CVE-2018-6981 PoC — Vmware ESXi、Workstation和Fusion 缓冲区错误漏洞

Source

Associated Vulnerability

Description

Use this tool to prioritize cluster patching for the recent VMware advisory VMSA-2018-0027 related to CVE-2018-6981 and CVE-2018-6982.

Readme

# Limitation
Script does not currently identify which ESXi systems have been patched, and merely relies on major and minor revision numbrer to determine if the hypervisor is vulnerable.  If required we can check patches but this tool will live and die over a short periord of time so it isn't worth the effort.  

# Description:  

This tool enables operations teams to quickly identify and prioritize which vCenter clusters have virtual machines using the VMXNET3 adapter on top of ESXi hypervisors vulnerable to VMSA-2018-0027.  

VMware Advisory: https://www.vmware.com/security/advisories/VMSA-2018-0027.html  
CVE: CVE-2018-6981, CVE-2018-6982  

# Usage

Usage:
  vmxnet3_hunter.py -h | --help
  vmxnet3_hunter.py (--vsphere_list=<vsphere_list> --vsphere_user=<vsphere_user>)
 
Options:
  --vsphere_list=<vsphere_list>     A file containing a single IPv4 address per line
  --vsphere_user=<vsphere_user>     vCenter username ex: administrator@vsphere.local

# Example vsphere_list file
$ cat rhosts  
1.1.1.1  
2.2.2.2  
3.3.3.3  
4.4.4.4  
5.5.5.5  

# Example execution
$ python3 vmxnet3_hunter.py  --vsphere_list rhosts --vsphere_user administrator@sphere.local   
  
Password for user administrator@vsphere.local:  
  
Generating data list from: rhosts    
Description:  
Concurrently executing vCenter enumeration  
Conecting to vCenter: 1.1.1.1  
Enumerating ESXi Host: 1.1.1.1 
Enumerating Virtula Machine: None  
Enumerating Virtula Machine: None  
Enumerating Virtula Machine: None  
Found vm with vmxnet3: None  
Enumerating Virtula Machine: 1.1.1.1  
Found vm with vmxnet3: 1.1.1.1   
Enumerating ESXi Host: 1.1.1.1  
Enumerating Virtula Machine: None  
Enumerating ESXi Host: 1.1.1.1  
Enumerating Virtula Machine: None  
Enumerating vCenter: 1.1.1.1   
Writing our results to vmxnet3_results.log  

# Log output      
$ cat vmxnet3_results.log  
```json
[  
    {  
        "vCenterIP": {  
            "ClusterPatchPriority": [  
                "Lab"  
            ],  
            "ESXiHosts": [  
                {  
                    "Cluster": "Lab",  
                    "Name": "1.1.1.1 ",  
                    "PatchPriority": true,  
                    "Version": "6.5.0",  
                    "VirtualMachines": [  
                        {  
                            "family": null,    
                            "fullname": null,  
                            "hostname": null,  
                            "ip": null,  
                            "name": "ubuntu01",  
                            "nicDevice": "VMXNET3",  
                            "state": "notRunning"  
                        },  
                        {  
                            "family": "linuxGuest",  
                            "fullname": "Other 3.x or later Linux (64-bit)",  
                            "hostname": "debian01",  
                            "ip": "1.1.1.1 ",  
                            "name": "VMware vCenter Server Appliance",  
                            "nicDevice": "VMXNET3",  
                            "state": "running"  
                        }  
                    ],  
                    "VulnerableTo": "CVE-2018-6981, CVE-2018-6982, VMSA-2018-0027"  
                },  
                {  
                    "Cluster": "Lab",  
                    "Name": "1.1.1.1 ",  
                    "PatchPriority": false,  
                    "Version": "6.5.0",  
                    "VirtualMachines": [],  
                    "VulnerableTo": "CVE-2018-6981, CVE-2018-6982, VMSA-2018-0027"  
                },  
                {  
                    "Cluster": "Lab",  
                    "Name": "1.1.1.1 ",  
                    "PatchPriority": false,  
                    "Version": "6.5.0",  
                    "VirtualMachines": [],  
                    "VulnerableTo": "CVE-2018-6981, CVE-2018-6982, VMSA-2018-0027"  
                }  
            ],  
            "vCenterBuild": "8307201",  
            "vCenterIP": "1.1.1.1",  
            "vCenterVersion": "6.5.0"  
        }  
    }  
]  
```

File Snapshot

 [4.0K]  /data/pocs/6ba19058f549a082f178e703b268f0bc8f094de8
├── [1.0K]  LICENSE
├── [4.0K]  README.md
└── [6.4K]  vmxnet3Hunter.py

0 directories, 3 files

Remarks