1. How to hack VMware
vCenter server in
60 seconds
Alexey Sintsov
Alexander Minozhenko

2. Hijacking VMware
@asintsov @al3xmin
• Pen-testers at Digital
Security
• Researchers
• DCG#7812 / Zeronights
• FUN, FUN, FUN
© 2002—2012, Digital

3. Hijacking VMware
Our target
© 2002—2012, Digital

4. Hijacking VMware
VMware vCenter Server
• VMware vCenter Server is solution to manage VMware vSphere
• vSphere – virtualization operating system
© 2002—2012, Digital

5. Hijacking VMware
Pen-test…
• Vmware vCenter version 4.1 update 1
Services:
• Update Manager
• vCenter Orchestrator
• Chargeback
• Other
• Most of those services has web server
© 2002—2012, Digital

6. Hijacking VMware
VASTO and CVE-2009-1523
• Directory traversal in Jetty web server
http://target:9084/vci/download/health.xml/%3f/../../../../FILE
• Discovered by Claudio Criscione
• Fixed in VMware Update Manager 4.1 update 1 :(
• Who want to pay me for 0day?
• Pentester is not resercher?
© 2002—2012, Digital

7. Hijacking VMware
8(
© 2002—2012, Digital

8. Hijacking VMware
CVE-2010-1870
• VMware vCenter Orchestrator use Struts2 version 2.11 discovered by
Digital Defense, Inc
• CVE-2010-1870 Struts2/XWork remote command execution discovered
by Meder Kydyraliev
Fixed in 4.2
© 2002—2012, Digital

9. Hijacking VMware
Details
•Struts2 does not properly escape “#”
•Could be bypass with unicode “u0023”
•2 variables need to be set for RCE
•#_memberAccess['allowStaticMethodAccess']
•#context['xwork.MethodAccessor.denyMethodExecution']
© 2002—2012, Digital

10. Hijacking VMware
But what about us?
• Directory traversal in Jetty web server … AGAIN!
http://target:9084/vci/download/.%5C..%5C..%5C..%5C..%5C..%5C..%5C..
%5C..FILE.EXT
•Metasploit module vmware_update_manager_traversal.rb by sinn3r
• We can read any file! But what
Claudio Criscione propose to read vpxd-profiler-* -
/SessionStats/SessionPool/Session/Id='06B90BCB-A0A4-4B9C-B680-
FB72656A1DCB'/Username=„FakeDomainFakeUser'/SoapSession/Id='A
Sorry, patched in 4.1!
D45B176-63F3-4421-BBF0-FE1603E543F4'/Count/total 1
Contains logs of SOAP requests with session ID !!!
Discovered by Alexey Sintsov 8)
© 2002—2012, Digital

11. Hijacking VMware
Attack #1
• Read vpxd-profiler via traversal…
• Get Admin’s IP addresses from it…
• Read secret SSL key
http://target:9084/vci/downloads/...............Documents and SettingsAll UsersApplication DataVMwareVMware VirtualCenterSSLrui.key
• ARP-SPOOF with SSL key - PROFIT
© 2002—2012, Digital

12. Hijacking VMware
VMware vCenter Orchestrator
• Vmware vCO – software for automate configuration
and management
• Install by default with vCenter
• Have interesting file
C:Program
filesVMwareInfrastructureOrchestratorconfigurationj
ettyetcpasswd.properties
© 2002—2012, Digital

13. Hijacking VMware
VMware vCenter Orchestrator
Password disclosure
Read hash -> crack MD5 -> log on into Orch. -> get vCenter pass
© 2002—2012, Digital

14. Hijacking VMware
VMware vCenter Orchestrator – more stuff
• vCO stored password at files:
• C:Program FilesVMwareInfrastructureOrchestratorapp-
<virtual-infrastructure-host
serverservervmoconfpluginsVC.xml
<enabled>true</enabled>
• C:Program FilesVMwareInfrastructureOrchestratorapp-
<url>https://new-virtual-center-host:443/sdk</url>
<administrator-username>vmware</administrator-username>
serverservervmoconfvmo.properties
<administrator-
password>010506275767b74786b383a4a60be767864740329d5fcf
324ec7fc98b1e0aaeef </administrator-password>
<pattern>%u</pattern>
</virtual-infrastructure-host>
© 2002—2012, Digital

15. Hijacking VMware
Hmmm….
006766e7964766a151e213a242665123568256c4031702d4c78454e5b575
f60654b
vmware
00776646771786a783922145215445b62322d1a2b5d6e196a6a712d712e2
4726079
vcenter
• Red bytes look like length
• Green bytes in ASCII range
• Black bytes random Discovered by Alexey Sintsov and
Alexander Minozhenko
© 2002—2012, Digital

16. Hijacking VMware
0day still not patched 8)
© 2002—2012, Digital

17. Hijacking VMware
gg and bb
a.sintsov@dsec.ru
@asintsov
a.minozhenko@dsec.ru
@al3xmin
© 2002—2012, Digital