module

VMWare Setuid vmware-mount Unsafe popen(3)

Try Surface Command
Back to search
Disclosed
Aug 22, 2013
Created
May 30, 2018

Description

VMWare Workstation (up to and including 9.0.2 build-1031769)
and Player have a setuid executable called vmware-mount that
invokes lsb_release in the PATH with popen(3). Since PATH is
user-controlled, and the default system shell on
Debian-derived distributions does not drop privs, we can put
an arbitrary payload in an executable called lsb_release and
have vmware-mount happily execute it as root for us.

Authors

Tavis Ormandy
egypt [email protected]

Platform

Linux

Architectures

x86

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/local/vmware_mount
    msf exploit(vmware_mount) > show targets
        ...targets...
    msf exploit(vmware_mount) > set TARGET < target-id >
    msf exploit(vmware_mount) > show options
        ...show and set options...
    msf exploit(vmware_mount) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today