VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation
Description
A vulnerability within the VBoxGuest driver allows an attacker to inject memory they control into an arbitrary location they define. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile on Windows XP SP3 systems. This has been tested with VBoxGuest Additions up to 4.3.10r93012.
Author(s)
- Matt Bergin <level@korelogic.com>
- Jay Smith <jsmith@korelogic.com>
Platform
Windows
Architectures
x86
Development
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/local/virtual_box_guest_additions
msf exploit(virtual_box_guest_additions) > show targets
...targets...
msf exploit(virtual_box_guest_additions) > set TARGET < target-id >
msf exploit(virtual_box_guest_additions) > show options
...show and set options...
msf exploit(virtual_box_guest_additions) > exploit
- Collect and share all the information you need to conduct a successful and efficient penetration test
- Simulate complex attacks against your systems and users
- Test your defenses to make sure they’re ready
- Automate Every Step of Your Penetration Test
Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.
– Jim O’Gorman | President, Offensive Security