CVE-2020-3952 PoC — VMware vCenter Server 访问控制错误漏洞

Description

VMWare vmdir missing access control exploit checker

介绍

Script to check for vulnerable status of CVE-2020-3952

It is inspired from [guardicore
exploit](https://github.com/guardicore/vmware_vcenter_cve_2020_3952)
but with a slight difference: it does NOT create an admin user.

It will assess the vulnerable status by validating that the builtin
Administrators group can be tainted by creating or appending the
harmless 'description' attribute.

## Check

Usage:
```
$ python exploit_check.py vserver_ip
```


## Detect attempts

suricata signature rule `vmware.rules` is a naive approach catching
the LDAP modify operation on the Administrators group. It needs to be
customized with a proper signature id `sid` and you can tune the src
and dst subnets that are set by default to `any` here.

It could be improved by looking specifically at members addition.

文件快照

备注