Crunch on $salt.$password:

#! /usr/bin/perl

use Digest::SHA 'sha256';
use MIME::Base64;

use Data::Dumper;
$Data::Dumper::Useqq = 1;

my ($hash, $salt) = unpack("a32 a*", decode_base64("KGOnPYya2qwhF9w4xK
+157EZZ/RqIxParohltZWU7h2T/VGjNRA=="));
print Dumper {SALT => $salt, DIGEST => $hash};

my $guess = "VMware1234!";
print Dumper {SALT => $salt, DIGEST => sha256($salt . $guess), TEST =>
+ $guess};
[download]

This is EXACTLY what I was looking for, thank you so much!!

Because I'm 99% sure I know the last few characters, my bruteforcer now looks like this:

#!/usr/bin/perl

use Digest::SHA 'sha256';
use MIME::Base64;

use Data::Dumper;
$Data::Dumper::Useqq = 1;

#my $target = "KGOnPYya2qwhF9w4xK157EZZ/RqIxParohltZWU7h2T/VGjNRA=="; 
+# VMware1234!
my $target = "(my actual hash goes here)"; # Unknown
my ($hash, $salt) = unpack("a32 a*", decode_base64($target));


my $chars = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTU
+VWXYZ.,-_|!#%=+?'*";
my $base = length($chars);
my $guess = "";
my $known = "(the known part of the password goes here)";
my $count = -1;

while (1) {
  
  my $digest = sha256($salt . $guess . $known);
  if ($digest eq $hash) {
    print "Password: '$guess$known'\n";
    exit;
  }

  $count++;
  my $temp = $count;
  $guess = "";
  while ($temp) {
    $guess = substr($chars, ($temp % $base), 1) . $guess;
    $temp = int($temp / $base);
  }
  
  print "Searching for $target: ($count) '$guess$known'\n" unless $cou
+nt % 1000000;
}
[download]

-- FloydATC

Time flies when you don't know what you're doing

Yes, this is known as a "pass-the-hash" attack and described in a few places as an unsupported way to recover from a lost SSO Master password. As I mentioned, I have tried this and it didn't work. I'm not sure why.

Part of the reason may be that I don't fully understand the actual relationship between the SSO Master password and the "admin@System-Domain" password. From what I understand, you initiallly set the admin password and it is used as a Master password as well. For all I know, the admin account may later have been disabled or broken somehow. If I could recover the password somehow, I'm hoping I'd be able to use it as Master password to perform the upgrade and reset the admin account.

This mechanism was unique to vCenter 5.1, it was fixed in version 5.5

-- FloydATC

Time flies when you don't know what you're doing

I agree that it does not appear to be a valid SSHA256 hash but it would help if we knew the salt. Here's what I came up with after some searching.

#!/bin/env perl
use strict;
use warnings;

use MIME::Base64;
use Digest::SHA qw( sha256 );

# Only the first one can be validated...
my @passwords = (
    {
        encoded     => 'M8Nbe/nfLJeVbV3XdvaLD44uxK77eAhJWEx1tIDLBCFteV
+9zYWx0Xw==',
        password    => 'P@ssw0rd!',
        salt        => 'my_salt_',
    },
    {
        encoded     => 'B6HO7UNHVi5fglh1RpJXX4z1maGJ9lcicTVcy94ztsmzAe
+kseg==',
        password    => 'Passw0rd!',
    },
    {
        encoded     => 'KGOnPYya2qwhF9w4xK157EZZ/RqIxParohltZWU7h2T/VG
+jNRA==',
        password    => 'VMware1234!',
    }
);

for my $pass ( @passwords )
{
    print "encoded: $pass->{encoded}\n";
    my $decoded = MIME::Base64::decode_base64( $pass->{encoded} );
    print "decoded: $decoded\n";

    # Find digest and salt
    my @salt = unpack( 'C*', $decoded );
    my @pass;
    push @pass, shift @salt for ( 1 .. 32 ); # shift the password off 
+leaving just the salt behind
    my $pw = pack( 'C32', @pass );
    my $salt = pack( 'C*', @salt );

    print "password digest: $pw\n";
    print "salt: $salt\n";
    print "     salt matches what is stored\n" if ( defined $pass->{sa
+lt} && $salt eq $pass->{salt} );

    # Create a new password digest
    my $digest = sha256( $pass->{password} . $salt );
    print "digest: $digest\n";

    my $reencoded = MIME::Base64::encode_base64( $digest . $salt );
    chomp $reencoded;
    print "reencoded (SSHA256): $reencoded\n";
    print "     reencoded matches the original encoded value!\n" if ( 
+$reencoded eq $pass->{encoded} );
    print "\n\n";
}
[download]

This looks very much like what I was trying, except I couldn't get a match on the salt because I fumbled the length AND looked at the wrong end of the string...

Fortunately, oiskuu seems to have nailed it, thank you both :-)

-- FloydATC

Time flies when you don't know what you're doing