platform)
What is the Logon Scripts persistence technique and where is it configured?
The Logon Scripts persistence technique involves creating a registry key `UserInitMprLogonScript` under `HKCU\Environment` and setting its value to the path of a batch file. This script will execute each time the user logs on. It is a well-known method for maintaining access on a Windows system. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Techniques - Obtaining Net-NTLM Hash via HTTP Protocol](/news/penetration-techniques-obtaining-net-ntlm-hash-via-http-protocol) - [Webmin<=1.920-Unauthenticated_RCE(CVE-2019-15107) Exploitation Test](/news/webmin-1-920-unauthenticated-rce-cve-2019-15107-exploitation-test) - [Pupy Exploitation Analysis - Features on Windows Platform](/news/pupy-exploitation-analysis-features-on-windows-platform)
What registry key should defenders monitor to detect Logon Script abuse?
Defenders should monitor the registry key HKCU\Environment\UserInitMprLogonScript. Unauthorized creation or modification of this value could indicate an attacker attempting to establish persistence via Logon Scripts. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Basics - Obfuscating Strings Using Unicode Encoding](/news/penetration-basics-obfuscating-strings-using-unicode-encoding) - [Sophos UTM Analysis - Clearing Last WebAdmin Sessions Records](/news/sophos-utm-analysis-clearing-last-webadmin-sessions-records) - [Penetration Basics - Methods to Continuously Obtain Exchange User Inbox Emails](/news/penetration-basics-methods-to-continuously-obtain-exchange-user-inbox-emails)
Why would an attacker replace WMI commands with direct registry edits?
WMI operations (e.g., wmic ENVIRONMENT create) are often monitored and blocked by security software like 360. Since WMI ultimately writes to the registry (HKCU\Environment), attackers can bypass detection by using PowerShell or reg commands to directly create the same registry entries, avoiding WMI-based alerts. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Basics - Obfuscating Strings Using Unicode Encoding](/news/penetration-basics-obfuscating-strings-using-unicode-encoding) - [Sophos UTM Analysis - Clearing Last WebAdmin Sessions Records](/news/sophos-utm-analysis-clearing-last-webadmin-sessions-records) - [Penetration Basics - Methods to Continuously Obtain Exchange User Inbox Emails](/news/penetration-basics-methods-to-continuously-obtain-exchange-user-inbox-emails)
How can Logon Scripts bypass antivirus software like 360?
Logon Scripts execute before many antivirus programs load, allowing malicious actions in the script to run without interception. In the article, a batch script using wmic to modify environment variables was blocked by 360, but when triggered via Logon Scripts, it succeeded because the script ran before 360 could intercept it. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Basics - Obfuscating Strings Using Unicode Encoding](/news/penetration-basics-obfuscating-strings-using-unicode-encoding) - [Sophos UTM Analysis - Clearing Last WebAdmin Sessions Records](/news/sophos-utm-analysis-clearing-last-webadmin-sessions-records) - [Penetration Basics - Methods to Continuously Obtain Exchange User Inbox Emails](/news/penetration-basics-methods-to-continuously-obtain-exchange-user-inbox-emails)
What is the registry path and key used for Logon Script persistence?
The persistence technique uses the registry path HKCU\Environment and creates a string value named UserInitMprLogonScript, set to the absolute path of a batch script (e.g., c:\test\11.bat). Upon user logon, the script executes automatically. --- **Related reading:** - [Use Logon Scripts to maintain persistence](/news/use-logon-scripts-to-maintain-persistence) — original article - [Penetration Basics - Obfuscating Strings Using Unicode Encoding](/news/penetration-basics-obfuscating-strings-using-unicode-encoding) - [Sophos UTM Analysis - Clearing Last WebAdmin Sessions Records](/news/sophos-utm-analysis-clearing-last-webadmin-sessions-records) - [Penetration Basics - Methods to Continuously Obtain Exchange User Inbox Emails](/news/penetration-basics-methods-to-continuously-obtain-exchange-user-inbox-emails)
What are the main defense recommendations against this SAML certificate attack?
The primary defenses are applying patches to prevent attackers from obtaining vCenter local administrator privileges, and securing vCenter backup files to avoid leakage. By blocking access to the `data.mdb` file or the local admin account, the attack chain is effectively broken.
Besides gaining local admin on vCenter, what other path can lead to obtaining the data.mdb file?
An attacker can acquire the `data.mdb` file from vCenter backup files. If backups are leaked, the same technique can extract the IdP certificate, create a SAML request, and gain admin access to the VCSA management panel. This enables interaction with managed virtual machines and can be combined with methods like the one described in [vSphere Development Guide 5 - LDAP](/news/vsphere-development-guide-5-ldap) for adding administrator users.
What modifications were needed to make vcenter_saml_login.py run directly on vCenter?
The script had to remove the dependency on the third-party `bitstring` package by inlining its functionality, and replace f-string formatting with the `.format()` method because vCenter 6.7 uses Python 3.5.6, which doesn't support f-strings. This allows the script to be uploaded and executed directly on a vCenter server without additional dependencies.
How can an attacker with vCenter local admin privileges gain access to the VCSA management panel?
The attacker extracts the IdP certificate from `/storage/db/vmware-vmdir/data.mdb`, creates a SAML request for an administrator user, and authenticates against vCenter to obtain a valid JSESSIONID cookie. This cookie grants administrator access to the VCSA management panel, enabling control over virtual machines. For full details, see [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates).
What key parameters are extracted by the vCenter_ExtraCertFromMdb.py script and how are they used in SAML authentication?
The script extracts the domain, idp_cert, trusted_cert_1, and trusted_cert_2. These parameters are used to forge a SAML request for an administrator user: the domain and certificates are employed by the SAML login tool (vcenter_saml_login.py) to authenticate against the vCenter server and obtain an administrator JSESSIONID cookie. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Covenant Utilization Analysis](/news/covenant-utilization-analysis) - [ADAudit Plus Exploitation Analysis — Data Encryption Analysis](/news/adaudit-plus-exploitation-analysis-data-encryption-analysis) - [Domain Penetration - Executing Programs on Remote Systems Using DCOM](/news/domain-penetration-executing-programs-on-remote-systems-using-dcom)
What are the recommended defenses against the SAML certificate exploitation technique described in the article?
Organizations should apply security patches to prevent attackers from gaining vCenter local administrator privileges. Additionally, they must ensure vCenter backup files are properly secured and not leaked, as these can be used to extract the data.mdb file and forge SAML authentication tokens. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Covenant Utilization Analysis](/news/covenant-utilization-analysis) - [ADAudit Plus Exploitation Analysis — Data Encryption Analysis](/news/adaudit-plus-exploitation-analysis-data-encryption-analysis) - [Domain Penetration - Executing Programs on Remote Systems Using DCOM](/news/domain-penetration-executing-programs-on-remote-systems-using-dcom)
What is one method to obtain the data.mdb file without direct local administrator access to a running vCenter?
An attacker can obtain the data.mdb file from vCenter backup files. If backup files are leaked or accessible, the same extraction technique can be used to retrieve the IdP certificate and SAML token, leading to administrator access to the VCSA management panel. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Covenant Utilization Analysis](/news/covenant-utilization-analysis) - [ADAudit Plus Exploitation Analysis — Data Encryption Analysis](/news/adaudit-plus-exploitation-analysis-data-encryption-analysis) - [Domain Penetration - Executing Programs on Remote Systems Using DCOM](/news/domain-penetration-executing-programs-on-remote-systems-using-dcom)
What modifications were made to the vcenter_saml_login.py script to run directly on vCenter?
The script was modified to remove reliance on the third-party package bitstring by integrating its functionality directly. Additionally, f-string formatting was replaced with the .format() method because vCenter 6.7 uses Python 3.5.6, which does not support f-strings. The optimized script, vCenter_ExtraCertFromMdb.py, outputs the domain and certificate files needed for SAML authentication. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Covenant Utilization Analysis](/news/covenant-utilization-analysis) - [ADAudit Plus Exploitation Analysis — Data Encryption Analysis](/news/adaudit-plus-exploitation-analysis-data-encryption-analysis) - [Domain Penetration - Executing Programs on Remote Systems Using DCOM](/news/domain-penetration-executing-programs-on-remote-systems-using-dcom)
How can an attacker with local administrator privileges on vCenter gain access to the VCSA management panel?
An attacker extracts the IdP certificate from the /storage/db/vmware-vmdir/data.mdb file, then creates a SAML request for an administrator user. Using the vCenter server to authenticate, they obtain a valid JSESSIONID cookie, which allows them to log into the VCSA management panel as an administrator. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Covenant Utilization Analysis](/news/covenant-utilization-analysis) - [ADAudit Plus Exploitation Analysis — Data Encryption Analysis](/news/adaudit-plus-exploitation-analysis-data-encryption-analysis) - [Domain Penetration - Executing Programs on Remote Systems Using DCOM](/news/domain-penetration-executing-programs-on-remote-systems-using-dcom)
How does the attacker use the extracted SAML certificates to gain administrator access?
After extracting the IdP certificate and trusted certificates from data.mdb, the attacker creates a SAML authentication request for an administrator user on any host, then authenticates against the vCenter server. The server returns a valid JSESSIONID cookie that, when set in the browser, provides full administrator access to the VCSA management panel. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Penetration Techniques - Deleting Single Windows Log Entries](/news/penetration-techniques-deleting-single-windows-log-entries) - [Penetration Technique: Remote Access to Exchange PowerShell](/news/penetration-technique-remote-access-to-exchange-powershell) - [Zimbra SOAP API Development Guide 2](/news/zimbra-soap-api-development-guide-2)
What defense recommendations does the article provide to prevent SAML certificate exploitation?
The article recommends applying security patches promptly to prevent attackers from gaining vCenter local administrator privileges in the first place, and avoiding leakage of vCenter backup files that might contain the data.mdb database with the IdP certificate. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Penetration Techniques - Deleting Single Windows Log Entries](/news/penetration-techniques-deleting-single-windows-log-entries) - [Penetration Technique: Remote Access to Exchange PowerShell](/news/penetration-technique-remote-access-to-exchange-powershell) - [Zimbra SOAP API Development Guide 2](/news/zimbra-soap-api-development-guide-2)
What are two exploitation methods for obtaining the data.mdb file mentioned in the article?
The first method requires already having vCenter local administrator privileges to directly access the file at /storage/db/vmware-vmdir/data.mdb. The second method involves obtaining the data.mdb file from vCenter backup files, which could be leaked or improperly secured. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Penetration Techniques - Deleting Single Windows Log Entries](/news/penetration-techniques-deleting-single-windows-log-entries) - [Penetration Technique: Remote Access to Exchange PowerShell](/news/penetration-technique-remote-access-to-exchange-powershell) - [Zimbra SOAP API Development Guide 2](/news/zimbra-soap-api-development-guide-2)
What modifications were made to the original vcenter_saml_login.py script for improved usability on vCenter?
The script was modified to remove dependencies on the third-party bitstring package (by inlining the necessary code) and to replace f-string formatting with the .format() method because vCenter 6.7 uses Python 3.5.6 which does not support f-strings. The optimized script, vCenter_ExtraCertFromMdb.py, can run directly on vCenter and outputs domain, idp_cert, trusted_cert_1, and trusted_cert_2. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Penetration Techniques - Deleting Single Windows Log Entries](/news/penetration-techniques-deleting-single-windows-log-entries) - [Penetration Technique: Remote Access to Exchange PowerShell](/news/penetration-technique-remote-access-to-exchange-powershell) - [Zimbra SOAP API Development Guide 2](/news/zimbra-soap-api-development-guide-2)
What is the main exploitation technique described in the vSphere Development Guide 6 article?
The technique involves using administrator privileges on vCenter to extract the Identity Provider (IdP) certificate from the /storage/db/vmware-vmdir/data.mdb database file, then creating a SAML request for an administrator user and authenticating against the vCenter server to obtain a valid administrator JSESSIONID cookie, which grants access to the VCSA management panel. --- **Related reading:** - [vSphere Development Guide 6 - vCenter SAML Certificates](/news/vsphere-development-guide-6-vcenter-saml-certificates) — original article - [Penetration Techniques - Deleting Single Windows Log Entries](/news/penetration-techniques-deleting-single-windows-log-entries) - [Penetration Technique: Remote Access to Exchange PowerShell](/news/penetration-technique-remote-access-to-exchange-powershell) - [Zimbra SOAP API Development Guide 2](/news/zimbra-soap-api-development-guide-2)