CVE-2023-27327 PoC — Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

Source

https://github.com/kn32/parallels-plist-escape

Associated Vulnerability

Title:Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability (CVE-2023-27327)
Description:Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-18964.

Description

Exploits for CVE-2023-27327 and CVE-2023-27328

Readme

# parallels-plist-escape

This repository contains exploits for CVE-2023-27327 and CVE-2023-27328, which can be used together to escape a Parallels Desktop virtual machine, prior to Parallels Desktop 18.1.1. 

It also contains code for a required kernel module, in `prl_mod`, which can be used to send arbitrary Toolgate requests (< opcode 0x8000) from userland, using a proc entry created at `/proc/driver/prl_tg_pwn`.

### Requirements
- Root in the guest so you can load the kernel module
- Parallels Tools installed - this is not strictly required if we have root in the guest, but the code here assumes it's present
- At least one share mounted into the VM, it doesn't matter where this is on the host

### Running the exploit
Build and load the kernel module:
```bash
cd prl_mod
make -f Makefile.kmods
sudo insmod ./prl_tg_pwn/Toolgate/Guest/Linux/prl_tg/prl_tg_pwn.ko
```

Run the exploit:
```bash
cd ..
pip install -r requirements.txt
./3_full_chain.py
```

File Snapshot


 [4.0K]  /data/pocs/db273ecdcc66762b8a0f5d5ef88a1fa2029e0a57
├── [4.3K]  1_write_file.py
├── [2.8K]  2_plist_injection.py
├── [ 151]  3_full_chain.py
├── [4.0K]  prl_mod
│   ├── [2.0K]  Makefile.kmods
│   ├── [4.0K]  prl_tg
│   │   └── [4.0K]  Toolgate
│   │       ├── [4.0K]  Guest
│   │       │   ├── [4.0K]  Interfaces
│   │       │   │   └── [1.0K]  tgreq.h
│   │       │   └── [4.0K]  Linux
│   │       │       ├── [4.0K]  Interfaces
│   │       │       │   ├── [ 465]  prltg_call.h
│   │       │       │   └── [3.0K]  prltg.h
│   │       │       └── [4.0K]  prl_tg
│   │       │           ├── [1.5K]  Makefile
│   │       │           ├── [ 16K]  prltg.c
│   │       │           ├── [ 13K]  prltg_call.c
│   │       │           ├── [5.5K]  prltg_common.h
│   │       │           ├── [3.2K]  prltg_compat.h
│   │       │           └── [ 951]  tg_test.c
│   │       └── [4.0K]  Interfaces
│   │           ├── [ 15K]  Tg.h
│   │           └── [ 179]  VSockPorts.h
│   └── [4.0K]  prl_tg_pwn
│       └── [4.0K]  Toolgate
│           ├── [4.0K]  Guest
│           │   ├── [4.0K]  Interfaces
│           │   │   └── [1.0K]  tgreq.h
│           │   └── [4.0K]  Linux
│           │       ├── [4.0K]  Interfaces
│           │       │   ├── [ 465]  prltg_call.h
│           │       │   └── [3.0K]  prltg.h
│           │       └── [4.0K]  prl_tg
│           │           ├── [1.4K]  Makefile
│           │           ├── [4.5K]  prltg.c
│           │           ├── [5.5K]  prltg_common.h
│           │           ├── [3.2K]  prltg_compat.h
│           │           └── [ 951]  tg_test.c
│           └── [4.0K]  Interfaces
│               ├── [ 15K]  Tg.h
│               └── [ 179]  VSockPorts.h
├── [ 32K]  pwn.dylib
├── [ 965]  README.md
├── [  15]  requirements.txt
├── [ 27K]  smile.png
└── [4.0K]  toolgate
    ├── [1.9K]  client.py
    ├── [9.6K]  constants.py
    ├── [  71]  __init__.py
    └── [2.1K]  structs.py

18 directories, 33 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!