module

VMware vCenter Server vmdir Authentication Bypass

Try Surface Command
Back to search
Disclosed
Apr 9, 2020
Created
Apr 23, 2020

Description

This module bypasses LDAP authentication in VMware vCenter Server's
vmdir service to add an arbitrary administrator user. Version 6.7
prior to the 6.7U3f update is vulnerable, only if upgraded from a
previous release line, such as 6.0 or 6.5.
Note that it is also possible to provide a bind username and password
to authenticate if the target is not vulnerable. It will add an
arbitrary administrator user the same way.

Authors

Hynek Petrak
JJ Lehmann
Ofri Ziv
wvu wvu@metasploit.com

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > show actions
        ...actions...
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > set ACTION < action-name >
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > show options
        ...show and set options...
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today