Bypass Record
Exploitation for Priv-Esc × Rapid7 Metasploit Pro
A publicly-reported instance of Exploitation for Priv-Esc bypassing Rapid7 Metasploit Pro, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The metasploitPostgreSQL service spawns postgres.exe as SYSTEM, which loads openssl.cnf from a static path writable by the 'vagrant' user. By placing a crafted configuration file, an attacker triggers arbitrary command execution via OpenSSL's config engine, bypassing security controls and escalating to SYSTEM.
Detection & mitigation
Monitor for unexpected modifications to OpenSSL configuration files in static paths, especially by non-privileged users, using file integrity monitoring (FIM) or Windows Event ID 4663. Mitigate by restricting write permissions on service-related configuration directories and applying the vendor patch.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.