Day: November 15, 2021

bad security of vmware guest isolation from host

by

1. without administrative privilege, only using guest os user password, we can copy any file from guest to host by

#startup win7.vmx first.
vmrun.exe -gu guest_os_user_name -gp guest_os_user_password copyFileFromGuestToHost "E:\vmimg\win7\win7.vmx" c:\windows\system32\notepad.exe e:\notepad.exe

2. example about communication between guest and host using vmware backdoor routines:
https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/services/plugins/dndcp

refer to:
n0nick

start tiny web server with current folder as http root path

by

httpd.py

1
2
3
4
5
6
7
8
9
10

from http.server import HTTPServer, SimpleHTTPRequestHandler
 
handler = SimpleHTTPRequestHandler
handler.extensions_map.update({
	".js": "application/javascript",
})
 
server_address = ("", 8008)
server = HTTPServer(server_address, handler)
server.serve_forever()

how to run

1

python3 ./httpd.py

unknown filesystem type 'vmhgfs'

by

because vmhgfs-fuse is not built,

1

apt install libfuse-dev

before compiling open-vm-tools.

following is the autorun scripts, e.g. open-vm-tools are installed in /home/work/vmware/open-vm-tools/open-vm-tools/installed.

  • /etc/xdg/autostart/vmware-user.desktop

    1
2
3
4
5
6

    [Desktop Entry]
Type=Application
Encoding=UTF-8
Exec=/home/work/vmware/open-vm-tools/open-vm-tools/installed/bin/vmware-user-suid-wrapper
Name=VMware User Agent
X-KDE-autostart-phase=1
  • /etc/rc.local

    1
2
3
4
5
6
7

    #!/bin/bash
(
cd /home/work/vmware/open-vm-tools/open-vm-tools/installed/bin/
LD_LIBRARY_PATH=`pwd`/../lib:$LD_LIBRARY_PATH ./vmtoolsd &
./vmhgfs-fuse /mnt/hgfs/
./vmware-user
)
1
2

chmod +x /etc/rc.local
reboot