module

VMware Fusion USB Arbitrator Setuid Privilege Escalation

Try Surface Command
Back to search
Disclosed
2020-03-17
Created
2020-04-02

Description

This exploits an improper use of setuid binaries within VMware Fusion 10.1.3 - 11.5.3.
The Open VMware USB Arbitrator Service can be launched outide of its standard path
which allows loading of an attacker controlled binary. By creating a payload in the
user home directory in a specific folder, and creating a hard link to the 'Open VMware
USB Arbitrator Service' binary, we're able to launch it temporarily to start our payload
with an effective UID of 0.
@jeffball55 discovered an incomplete patch in 11.5.3 with a TOCTOU race.
Successfully tested against 10.1.6, 11.5.1, 11.5.2, and 11.5.3.

Authors

h00die
Dhanesh Kizhakkinan
Rich Mirch
jeffball jeffball@dc949.org
grimm

Platform

OSX

Architectures

x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/osx/local/vmware_fusion_lpe
    msf exploit(vmware_fusion_lpe) > show targets
        ...targets...
    msf exploit(vmware_fusion_lpe) > set TARGET < target-id >
    msf exploit(vmware_fusion_lpe) > show options
        ...show and set options...
    msf exploit(vmware_fusion_lpe) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today