Tunnel Vision: Exploring VPN Post-Exploitation Techniques

Tunnel Vision: Exploring VPN Post-Exploitation Techniques

Speakers: Olid, Security Researcher, Akamai

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=JIszPqQcZxw

Overview

In a compelling presentation at Black Hat USA 2024, Olid, a security researcher at Akamai, challenged the conventional understanding of Virtual Private Network (VPN) security. Titled "Tunnel Vision: Exploring VPN Post-Exploitation Techniques," the talk delved into the often-overlooked phase of VPN post-exploitation, moving beyond the initial compromise of these critical network edge devices. Olid opened with a thought-provoking question: "Do you trust your VPN server?" He argued that organizations, despite growing adoption of zero-trust principles, often place undue faith in their VPN infrastructure, creating significant blind spots for advanced attackers.

The core premise of Olid's research is that a compromised VPN server can offer far more than just a gateway to the internal network. While initial access is a common objective for threat actors exploiting VPN vulnerabilities, the talk illuminated sophisticated techniques that allow attackers to deepen their foothold, maintain persistence, and harvest sensitive credentials directly from the VPN device itself. This shift in focus from how VPNs are exploited to what an attacker can achieve after exploitation is crucial for organizations to fully grasp the potential impact of a VPN breach and implement more robust defensive strategies.

Olid’s presentation aimed to raise awareness about these advanced post-exploitation tactics, particularly those that do not require complex custom implants, making them accessible to a broader range of threat actors. By examining popular VPN solutions like Ivanti and Fortinet, he demonstrated how abusing existing management interface functionalities can lead to a full network compromise. This research underscores the urgent need for a more comprehensive security posture around VPNs, treating them not merely as network entry points but as high-value targets demanding continuous vigilance and a zero-trust approach.

Background

▶ Watch: Introduction: Do you trust your VPN server? (0:37)

The security landscape for VPNs has been particularly tumultuous in recent years. As Olid noted, the past year alone witnessed a significant rise in critical security vulnerabilities discovered in leading VPN servers, frequently leading to widespread exploitation campaigns against organizations globally. This trend, while intensified recently, is not new; VPNs have long been attractive targets for attackers due to their fundamental role in providing remote access to internal networks from the internet. This utility, invaluable from an IT perspective, simultaneously positions VPNs as prime targets for adversaries seeking to bypass perimeter defenses.

Traditionally, attackers have primarily leveraged compromised VPNs as a conduit for initial network access. Once a VPN server is breached, the attacker tunnels communications through it, begins internal network scanning, and initiates their broader intrusion from this established beachhead. However, Olid questioned whether this limited perspective fully captures the extent of what an attacker can achieve. He drew an analogy to the post-exploitation phase on a compromised Windows machine, where attackers move beyond mere access to establish persistence, gather credentials, and perform lateral movement, often utilizing extensive frameworks dedicated to these tasks. In contrast, discussions around VPN post-exploitation have been notably sparse.

Olid acknowledged that VPN post-exploitation is not an entirely novel concept, citing Mandiant's report on the Ivanti VPN exploitation campaign from the previous year. This report detailed sophisticated techniques, such as establishing persistence mechanisms and manipulating log files, demonstrating that high-tier threat actors, particularly nation-state groups, have been engaging in these activities for years. A common theme in these advanced attacks involves the deployment of custom implants. After achieving Remote Code Execution (RCE) on the VPN device, attackers install specialized malware designed to run directly on the server's operating system, allowing them to modify system files, hook functions, and implement virtually any desired technique.

While implant-based post-exploitation offers attackers unparalleled control, it comes with a significant overhead. VPN devices are often "undocumented black boxes," making the development and maintenance of custom implants a time-consuming and resource-intensive endeavor requiring substantial research and development. Consequently, this level of effort typically limits implant-based attacks to well-funded and highly skilled nation-state threat actors. Mid-range APTs and financially motivated groups often forgo such complex efforts in favor of simpler, yet still effective, methods. This observation led Olid to challenge the assumption that advanced VPN post-exploitation is a risk relevant only to a small subset of organizations targeted by elite adversaries. He sought to discover if there were easier, more accessible methods for less sophisticated threat actors to achieve similar post-exploitation objectives, thereby expanding the scope of this critical security concern.

Key Findings

▶ Watch: Understanding why VPNs are prime targets for exploitation (2:57)

Olid's research successfully demonstrated an "easier way" to perform VPN post-exploitation, making these advanced techniques accessible to a wider array of threat actors. He introduced the concept of "living off the VPN," a parallel to the well-known "living off the land" approach in traditional endpoint compromise. Instead of developing complex custom implants to delve deep into the VPN's underlying operating system, this methodology focuses on abusing existing functionalities within the VPN's management interface.

This approach offers two significant advantages:

1. Ease of Execution: Rather than writing intricate custom code for a hardened, often undocumented, operating system, attackers can achieve their goals by "clicking buttons in the UI" – interacting with the VPN's administrative interface. This drastically lowers the technical barrier to entry.
2. Broader Access Methods: Gaining access to the underlying OS for implant deployment typically requires a full RCE vulnerability. However, access to the management interface can be obtained through various means, including RCE, authentication bypass vulnerabilities, or even by simply compromising legitimate administrative credentials. This expanded attack surface means that less sophisticated vulnerabilities or even social engineering tactics could pave the way for powerful post-exploitation activities.

To validate his hypothesis, Olid targeted two of the most popular VPN providers on the market: Ivanti and Fortinet. The research proceeded under the assumption that an attacker had already gained administrative access to the management interface of these devices. Through this lens, Olid uncovered a set of highly impactful techniques that allow an attacker to immediately gain access to additional critical resources within the internal network. The most alarming finding was that, in certain scenarios, a VPN compromise can very easily and rapidly escalate into a full network compromise, largely through the harvesting of credentials.

The primary technique discovered involves manipulating the VPN's remote authentication server configurations. By leveraging default insecure settings or inherent design choices in how these VPNs handle authentication, an attacker with management interface access can effectively position themselves to intercept and capture user credentials as they authenticate to the VPN. This simple yet devastating method allows the attacker to bypass the need for complex implants, instead relying on the VPN's own features to steal credentials that can then be used for lateral movement and privilege escalation across the entire organization.

Technical Deep Dive

▶ Watch: Exploring VPN post-exploitation beyond initial network access (4:00)

The cornerstone of Olid's "living off the VPN" methodology revolves around the manipulation of remote authentication servers, a critical component of enterprise VPN infrastructure. To understand the vulnerability, it's essential to first grasp how VPN authentication typically works.

Remote Authentication Servers: The Standard Flow

When a user attempts to access the internal network via a VPN, they must first authenticate. While basic setups might use local users (credentials stored directly on the VPN server), this approach doesn't scale for large organizations. Most enterprises rely on remote authentication servers or identity providers (e.g., LDAP, RADIUS, cloud-based SSO solutions like Azure AD or Okta). In this model, the user provides their credentials to the VPN, which then acts as a proxy, forwarding these credentials to the configured remote authentication server for validation. Based on the server's response, the VPN either approves or rejects the user's access. This system is designed for centralized identity management, but as Olid demonstrated, it introduces significant points of vulnerability when misconfigured or poorly implemented.

Fortinet: Cleartext LDAP by Default

Olid's investigation into Fortinet VPNs revealed a critical security flaw in their default configuration for LDAP authentication. When a user authenticates, Fortinet performs a simple LDAP bind operation to the configured LDAP server. Shockingly, Olid discovered that, by default, Fortinet sends the user's password in cleartext during this LDAP bind.

This default behavior has two severe implications for credential exposure:

1. Service Account Credentials: To configure an LDAP authentication server on the Fortinet VPN, an administrator must typically provide credentials for a service account. This account is used by the VPN to query information from the LDAP server (e.g., user groups, attributes). These service account credentials are also sent in cleartext during the configuration and operational phases.
2. User Credentials: More critically, every time a user authenticates via LDAP, their provided credentials are sent in cleartext to the LDAP server. An attacker with access to the VPN's management interface can leverage this.

While LDAPS (LDAP over SSL/TLS) is supported by Fortinet, it is not the default option. Furthermore, many legacy or internal LDAP servers may not be configured to support LDAPS by default, leaving organizations vulnerable even if they attempt to enable it. This creates a scenario where an attacker, having compromised the VPN's management, can easily capture a stream of cleartext credentials.

Ivanti: The Secondary Authentication Server Abuse

Ivanti VPNs presented a different, but equally dangerous, vulnerability related to their authentication server configurations. Unlike Fortinet, Ivanti typically allows only one primary authentication server per group. However, it supports a secondary authentication server option, primarily designed to facilitate certain Single Sign-On (SSO) configurations where multiple servers might be involved in the authentication flow.

The critical flaw lies in how Ivanti handles this secondary server. When configured, after the primary authentication server validates the user's credentials, the Ivanti VPN can be set up to also validate the same credentials against the secondary server. This design choice, intended for specific SSO scenarios, creates a powerful credential harvesting opportunity for attackers.

The Post-Exploitation Technique: Attacker-Controlled Authentication Servers

Olid demonstrated how an attacker, having gained administrative access to either the Fortinet or Ivanti VPN's management interface, could weaponize these features to capture credentials. The technique is remarkably simple:

1. Fortinet: The attacker adds an additional authentication server to the Fortinet configuration. This new server is controlled by the attacker.
2. Ivanti: The attacker configures a secondary authentication server within the Ivanti setup, pointing it to an attacker-controlled endpoint.

In both scenarios, whenever a legitimate user authenticates to the VPN, their credentials are sent to the normal, legitimate authentication server for validation. Critically, these same credentials are also sent in the background to the attacker-controlled server. This applies to any authentication method that relies on the VPN forwarding credentials, including local VPN credentials, LDAP credentials, and RADIUS authentication.

This technique is incredibly effective because it leverages the VPN's inherent functionality without requiring complex code injection or system-level modifications. The attacker simply reconfigures an existing, legitimate feature to redirect sensitive information. By passively collecting these credentials, the attacker gains access to a wealth of user accounts, enabling widespread lateral movement, privilege escalation, and ultimately, a potentially full network compromise. The ease of implementation combined with the severity of the outcome makes this a potent post-exploitation technique for a broad spectrum of threat actors.

Demo / Proof of Concept

▶ Watch: Mandiant report on Ivanti VPN post-exploitation techniques (5:25)

While the presentation did not include a live, on-stage demonstration of the attacks, Olid thoroughly explained the methodology and the specific configuration changes required to implement the credential capture techniques on both Fortinet and Ivanti VPN devices. He walked the audience through the logical steps an attacker would take, assuming management interface access, to configure an attacker-controlled authentication server.

The conceptual proof of concept was detailed by describing how, in the case of Fortinet, an attacker would add an additional LDAP server pointing to their own controlled endpoint. For Ivanti, the explanation focused on setting up a secondary authentication server similarly directed to an attacker's listener. In both scenarios, the core of the demonstration was the illustration of how subsequent user authentications would then transmit credentials to both the legitimate and the malicious servers, effectively allowing the attacker to passively harvest sensitive login information. The speaker also mentioned that additional details and techniques not covered in the talk would be published on Akamai's blog, implying that more in-depth technical walkthroughs or simulated environments might be available there.

Defensive Implications

▶ Watch: Implant-based VPN post-exploitation and its high cost (6:00)

Olid's research highlights a critical need for organizations to fundamentally reassess their trust in VPN infrastructure. The defensive implications are profound and require a multi-faceted approach:

1. Adopt a Zero-Trust Mindset for VPNs: The overarching message is clear: "Do not trust your VPN." Organizations must assume that their VPN could be, or already has been, compromised. This necessitates treating the VPN not as an impenetrable gateway, but as another potentially vulnerable node within the network that requires continuous verification and least-privilege principles.

1. Strict Configuration Audits and Hardening:

• LDAPS Enforcement: For Fortinet and similar VPNs, it is imperative to ensure that LDAPS (LDAP over SSL/TLS) is enabled and enforced for all LDAP authentication configurations. This encrypts credentials in transit, preventing cleartext exposure. Organizations must also verify that their internal LDAP servers are correctly configured to support LDAPS.
• Review Authentication Server Chains: Thoroughly audit all configured authentication servers, especially secondary or additional servers on platforms like Ivanti. Scrutinize their purpose, ensure they point to legitimate and secured endpoints, and remove any unnecessary or suspicious entries.
• Least Privilege for Service Accounts: Implement the principle of least privilege for any service accounts used by the VPN to query authentication servers. These accounts should only have the minimum necessary permissions.

1. Enhanced Monitoring and Alerting:

• Monitor Configuration Changes: Implement robust logging and alerting for any changes made to VPN authentication server configurations. This includes the addition, modification, or deletion of primary, secondary, or additional authentication servers.
• Network Traffic Analysis: Monitor network traffic originating from the VPN server, particularly connections to external or unusual IP addresses on authentication ports (e.g., LDAP, RADIUS). Look for traffic directed to unknown or non-sanctioned authentication endpoints.
• Credential Exposure Detection: Deploy solutions capable of detecting cleartext credential transmissions over the network, particularly from VPN devices to authentication servers.

1. Secure Management Interface Access:

• Strong Authentication: Enforce strong, multi-factor authentication (MFA) for all VPN management interfaces.
• Network Segmentation: Restrict access to the VPN management interface to a highly segmented and trusted management network, accessible only by authorized administrators.
• Patch Management: While this talk focused on post-exploitation, the underlying premise is an initial compromise. Therefore, maintaining a rigorous patch management program for all VPN devices is fundamental to prevent initial exploitation. The "rough year for VPN security" highlighted the constant threat of RCE and authentication bypass vulnerabilities.

1. Incident Response Planning: Develop and regularly test incident response plans specifically tailored for a VPN compromise scenario. This plan should account for the possibility of credential theft and the subsequent lateral movement, outlining steps for credential rotation, network segmentation, and threat hunting within the internal network.

By adopting these defensive measures, organizations can significantly reduce the attack surface and mitigate the severe risks associated with VPN post-exploitation, preventing an initial VPN breach from spiraling into a full-scale network compromise.

Key Takeaways

• VPNs are Prime Targets: Threat actors are consistently targeting VPN devices due to their critical role at the network edge, providing direct access to internal resources upon compromise.
• Post-Exploitation Extends Beyond Initial Access: A compromised VPN offers attackers much more than just a gateway. They can achieve persistence, gather credentials, and facilitate lateral movement, transforming an initial breach into a deeper intrusion.
• "Living off the VPN" Lowers the Bar for Attackers: Less sophisticated threat actors can achieve significant post-exploitation objectives by abusing existing functionalities within the VPN's management interface, bypassing the need for complex custom implants.
• Default Insecure Configurations are Critical Vulnerabilities: Default settings, such as Fortinet's cleartext LDAP authentication, expose sensitive service account and user credentials, making credential harvesting straightforward for attackers.
• Credential Harvesting via Malicious Authentication Servers: Attackers with management interface access can easily configure attacker-controlled authentication servers (e.g., additional Fortinet servers, secondary Ivanti servers) to intercept and capture any credentials passed through the VPN.
• Zero-Trust is Essential for VPNs: Organizations must adopt a "do not trust your VPN" mentality, assuming potential compromise and implementing rigorous security measures like LDAPS enforcement, strict configuration auditing, enhanced monitoring, and strong access controls for management interfaces.

About the Speaker(s)

Olid is a security researcher at Akamai, based in Israel. His professional background is rooted in red teaming and threat hunting, providing him with a practical, adversarial perspective on security challenges. In his current role, Olid covers a diverse array of research topics within Akamai's security research team. He specifically dedicated several months to in-depth research into VPN security, culminating in the insights presented in this talk, aiming to shed light on overlooked aspects of VPN post-exploitation.