Rapid7 Vulnerability & Exploit Database

VMware vCenter vScalation Priv Esc

Back to Search

VMware vCenter vScalation Priv Esc

Disclosed
09/21/2021
Created
12/05/2022

Description

This module exploits a privilege escalation in vSphere/vCenter due to improper permissions on the /usr/lib/vmware-vmon/java-wrapper-vmon file. It is possible for anyone in the cis group to write to the file, which will execute as root on vmware-vmon service restart or host reboot. This module was successfully tested against VMware VirtualCenter 6.5.0 build-7070488. The following versions should be vulnerable: vCenter 7.0 before U2c vCenter 6.7 before U3o vCenter 6.5 before U3q

Author(s)

  • h00die
  • Yuval Lazar

Platform

Linux

Architectures

x86, x64

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/local/vcenter_java_wrapper_vmon_priv_esc
msf exploit(vcenter_java_wrapper_vmon_priv_esc) > show targets
    ...targets...
msf exploit(vcenter_java_wrapper_vmon_priv_esc) > set TARGET < target-id >
msf exploit(vcenter_java_wrapper_vmon_priv_esc) > show options
    ...show and set options...
msf exploit(vcenter_java_wrapper_vmon_priv_esc) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;