Rapid7 Vulnerability & Exploit Database

VMware Fusion USB Arbitrator Setuid Privilege Escalation

Back to Search

VMware Fusion USB Arbitrator Setuid Privilege Escalation

Disclosed
03/17/2020
Created
04/02/2020

Description

This exploits an improper use of setuid binaries within VMware Fusion 10.1.3 - 11.5.3. The Open VMware USB Arbitrator Service can be launched outide of its standard path which allows loading of an attacker controlled binary. By creating a payload in the user home directory in a specific folder, and creating a hard link to the 'Open VMware USB Arbitrator Service' binary, we're able to launch it temporarily to start our payload with an effective UID of 0. @jeffball55 discovered an incomplete patch in 11.5.3 with a TOCTOU race. Successfully tested against 10.1.6, 11.5.1, 11.5.2, and 11.5.3.

Author(s)

  • h00die
  • Dhanesh Kizhakkinan
  • Rich Mirch
  • jeffball <jeffball@dc949.org>
  • grimm

Platform

OSX

Architectures

x86, x64

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/osx/local/vmware_fusion_lpe
msf exploit(vmware_fusion_lpe) > show targets
    ...targets...
msf exploit(vmware_fusion_lpe) > set TARGET < target-id >
msf exploit(vmware_fusion_lpe) > show options
    ...show and set options...
msf exploit(vmware_fusion_lpe) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;