CVE-2021-21972 PoC — VMware vSphere Client 路径遍历漏洞

Source

Associated Vulnerability

Description

POC exploit for CVE-2021-21972

Readme

**vsphereyeeter.sh** is an automated bash script to exploit vulnerabilty **CVE-2021-21972** in the vSphere Client for vCenter servers. Once executed simply give it the IP Address of your vulnerable target and you will be presented with an SSH shell.

"*The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2)." - mitre*

Great write-up of the vulnerability here: https://swarm.ptsecurity.com/unauth-rce-vmware/

## Prerequisites:
	Download the evilarc.py script from https://github.com/ptoomey3/evilarc and place it in the same directory as this script.

## Automated Steps:
	1. Create SSH Keypair
	2. Add your public key into directory traversal archive w/ evilarc
	3. Send request to vSphere to add your ssh key to the authorized_keys directory (it will create one if one does not exists)

*written by @PettyHacks*


![alt text](https://i.imgur.com/ZW8S83D.jpeg)

File Snapshot

 [4.0K]  /data/pocs/fa9bf78bd5352b46647e9196c2ff9f9da30b4e23
├── [3.6K]  evilarc.py
├── [1.2K]  README.md
└── [2.0K]  vSphereyeeter.sh

0 directories, 3 files

Remarks