SlideShare a Scribd company logo

Guest Stealing...The VMware Way

S
SecurityTube.Net

This document summarizes a presentation given by Justin Morehouse and Tony Flick at ShmooCon 2010 about exploiting a directory traversal vulnerability in VMware virtualization products to steal virtual machines. It identifies the vulnerability, explains how it works, lists affected versions, and demonstrates a "GuestStealer" proof-of-concept tool. The presentation recommends patching systems and properly segmenting networks as mitigation strategies.

1 of 19
Downloaded 24 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
SSID: FYRM URL: http://172.16.254.1 STEALING GUESTS... THE VMWARE WAY Justin Morehouse & Tony Flick ShmooCon 2010
SSID: FYRM URL: http://172.16.254.1 DISCLAIMER Standard disclaimer verbiage... •Everything said, showed, implied, etc. is not the opinion of our employers, friends, dogs, VMware, ShmooCon, etc. •This disclaimer is not endorsed by our lawyers.
SSID: FYRM URL: http://172.16.254.1 ABOUT US Justin Morehouse • Assessment Lead @ Large Retailer in Southeast USA • Controls 58.2% of the MacBook Pro flipping market on Craigslist Tony Flick • Principal @ FYRM Associates • Has never mistaken Hunts ketchup for Heinz ketchup...EVER!
SSID: FYRM URL: http://172.16.254.1 WARNING What this presentation IS NOT: • 0 day release - worked w/ VMware • A demonstration of rocket science What this presentation IS: • A reminder of the security implications of virtualization • The culmination of ‘sanity’ projects
SSID: FYRM URL: http://172.16.254.1 TIMELINE • Vulnerability identified on 5/14/09 • Reported to VMware on 5/15/09 • VMware responded on 5/21/09 • CVE-2009-3733 reserved on 10/20/09 • VMSA-2009-0015 released on 10/27/09 • ‘b. Directory Traversal vulnerability’
SSID: FYRM URL: http://172.16.254.1 IDENTIFICATION • Originally identified on VMware Server 2.0.1 build 156745 (on Ubuntu 8.04) • Thought to be localized to inside of NAT interface of Host (8307/tcp) • Can steal VMs from within other VMs... if NAT’d • Kinda cool, not really practical • What we originally reported to VMware & submitted to ShmooCon but......
SSID: FYRM URL: http://172.16.254.1 DOES THIS LOOK FAMILIAR?
SSID: FYRM URL: http://172.16.254.1 HOW ABOUT THIS?
SSID: FYRM URL: http://172.16.254.1 VULNERABILITY •Web Access web servers also vulnerable •Server (default ports 8222/8333) - ../ x 6 •ESX/ESXi (default ports 80/443) - %2E%2E/ x 6 •No longer requires NAT mode / Remotely exploitable •Not as straightforward as originally thought •Still trivial to exploit because...
SSID: FYRM URL: http://172.16.254.1 IT’S GOOD TO BE ROOT •Web servers are running as root = complete access •ESX/ESXi •Server
SSID: FYRM URL: http://172.16.254.1 HOW IT WORKS ON SERVER •Proxy used to redirect requests based on URL •/etc/vmware/hostd/proxy.xml (includes mappings) •/sdk = 8307/tcp •/ui = 8308/tcp
SSID: FYRM URL: http://172.16.254.1 HOW IT WORKS ON SERVER •Web server on 8308/tcp is vulnerable, but will only serve certain filetypes (xml, html, images, etc.) •Web server on 8307/tcp is also vulnerable, but serves ALL filetypes •Simply append /sdk to our URL request and we’ve got complete access to Host filesystem (including other Virtual Machines) •ESX/ESXi - ALL web servers return ALL filetypes (no /sdk)
SSID: FYRM URL: http://172.16.254.1 VULNERABLE VERSIONS Server • VMware Server 2.x < 2.0.2 build 203138 (Linux) • VMware Server 1.x < 1.0.10 build 203137 (Linux) ESX/ESXi • ESX 3.5 w/o ESX350-200901401-SG • ESX 3.0.3 w/o ESX303-200812406-BG • ESXi 3.5 w/o ESXe350-200901401-I-SG
SSID: FYRM URL: http://172.16.254.1 GUESTSTEALER •Perl script remotely ‘steals’ virtual machines from vulnerable hosts •Supports Server, ESX, ESXi •Allows attacker to select which Guest to ‘steal’ •Utilizes VMware configuration files to identify available Guests and determine associated files
SSID: FYRM URL: http://172.16.254.1 VMINVENTORY.XML •/etc/vmware/hostd/vmInventory.xml (default location) •Gives us Guest inventory & location information
SSID: FYRM URL: http://172.16.254.1 GUEST .VMX & .VMDK • .vmx gives us Guest config and file locations •.vmdk (disk image) can point to other .vmdk images
SSID: FYRM URL: http://172.16.254.1 LIVE DEMO
SSID: FYRM URL: http://172.16.254.1 MITIGATION STRATEGIES • Patch, patch, patch • Hosts are an attractive target (compromise one = access many) • Better yet...Segment, segment, segment • Segment management interfaces • Segment systems of different security levels • Don’t share physical NICs between different security levels • Virtualization is not always the ‘best answer’
SSID: FYRM URL: http://172.16.254.1 QUESTIONS? GuestStealer available for download @ www.fyrmassociates.com

More Related Content

PPTX
STUDY EDUCATIONAL OPERATING SYSTEM MINIX OPERATING SYSTEM AND DEVELOP REASO...
ANJALAI AMMAL MAHALINGAM ENGINEERING COLLEGE
 
PPTX
Hypervisor Security - OpenStack Summit Hong Kong
Robert Clark
 
PPT
Lessons On Hyper V
Aidan Finn
 
PPTX
Virtualization support by intel
Inzemamul Haque
 
PDF
Distro Recipes 2013: Secure Boot and Linux: several issues, one solution
Anne Nicolas
 
PDF
ELC2019: Static Partitioning Made Simple
The Linux Foundation
 
PPTX
Virtualization lab
Yogendra Tamang
 
PPTX
Venom vulnerability
Portcullis Computer Security
 
STUDY EDUCATIONAL OPERATING SYSTEM MINIX OPERATING SYSTEM AND DEVELOP REASO...
ANJALAI AMMAL MAHALINGAM ENGINEERING COLLEGE
 
Hypervisor Security - OpenStack Summit Hong Kong
Robert Clark
 
Lessons On Hyper V
Aidan Finn
 
Virtualization support by intel
Inzemamul Haque
 
Distro Recipes 2013: Secure Boot and Linux: several issues, one solution
Anne Nicolas
 
ELC2019: Static Partitioning Made Simple
The Linux Foundation
 
Virtualization lab
Yogendra Tamang
 
Venom vulnerability
Portcullis Computer Security
 

Similar to Guest Stealing...The VMware Way (20)

PDF
The Art of Grey-Box Attack
Prathan Phongthiproek
 
PPT
Nomura UCCSC 2009
dnomura
 
PPT
Intro To Hacking
nayakslideshare
 
PPT
hacking and crecjing
parth jasani
 
PDF
Tudor Damian - Hyper-V 3.0 overview
ITCamp
 
PDF
Hyper-V 3.0 Overview
Tudor Damian
 
PPTX
Network Penetration Testing
Mohammed Adam
 
PPTX
DC612 Day - Hands on Penetration Testing 101
dc612
 
PDF
sVirt: Hardening Linux Virtualization with Mandatory Access Control
James Morris
 
ODP
Malware analysis
xabean
 
PDF
Atc ny friday-talk_slides_20080808
Todd Deshane
 
PPTX
Linux Based Network Proposal
Chris Riccio
 
PDF
Building a low cost hack lab
Joe McCray
 
PPTX
System Center Virtual Machine Manager 2008 R2
aralves
 
PPTX
Ethical hacking chapter 8 - Windows Vulnerabilities - Eric Vanderburg
Eric Vanderburg
 
PDF
HackEire 2009
Mark Hillick
 
PDF
Don't Get Hacked on Hostile WiFi
Mackenzie Morgan
 
PDF
Dal Desktop Al Disco Parte 2 - Virtualizzazione E Sicurezza
Walter Moriconi
 
PPT
Trend micro - Your journey to the cloud, where are you
Global Business Events
 
PDF
Lares from LOW to PWNED
Chris Gates
 
The Art of Grey-Box Attack
Prathan Phongthiproek
 
Nomura UCCSC 2009
dnomura
 
Intro To Hacking
nayakslideshare
 
hacking and crecjing
parth jasani
 
Tudor Damian - Hyper-V 3.0 overview
ITCamp
 
Hyper-V 3.0 Overview
Tudor Damian
 
Network Penetration Testing
Mohammed Adam
 
DC612 Day - Hands on Penetration Testing 101
dc612
 
sVirt: Hardening Linux Virtualization with Mandatory Access Control
James Morris
 
Malware analysis
xabean
 
Atc ny friday-talk_slides_20080808
Todd Deshane
 
Linux Based Network Proposal
Chris Riccio
 
Building a low cost hack lab
Joe McCray
 
System Center Virtual Machine Manager 2008 R2
aralves
 
Ethical hacking chapter 8 - Windows Vulnerabilities - Eric Vanderburg
Eric Vanderburg
 
HackEire 2009
Mark Hillick
 
Don't Get Hacked on Hostile WiFi
Mackenzie Morgan
 
Dal Desktop Al Disco Parte 2 - Virtualizzazione E Sicurezza
Walter Moriconi
 
Trend micro - Your journey to the cloud, where are you
Global Business Events
 
Lares from LOW to PWNED
Chris Gates
 
Ad

More from SecurityTube.Net (15)

PPT
Gsm Srsly (Shmoocon)
SecurityTube.Net
 
PPTX
Keynote - Closing the TLS Authentication Gap
SecurityTube.Net
 
PDF
Learning By Breaking O W A S P B W A Doug Wilson Shmoo 2010
SecurityTube.Net
 
PDF
Learning By Breaking Owasp Bwa Doug Wilson Shmoo 2010
SecurityTube.Net
 
PPT
GPU vs CPU Supercomputing Security Shootout
SecurityTube.Net
 
ODP
Wifi Security, or Descending into Depression and Drink
SecurityTube.Net
 
PPT
Network Attacks
SecurityTube.Net
 
PPT
TCP/IP basics
SecurityTube.Net
 
PPT
Wireless Security Basics
SecurityTube.Net
 
PPT
Linux Vulnerabilities
SecurityTube.Net
 
PPT
Microsoft OS Vulnerabilities
SecurityTube.Net
 
PPT
Cryptography Lecture by Sam Bowne
SecurityTube.Net
 
PDF
Active Https Cookie Stealing
SecurityTube.Net
 
PDF
Black Hat Dc 09 Marlinspike Defeating Ssl
SecurityTube.Net
 
PPT
SSL MITM Attack Over Wireless
SecurityTube.Net
 
Gsm Srsly (Shmoocon)
SecurityTube.Net
 
Keynote - Closing the TLS Authentication Gap
SecurityTube.Net
 
Learning By Breaking O W A S P B W A Doug Wilson Shmoo 2010
SecurityTube.Net
 
Learning By Breaking Owasp Bwa Doug Wilson Shmoo 2010
SecurityTube.Net
 
GPU vs CPU Supercomputing Security Shootout
SecurityTube.Net
 
Wifi Security, or Descending into Depression and Drink
SecurityTube.Net
 
Network Attacks
SecurityTube.Net
 
TCP/IP basics
SecurityTube.Net
 
Wireless Security Basics
SecurityTube.Net
 
Linux Vulnerabilities
SecurityTube.Net
 
Microsoft OS Vulnerabilities
SecurityTube.Net
 
Cryptography Lecture by Sam Bowne
SecurityTube.Net
 
Active Https Cookie Stealing
SecurityTube.Net
 
Black Hat Dc 09 Marlinspike Defeating Ssl
SecurityTube.Net
 
SSL MITM Attack Over Wireless
SecurityTube.Net
 
Ad

Guest Stealing...The VMware Way

  • 1. SSID: FYRM URL: http://172.16.254.1 STEALING GUESTS... THE VMWARE WAY Justin Morehouse & Tony Flick ShmooCon 2010
  • 2. SSID: FYRM URL: http://172.16.254.1 DISCLAIMER Standard disclaimer verbiage... •Everything said, showed, implied, etc. is not the opinion of our employers, friends, dogs, VMware, ShmooCon, etc. •This disclaimer is not endorsed by our lawyers.
  • 3. SSID: FYRM URL: http://172.16.254.1 ABOUT US Justin Morehouse • Assessment Lead @ Large Retailer in Southeast USA • Controls 58.2% of the MacBook Pro flipping market on Craigslist Tony Flick • Principal @ FYRM Associates • Has never mistaken Hunts ketchup for Heinz ketchup...EVER!
  • 4. SSID: FYRM URL: http://172.16.254.1 WARNING What this presentation IS NOT: • 0 day release - worked w/ VMware • A demonstration of rocket science What this presentation IS: • A reminder of the security implications of virtualization • The culmination of ‘sanity’ projects
  • 5. SSID: FYRM URL: http://172.16.254.1 TIMELINE • Vulnerability identified on 5/14/09 • Reported to VMware on 5/15/09 • VMware responded on 5/21/09 • CVE-2009-3733 reserved on 10/20/09 • VMSA-2009-0015 released on 10/27/09 • ‘b. Directory Traversal vulnerability’
  • 6. SSID: FYRM URL: http://172.16.254.1 IDENTIFICATION • Originally identified on VMware Server 2.0.1 build 156745 (on Ubuntu 8.04) • Thought to be localized to inside of NAT interface of Host (8307/tcp) • Can steal VMs from within other VMs... if NAT’d • Kinda cool, not really practical • What we originally reported to VMware & submitted to ShmooCon but......
  • 7. SSID: FYRM URL: http://172.16.254.1 DOES THIS LOOK FAMILIAR?
  • 8. SSID: FYRM URL: http://172.16.254.1 HOW ABOUT THIS?
  • 9. SSID: FYRM URL: http://172.16.254.1 VULNERABILITY •Web Access web servers also vulnerable •Server (default ports 8222/8333) - ../ x 6 •ESX/ESXi (default ports 80/443) - %2E%2E/ x 6 •No longer requires NAT mode / Remotely exploitable •Not as straightforward as originally thought •Still trivial to exploit because...
  • 10. SSID: FYRM URL: http://172.16.254.1 IT’S GOOD TO BE ROOT •Web servers are running as root = complete access •ESX/ESXi •Server
  • 11. SSID: FYRM URL: http://172.16.254.1 HOW IT WORKS ON SERVER •Proxy used to redirect requests based on URL •/etc/vmware/hostd/proxy.xml (includes mappings) •/sdk = 8307/tcp •/ui = 8308/tcp
  • 12. SSID: FYRM URL: http://172.16.254.1 HOW IT WORKS ON SERVER •Web server on 8308/tcp is vulnerable, but will only serve certain filetypes (xml, html, images, etc.) •Web server on 8307/tcp is also vulnerable, but serves ALL filetypes •Simply append /sdk to our URL request and we’ve got complete access to Host filesystem (including other Virtual Machines) •ESX/ESXi - ALL web servers return ALL filetypes (no /sdk)
  • 13. SSID: FYRM URL: http://172.16.254.1 VULNERABLE VERSIONS Server • VMware Server 2.x < 2.0.2 build 203138 (Linux) • VMware Server 1.x < 1.0.10 build 203137 (Linux) ESX/ESXi • ESX 3.5 w/o ESX350-200901401-SG • ESX 3.0.3 w/o ESX303-200812406-BG • ESXi 3.5 w/o ESXe350-200901401-I-SG
  • 14. SSID: FYRM URL: http://172.16.254.1 GUESTSTEALER •Perl script remotely ‘steals’ virtual machines from vulnerable hosts •Supports Server, ESX, ESXi •Allows attacker to select which Guest to ‘steal’ •Utilizes VMware configuration files to identify available Guests and determine associated files
  • 15. SSID: FYRM URL: http://172.16.254.1 VMINVENTORY.XML •/etc/vmware/hostd/vmInventory.xml (default location) •Gives us Guest inventory & location information
  • 16. SSID: FYRM URL: http://172.16.254.1 GUEST .VMX & .VMDK • .vmx gives us Guest config and file locations •.vmdk (disk image) can point to other .vmdk images
  • 17. SSID: FYRM URL: http://172.16.254.1 LIVE DEMO
  • 18. SSID: FYRM URL: http://172.16.254.1 MITIGATION STRATEGIES • Patch, patch, patch • Hosts are an attractive target (compromise one = access many) • Better yet...Segment, segment, segment • Segment management interfaces • Segment systems of different security levels • Don’t share physical NICs between different security levels • Virtualization is not always the ‘best answer’
  • 19. SSID: FYRM URL: http://172.16.254.1 QUESTIONS? GuestStealer available for download @ www.fyrmassociates.com