Saturday, June 22, 2024

Hacker Leaked Unpatched Virtual Box Zero-day Vulnerability and its Exploit Online

Russian Security Expert leaked a critical Virtual Box Zero-day vulnerability online along with its exploit that allows an attacker to gain root/administrator privileges in a guest and escape to a host.

The vulnerability can be exploited from guest ring 3 level privilege which is used to exploit the most powerful hypervisor vulnerabilities that allow taking control over the host operating system.

Exploiting this Vulnerability that existing in the Virtual box is sophisticated and there is a lot more technical process involved in order to exploit and gain the host privilege.

Exploiting Algorithm Steps for Virtual Box Zero-day

Before executing the shellcode, researcher crossed the information leak, stack buffer overflow attacks in order to take control over the host.

Initially, attacker unloads the driver e1000.ko which is basically loaded in Linux guests by default and then load the  LKM exploits.

According to the datasheet,  E1000 will be initialized by the Linux kernel module (LKM) to leak the information where  LKM disables E1000 loopback mode to make stack buffer overflow code unreachable.

“Here The LKM uses the integer underflow vulnerability to make the heap buffer overflow. The heap buffer overflow allows for use E1000 EEPROM to write two any bytes relative to a heap buffer in 128 KB range. Hence the attacker gains a write primitive.”

Later to perform a stack overflow Researcher explained the following statement,

  • The LKM enabled E1000 loopback mode to make stack buffer overflow code reachable.
  • The LKM uses the integer underflow vulnerability to make the heap buffer overflow and the stack buffer overflow. Saved return address (RIP/EIP) is overwritten. The attacker gains control.
  • ROP chain is executed to execute a shellcode loader.

Later the Shellcode loader copied the shellcode and executed it to perform an orbitary process on the host side.

Finally, The attacker unloads the LKM and loads e1000.ko back to allow the guest to use a network.

He explained a complete exploitation process in his GitHub Page and he released a test video as a proof of this Zero-day vulnerability.

In Above video, researcher loads the exploit in guest OS and the shell has been executed in host OS.

“Until the patched VirtualBox build is out you can change the network card of your virtual machines to PCnet (either of two) or to Paravirtualized Network. If you can’t, change the mode from NAT to another one. The former way is more secure”. Researcher said.

The Reasons why He made this Zero-day Vulnerability in Public

Before starting the complete exploitation details, he explained the following reasons to leak this Virtual box Zero-day Flaw online.

“I like VirtualBox and it has nothing to do with why I publish a 0day vulnerability. The reason is my disagreement with contemporary state of infosec, especially of security research and bug bounty:”

  1. Wait half a year until a vulnerability is patched is considered fine.
  2. In the bug bounty field these are considered fine:
  • Wait more than month until a submitted vulnerability is verified and a decision to buy or not to buy is made.
  • Change the decision on the fly. Today you figured out the bug bounty program will buy bugs in a software, week later you come with bugs and exploits and receive “not interested”.
  • Have not a precise list of software a bug bounty is interested to buy bugs in. Handy for bug bounties, awkward for researchers.
  • Have not precise lower and upper bounds of vulnerability prices. There are many things influencing a price but researchers need to know what is worth to work on and what is not.

3. The delusion of grandeur and marketing bullshit: naming vulnerabilities and creating websites for them; making a thousand conferences in a year; exaggerating importance of own job as a security researcher; considering yourself “a world saviour”. Come down, Your Highness.

I’m exhausted of the first two, therefore my move is full disclosure. Infosec, please move forward.

Please find the complete vulnerability & its exploit details Here.

Also Read:

Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

Hackers Exploit Cisco Zero Day Vulnerability in Wild Resulting in DoS Condition

Zero Day Attack Prevention: A Fundamental Pillar of Security


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles