5

I have to demonstrate a VM Escape for a project. After some light research, I have found a vulnerability CVE-2014-0983 "Oracle VirtualBox 3D Acceleration Multiple Memory Corruption Vulnerabilities". The Rapid7 website shows that an exploit for metasploit is available to trigger this vulnerability.

What is the best way of running the exploit, provided I want the attack to seem remote? (I am using a different PC to act as a remote attacker) The exploit is said to be tested on a Windows 7 host running VirtualBox 4.3.6, but doesn't mention which Operating System is running on the virtual box.

Also are there any more ways to demonstrate a VM Escape? (I am not skilled enough to actually write VM Escape code)

Improve this question
1
  • I would guess it works with either a Linux or Windows guest OS, but you will have to test. VM escape isn't really a remote vuln, but you can simulate it by connecting remotely to the guest over SSH or RDP.
    – paj28
    Oct 25, 2016 at 11:11

1 Answer 1

Reset to default
4

VM escapes are typically local exploits in that they already need native code execution capabilities to talk to local virtual devices of the guest.

I believe the most convincing way would be to chain this together with a remote exploit, such as one for a browser. Open a Meterpreter session via the browser exploit, then you can use any local exploit from remote to perform privilege escalation or even VM escape. This tutorial summarizes the commands pretty well:

https://www.offensive-security.com/metasploit-unleashed/privilege-escalation/

Please note that CVE-2014-0983 is a memory corruption exploit, so you have to set up your test environment to precisely match the exploit target ("VirtualBox 4.3.6 / Windows 7 SP1 / 64 bits").

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .