module

VMware vCenter Server vmdir Authentication Bypass

Try Surface Command
Back to search
Disclosed
Apr 9, 2020
Created
Apr 23, 2020

Description

This module bypasses LDAP authentication in VMware vCenter Server's
vmdir service to add an arbitrary administrator user. Version 6.7
prior to the 6.7U3f update is vulnerable, only if upgraded from a
previous release line, such as 6.0 or 6.5.
Note that it is also possible to provide a bind username and password
to authenticate if the target is not vulnerable. It will add an
arbitrary administrator user the same way.

Authors

Hynek Petrak
JJ Lehmann
Ofri Ziv
wvu [email protected]

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > show actions
        ...actions...
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > set ACTION < action-name >
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > show options
        ...show and set options...
    msf auxiliary(vmware_vcenter_vmdir_auth_bypass) > run
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report