module

VyOS restricted-shell Escape and Privilege Escalation

Disclosed
Nov 5, 2018

Description

This module exploits command injection vulnerabilities and an insecure
default sudo configuration on VyOS versions 1.0.0 arbitrary system commands as root.

VyOS features a `restricted-shell` system shell intended for use by
low privilege users with operator privileges. This module exploits
a vulnerability in the `telnet` command to break out of the restricted
shell, then uses sudo to exploit a command injection vulnerability in
`/opt/vyatta/bin/sudo-users/vyatta-show-lldp.pl` to execute commands
with root privileges.

This module has been tested successfully on VyOS 1.1.8 amd64 and
VyOS 1.0.0 i386.
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.