Researchers at Akamai have uncovered the significant threat posed by VPN post-exploitation, shedding light on how attackers can intensify their infiltration once a VPN server has been compromised. The investigation highlights vulnerabilities and unresolved issues within Ivanti Connect Secure and FortiGate VPNs that could enable malicious actors to seize control of other vital network resources.
VPN servers are frequently targeted by attackers due to their direct exposure to the internet and extensive attack surfaces. These servers have traditionally served as entry points into internal networks. However, the focus of the research was to explore the additional damage an attacker might inflict after breaching a VPN server.
Advanced Exploitation Techniques
The researchers identified two primary strategies for VPN post-exploitation: compromising the device’s operating system and exploiting the existing VPN management interface. The latter method, termed “living off the VPN,” is particularly appealing due to its lower cost and ease of execution, as it bypasses the need for a custom malware implant.
- Management Interface Exploitation: Gaining access to the VPN’s management interface is often simpler than achieving full remote code execution (RCE). This can be done through an authentication bypass, weak credentials, or phishing.
- Cost-Effective Approach: By leveraging the existing interface, attackers can avoid the complexity and resource investment required to develop a custom payload.
Akamai’s team demonstrated these tactics on Ivanti Connect Secure and FortiGate VPN servers, identifying two critical vulnerabilities (CVEs) and several other techniques that attackers could use to control crucial network assets, potentially transforming a VPN breach into a comprehensive network takeover.
Exploiting Remote Authentication Servers
One of the most sensitive assets managed by VPN servers is user credentials, particularly when LDAP and RADIUS authentication servers are employed. The researchers discovered methods to exploit these credentials.
- LDAP Authentication Flaws: Both FortiGate and Ivanti VPNs were found to transmit LDAP credentials in plain text when using simple authentication. Even when secure protocols like LDAPS and TLS are in place, an attacker controlling the VPN could degrade the configuration, capturing credentials in plain text.
- RADIUS Authentication Exploitation: The researchers also found a technique to register a rogue authentication server, enabling the capture of user credentials. This is achieved by adding a rogue server to a user group or realm, tricking the VPN into authenticating against the attacker’s server.
Capturing LDAP Credentials
When plain LDAP is used for authentication, attackers can intercept credentials by positioning themselves between the VPN and the LDAP server or by taking control of the VPN server itself. They can utilize built-in packet capture features in FortiGate and Ivanti to capture LDAP packets without deploying any malware. Even if secure protocols like LDAPS and TLS are used, an attacker with control over the VPN can modify the settings to revert to plain LDAP, facilitating the capture of credentials.
This can be done by altering the configuration for standard LDAP servers or by reconfiguring the Ivanti AD server settings to use a less secure LDAP setup, all without alerting users. This change causes the VPN to transmit passwords in clear text, enabling attackers to easily obtain credentials and move laterally within the network.
Rogue Authentication Server Creation
Akamai’s research identified a security flaw in FortiGate and Ivanti VPNs that attackers can exploit to compromise user credentials during the authentication process by registering a rogue authentication server.
- FortiGate VPN Vulnerability: Users can be grouped to apply specific permissions, including those linked to external servers like LDAP. When a user from a mixed group (local and remote) authenticates, FortiGate attempts to validate their credentials across all configured servers, granting access if any server approves.
- Ivanti VPN Exploitation: Although Ivanti typically restricts authentication realms to a single server, the addition of a secondary server leads Ivanti to validate credentials against both, succeeding if either server approves. Attackers can exploit this behavior to undermine security.
By setting up a rogue authentication server, attackers can capture user credentials. This involves adding the rogue server to a FortiGate user group or Ivanti realm, causing the VPN to send authentication requests to the attacker-controlled server. This method targets both VPN clients and administrators, allowing the attacker to decrypt and capture credentials using a RADIUS server. The credentials are sent in the initial request without proper verification and encrypted with a key that the attacker controls. The provided script demonstrates how to decrypt RADIUS passwords. For Ivanti, the rogue server must be configured to approve any provided credentials.
Extracting Sensitive Information from Configuration Files
The study also highlighted that VPN configuration files often contain sensitive data, such as local user passwords, SSH keys, and third-party service account credentials. Although these secrets are encrypted, they can be decrypted using known keys. FortiGate, for instance, uses a default hard-coded key, which can be exploited to decrypt stored secrets. Even if a custom key is used, an attacker could revert to the default key, decrypting the information.
The findings suggest that a compromised VPN server is not just a stepping stone into the network but can be a powerful tool for gaining broader access to network resources and potentially leading to a full-scale network compromise. The researchers stress the need to adhere to best practices to mitigate the risks associated with VPN post-exploitation techniques.
Mitigation Strategies
To reduce the risks associated with using a VPN server, the following key practices are recommended:
- Implement Zero Trust Network Access (ZTNA): Traditional VPNs provide extensive network access, which can be risky if compromised. ZTNA limits access based on identity and context, granting users only the necessary access while reducing the impact of potential breaches.
- Restrict Service Account Permissions: Given that VPNs may expose service account passwords in plaintext, these accounts should be limited to the minimum necessary permissions, ideally read-only, to minimize the damage from a potential VPN compromise.
- Use Dedicated Authentication for VPNs: Avoid using existing authentication services like Active Directory (AD) for VPN access, as compromised credentials could lead to broader network breaches. Instead, use dedicated authentication methods, such as certificate-based authentication.
- Monitor Configuration Changes: Regularly review and compare VPN device configurations against a baseline “golden image” to detect and prevent unauthorized modifications.
These recommendations underscore the importance of not relying solely on the security of a VPN and taking proactive measures to protect it.
