VMware WorkStation 12.5.3 - Virtual Machine Escape
| Reporter | Title | Published | Views | Family All 26 |
|---|---|---|---|---|
 | VMware WorkStation 12.5.3 - Virtual Machine Escape Exploit | 25 Nov 201900:00 | – | zdt |
 | Exploit for Use of Uninitialized Resource in Vmware Fusion | 14 Sep 202518:01 | – | gitee |
 | Security Bulletin: Open Source VMware Fusion Vulnerabilities in IBM Pure Application System (CVE-2017-4903, CVE-2017-4904, CVE-2017-4905) | 25 Jun 201919:40 | – | ibm |
 | Multiple VMware Product Local Information Disclosure Vulnerabilities | 30 Mar 201700:00 | – | cnvd |
 | CVE-2017-4905 | 7 Jun 201718:00 | – | cve |
 | CVE-2017-4905 | 7 Jun 201718:00 | – | cvelist |
 | EUVD-2017-14022 | 7 Oct 202500:30 | – | euvd |
 | VMware WorkStation 12.5.3 - Virtual Machine Escape | 6 Jun 201900:00 | – | exploitpack |
 | VMware Fusion 8.x < 8.5.6 Multiple Vulnerabilities (VMSA-2017-0006) (macOS) | 30 Mar 201700:00 | – | nessus |
| ESXi 5.5 < Build 5230635 Multiple Vulnerabilities (VMSA-2017-0006) (remote check) | 31 Mar 201700:00 | – | nessus |
10
# VMware Escape Exploit
VMware Escape Exploit before VMware WorkStation 12.5.3
Host Target: Win10 x64
Compiler: VS2013
Test on VMware 12.5.2 build-4638234
# Known issues
* Failing to heap manipulation causes host process crash. (About 50% successful rate )
* Not quite elaborate because I'm not good at doing heap "fengshui" on winows LFH.
# FAQ
* Q: Error in reboot vmware after crashing process.
* A: Just remove ***.lck** folder in your vm directory or wait a while and have a coffee :).Here is a simple [script](https://raw.githubusercontent.com/unamer/vmware_escape/master/cve-2017-4901/cleanvm.bat) I used to clean up.
# Reference
* https://keenlab.tencent.com/en/2018/04/23/A-bunch-of-Red-Pills-VMware-Escapes/
EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47715.zipData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Nov 2019 00:00Current
7.2High risk
Vulners AI Score7.2
CVSS 22.1
CVSS 3.15.5
EPSS0.01204