CVE-2013-1662

This Metasploit module exploits a privilege escalation vulnerability in VMWare Workstation/Player (up to 9.0.2) by leveraging a setuid binary (vmware-mount) that executes lsb_release via popen(3) without sanitizing the PATH. The exploit writes a malicious lsb_release executable to the current directory and manipulates PATH to achieve root execution.

The writeup discusses a privilege escalation vulnerability (CVE-2013-1662) in Debian/Ubuntu systems due to the lack of privilege-dropping behavior in dash (used as /bin/sh) compared to bash. It highlights how this can be exploited in setuid programs like VMware utilities to gain root access.

This Metasploit module exploits a privilege escalation vulnerability in VMWare Workstation/Player by leveraging a setuid binary (vmware-mount) that executes lsb_release from the user-controlled PATH, allowing arbitrary code execution as root.