Hello,

I keep getting this error and have no clue why is that.

[*] Successfully extracted the IdP certificate
[*] CN: cn=TrustedCertChain-1,cn=TrustedCertificateChains,cn=<redacted>.local,cn=Tenants,cn=IdentityManager,cn=Services,dc=<redacted>,dc=local
[*] Domain: <redacted>.local
[*] Successfully extracted trusted certificate 1
[*] Successfully extracted trusted certificate 2
[*] Obtaining hostname from vCenter SSL certificate
[*] Found hostname <redacted>.<redacted>.local for <redacted>
[*] Initiating SAML request with <redacted>
[-] Failed initiating SAML request with <redacted>
Traceback (most recent call last):
  File "/home/morpheus/stuff/vcenter_saml_login/vcenter_saml_login.py", line 347, in <module>
    req = saml_request(args.target)
  File "/home/morpheus/stuff/vcenter_saml_login/vcenter_saml_login.py", line 241, in saml_request
    raise Exception("expected 302 redirect")
Exception: expected 302 redirect

I did check a little bit and if I understand correctly, the code expects to 302 redirect and gives exception when it doesn't. The thing is, the host is making 302 redirect but still, I'm getting this exception. Any help, suggestions will be priceless. Thanks.

Hello, I can't execute python. It may be caused by the certificate. I need help.

python3 vcenter_saml_login.py -p data.mdb -t 172.31.0.10 [*] Successfully extracted the IdP certificate [-] Failed to find the trusted certificate 1 Traceback (most recent call last): File "vcenter_saml_login.py", line 295, in trusted_cert_1, domain = get_trusted_cert1(bin_stream, args.verbose) TypeError: cannot unpack non-iterable NoneType object

Any idea what could have gone wrong? Ver: VMware VirtualCenter 7.0.2 build-17920168 [-] Failed logging in with SAML request Traceback (most recent call last): File "/Users/vcenter_saml_login.py", line 351, in <module> c = login(args.target, s) File "/Users/vcenter_saml_login.py", line 301, in login raise Exception("expected 302 redirect") Exception: expected 302 redirect Response: [400] An error occurred while processing the authentication response from the vCenter Single Sign-On server. Details: HTTP error code: 403, status: BadResponse, sub status: Issuer not trusted: .

Hello, I would like to contribute to the code adding a more reliable validation for keys and certs, but there is no license in this repository. Please add some sort auf license to the repository. No license generally means you have no permission from the creators of the software to use, modify, or share the software. More info here https://choosealicense.com/no-permission/

Hello!

The script reports Successfuly obtained Administrator cookie for .... but when I paste the value in the corresponding field the auth not working, just throws back to login screen. As I check its working with vcenter 6.x but not success in vcenter 7.0.3.

Any idea? Thx!

One should replace the 'lstrip' function call at 'get_domain_from_cn' with any alternative (e.g. 'removeprefix') since it strips extra characters (e.g. when the last domain part is 'dc=com').

Thank you!

Did anyone else have issues with "Failed signing the SAML assertion"?

python3 vcenter_saml_login.py -p data.mdb -t <IP>  -v
[*] Extracted IdP certificate:
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----

[*] Successfully extracted the IdP certificate
[!] Looking for cert 1 at position: 69734592
[!] CN end position: 69735640
[*] CN: cn=TrustedCertChain-1,cn=TrustedCertificateChains,cn=<DOMAIN>.<DOMAIN>,cn=Tenants,cn=IdentityManager,cn=Seces,dc=<DOMAIN>,dc=<DOMAIN>
[*] Domain: <DOMAIN>.<DOMAIN>
[!] Cert 1 size: 999
[*] Extracted Trusted certificate:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

[*] Successfully extracted trusted certificate 1
Cert 2 Size: 1053
[*] Extracted Trusted certificate:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

[*] Successfully extracted trusted certificate 2
[*] Obtaining hostname from vCenter SSL certificate
[*] Found hostname <FQDN> for <IP>
[*] Initiating SAML request with <IP>
[*] Generating SAML assertion
[*] Signing the SAML assertion
[-] Failed signing the SAML assertion
Traceback (most recent call last):
  File "<PATH>/Log4jCenter/utils/vcenter_saml_login/vcenter_saml_login.py", line 349, in <module>
    s = sign_assertion(t, trusted_cert_1, trusted_cert_2, idp_cert)
  File "<PATH>/Log4jCenter/utils/vcenter_saml_login/vcenter_saml_login.py", line 281, in sign_assertion
    signed_assertion = signer.sign(root, reference_uri=assertion_id, key=key, cert=[cert1, cert2])
  File "/usr/local/lib/python3.9/dist-packages/signxml/__init__.py", line 398, in sign
    key = load_pem_private_key(ensure_bytes(key), password=passphrase, backend=default_backend())
  File "/usr/local/lib/python3.9/dist-packages/cryptography/hazmat/primitives/serialization/base.py", line 22, in d_pem_private_key
    return ossl.load_pem_private_key(data, password)
  File "/usr/local/lib/python3.9/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 823, in loadm_private_key
    return self._load_key(
  File "/usr/local/lib/python3.9/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 1070, in _lokey
    self._handle_key_loading_error()
  File "/usr/local/lib/python3.9/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 1129, in _hae_key_loading_error
    raise ValueError(
ValueError: ('Could not deserialize key data. The data may be in an incorrect format, it may be encrypted with an upported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).', [_OpenSSLErrithText(code=218529960, lib=13, reason=168, reason_text=b'error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wr tag'), _OpenSSLErrorWithText(code=218546234, lib=13, reason=58, reason_text=b'error:0D06C03A:asn1 encoding routinasn1_d2i_ex_primitive:nested asn1 error'), _OpenSSLErrorWithText(code=218640442, lib=13, reason=58, reason_text=b'or:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error'), _OpenSSLErrorWithText(code=1514987 lib=9, reason=13, reason_text=b'error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib')])

I get the same error when trying to "check" the key with openssl:

 openssl rsa -in private.key -check    
   
unable to load Private Key
139866836145536:error:0D0680A8:asn1 encoding routines:asn1_check_tlen:wrong tag:../crypto/asn1/tasn_dec.c:1149:
139866836145536:error:0D06C03A:asn1 encoding routines:asn1_d2i_ex_primitive:nested asn1 error:../crypto/asn1/tasn_dec.c:713:
139866836145536:error:0D08303A:asn1 encoding routines:asn1_template_noexp_d2i:nested asn1 error:../crypto/asn1/tasn_dec.c:646:Field=version, Type=PKCS8_PRIV_KEY_INFO
139866836145536:error:0907B00D:PEM routines:PEM_read_bio_PrivateKey:ASN1 lib:../crypto/pem/pem_pkey.c:88:

This should differentiate better between keys and certificates by adding a validation function for both. Probably fixes #6

Thanks for adding the license.

root@kent:~/CVE-2021-22005-exp# python3 vcenter_saml_login.py -p data.mdb -t xxx.xx.xxx.xxx [] Successfully extracted the IdP certificate [] CN: cn=TrustedCertChain-1,cn=TrustedCertificateChains,CN=e4ed3720-803d-4d2e-bbd1-3b5221182357,CN=Ldus,CN=ComponentManager,DC=vsphere,DC=local [] Domain: vsphere.local [] Successfully extracted trusted certificate 1 [] Successfully extracted trusted certificate 2 [] Obtaining hostname from vCenter SSL certificate [] Found hostname vcenter.tech.zone for xxx.xx.xxx.xxx [] Initiating SAML request with xxx.xx.xxx.xxx [] Generating SAML assertion [] Signing the SAML assertion [*] Attempting to log into vCenter with the signed SAML request [-] Failed logging in with SAML request Traceback (most recent call last): File "/root/CVE-2021-22005-exp/vcenter_saml_login.py", line 350, in c = login(args.target, s) File "/root/CVE-2021-22005-exp/vcenter_saml_login.py", line 300, in login raise Exception("expected 302 redirect") Exception: expected 302 redirect

xxx.xx.xxx.xxx Is an Internet IP

I was recently on an engagement and identified a vCenter 7.0.3 server. After troubleshooting this script I determined that this version requires a POST parameter RelayState for successful authentication. This change adds the RelayState parameter to add support for vCenter 7.0.3.

This could break compatibility with older versions and should be tested.