module

VyOS restricted-shell Escape and Privilege Escalation

Try Surface Command
Back to search
Disclosed
Nov 5, 2018
Created
Sep 19, 2020

Description

This module exploits command injection vulnerabilities and an insecure
default sudo configuration on VyOS versions 1.0.0 arbitrary system commands as root.

VyOS features a `restricted-shell` system shell intended for use by
low privilege users with operator privileges. This module exploits
a vulnerability in the `telnet` command to break out of the restricted
shell, then uses sudo to exploit a command injection vulnerability in
`/opt/vyatta/bin/sudo-users/vyatta-show-lldp.pl` to execute commands
with root privileges.

This module has been tested successfully on VyOS 1.1.8 amd64 and
VyOS 1.0.0 i386.

Authors

Rich Mirch
bcoles [email protected]

Platform

Unix

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/ssh/vyos_restricted_shell_privesc
    msf exploit(vyos_restricted_shell_privesc) > show targets
        ...targets...
    msf exploit(vyos_restricted_shell_privesc) > set TARGET < target-id >
    msf exploit(vyos_restricted_shell_privesc) > show options
        ...show and set options...
    msf exploit(vyos_restricted_shell_privesc) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today