BMC Patrol Agent - Privilege Escalation Code Execution Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'zlib' class MetasploitModule Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Powershell @deflater = nil...

BMC Patrol Agent Privilege Escalation / Command Execution Exploit

This Metasploit module leverages the remote command execution feature provided by the BMC Patrol Agent software. It can also be used to escalate privileges on Windows hosts as the software runs as SYSTEM but only verifies that the password of the provided user is correct. This also means if the...

BMC Patrol Agent Privilege Escalation / Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'zlib' class MetasploitModule Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Powershell @deflater = nil...

Default configuration

DISPUTED An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...

CVE-2018-20735

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

CVE-2018-20735

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

CVE-2018-20735

BMC PATROL Agent (PatrolCli) up to version 11.3.01 is vulnerable to privilege escalation and potential domain-wide lateral movement. The PatrolCli/PATROL Agent authentication only validates the user password, not the user’s network permissions, enabling a low-privilege domain account to authentic...

CVE-2018-20735

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

PT-2019-10193 · Microsoft +1 · Windows Active Directory +1

Name of the Vulnerable Software and Affected Versions: BMC PATROL Agent versions through 11.3.01 Description: An issue in the BMC PATROL Agent allows for lateral movement and escalation of privilege inside a Windows Active Directory environment. The PatrolCli application only verifies if the...

CVE-2018-20735: Improper Authentication

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if...

BMC Patrol Agent Privilege Escalation Cmd Execution

This module leverages the remote command execution feature provided by the BMC Patrol Agent software. It can also be used to escalate privileges on Windows hosts as the software runs as SYSTEM but only verfies that the password of the provided user is correct. This also means if the software is...

Code injection

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring...

CVE-2017-13130

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring...

BMC Patrol Elevation of Privilege Vulnerability

BMC Patrol is a suite of enterprise-class server management tools. A security vulnerability in BMC Patrol mcmnm allows local attackers to exploit the vulnerability by submitting a special libmcmclnx.so with elevated privileges...

CVE-2017-13130: Uncontrolled Search Path Element

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring...

CVE-2017-13130

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring...

PT-2017-12920

Name of the Vulnerable Software and Affected Versions BMC Patrol affected versions not specified Description The issue allows local users to gain privileges through a crafted libmcmclnx.so file in the current working directory. This is possible because the affected software is setuid root and the...

CVE-2017-13130

CVE-2017-13130 affects BMC Patrol (mcmnm) with a local privilege escalation in which a crafted libmcmclnx.so placed in the current working directory can be executed to gain elevated privileges. Root cause: the binary is setuid root and the RPATH starts with .: which enables an attacker-controlled...

Design/Logic Flaw

In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to...

CVE-2016-9638

In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to...