For the Greater Good: Leveraging VMware's RPC Interface for fun and profit
summary
Demonstrates how VMware guest-to-host RPC can be recorded with piKD RPC sniffing and exercised from userland via a C++ DLL or a Python layer using ctypes Python fuzzer or C extensions; shows an actual exploit chain: a drag‑and‑drop use‑after‑free in DND is triggered by flipping the DND version, the freed object size is b8, then an RPC request (up to 0x10000 bytes) reclaims and overwrites that slot, unity_window_content gives a predictable pointer for a libc‑style leak, and Workstation/Fusion vmx runs at medium integrity.
AI-written summary · about
chapters (4)
related talks
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
39mFuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit
48mStraight Outta VMware: Modern Exploitation of the SVGA Device for Guest-to-Host Escapes
27m3d Red Pill: A Guest-to-Host Escape on QEMU/KVM Virtio Device
41mRDP and The Power of Deterministic Snapshot Fuzzing
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
46mFor The Win: The Art Of The Windows Kernel Fuzzing