VMware vCenter - CVE-2024-37081 Proof of Concept

Description

This repository contains a proof of concept (PoC) for the vulnerability CVE-2024-37081 in VMware vCenter. The vulnerability is due to a misconfiguration in the /etc/sudoers file that allows the preservation of dangerous environment variables when executing sudo commands. This can be exploited by attackers to execute arbitrary commands with root privileges.

Vulnerability

• ID: CVE-2024-37081
• Description: The misconfiguration of the Defaults env_keep parameter in the /etc/sudoers file allows the propagation of dangerous environment variables (PYTHONPATH, VMWARE_PYTHON_PATH, VMWARE_PYTHON_BIN, etc.) during the execution of sudo commands, enabling arbitrary code execution with root privileges.
• Affected Users/Groups:
  • %operator (group)
  • %admin (group)
  • infraprofile (user)
  • vpxd (user)
  • sts (user)
  • pod (user)

Requirements

• Python 3.x
• sudo permissions

Instructions

1. Clone this repository:

   root@kitploit:~

   git clone https://github.com/Mr-r00t11/CVE-2024-37081.git
   cd CVE-2024-37081
   

2. Run the PoC script:

   root@kitploit:~

   python3 poc.py
   

Repository Contents

• poc.py: Python script that demonstrates the exploitation of the vulnerability.
• README.md: This file.

Script Details

The poc.py script performs the following steps:

1. create_malicious_code(): Creates a malicious Python file in the /tmp/malicious/__init__.py directory that executes the id command and saves the output to /tmp/pwned.
2. execute_with_pythonpath(): Sets the PYTHONPATH environment variable to /tmp/malicious and executes a sudo command to import a Python module as the operator user.
3. execute_with_vmware_python_path(): Similar to execute_with_pythonpath(), but uses the VMWARE_PYTHON_PATH environment variable and executes the command as the pod user.
4. execute_with_vmware_python_bin(): Creates a malicious shell script, sets the VMWARE_PYTHON_BIN environment variable to this script, and executes a sudo command as the admin user.
5. execute_with_sendmail(): Executes a sudo command as the vpxd user to read the file using .

Security Notes

This script should only be used in a controlled environment and for educational purposes. Exploiting vulnerabilities in systems without authorization is illegal and punishable by law. Ensure you have proper permissions and fully understand the implications of running this type of code.

Credits

• Security Researcher: Matei “Mal” Badanoiu

License

This project is licensed under the terms of the MIT License.