Metasploit module developed for CVE-2018-18556 VyOS Privilege Escalation

Fri, 25 Sep 2020 20:52:25 +0000

Today, a Metasploit module was merged for a vulnerability I found in 2018 with VyOS. This vulnerability was my first public InfoSec blog post. I appreciate bcoles for developing the exploit/linux/ssh/vyos_restricted_shell_privesc module. Read the Metasploit Wrapup for 9/25/2020. The full write-up can be found on this blog at CVE-2018-18556 – VyOS Privilege escalation via sudo pppd for operator users.

CVE-2018-18556 - VyOS Privilege escalation via sudo pppd for operator users

Tue, 06 Nov 2018 04:39:42 +0000

Recently I found several ways to escape the restricted shell for an operator user in VyOS 1.1.8. VyOS is a Linux-based network operating system that provides software-based network routing, firewall, and VPN functionality. I plan to post information on the restricted shell escapes in the near future; For now read the blog by @dmbaturin detailing some of the methods.

This post will focus on how root access was obtained using sudo after the restricted shell was escaped. One of my first post exploitation steps on Linux after a low privileged shell is obtained is to check if the user has sudo rules configured. Sudo is designed to limit privileges but often it can be leveraged to elevate access.

vyos on Rich Mirch

Metasploit module developed for CVE-2018-18556 VyOS Privilege Escalation

CVE-2018-18556 - VyOS Privilege escalation via sudo pppd for operator users