Skip to content

Commit 5c6f6f1

Browse files
smcintyre-r7smcintyre-r7
authored
Merge pull request rapid7#20261 from bwatters-r7/fix/vmcenter_vmdir_auth
Update datastore option names in vmware_vcenter_vmdir_auth_bypass module and docs
2 parents 1264bfa + e282bbd commit 5c6f6f1

File tree

2 files changed

+96
-25
lines changed

2 files changed

+96
-25
lines changed

‎documentation/modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.md

Lines changed: 95 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,13 @@ Add an admin user to the vCenter Server.
3232
If you already have the LDAP base DN, you may set it in this option.
3333
`dc=vsphere,dc=local` will be used if not set.
3434

35-
### USERNAME
35+
### LDAPUsername
3636

3737
If you already have a password to authenticate to the LDAP server (see
3838
USERNAME), this option let you setup the bind username in DN format (e.g
3939
`cn=1.2.3.4,ou=Domain Controllers,dc=vsphere,dc=local`).
4040

41-
### PASSWORD
41+
### LDAPPassword
4242

4343
The password to authenticate to the LDAP server, if you have it.
4444

@@ -55,22 +55,35 @@ Set this to the password for the new admin user.
5555
### VMware vCenter Server 6.7 virtual appliance on ESXi (vulnerable target)
5656

5757
```
58-
msf5 > use auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass
59-
msf5 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > options
58+
msf6 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > show options
6059
6160
Module options (auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass):
6261
6362
Name Current Setting Required Description
6463
---- --------------- -------- -----------
6564
BASE_DN no LDAP base DN if you already have it
66-
DOMAIN no The domain to authenticate to
67-
NEW_PASSWORD no Password of admin user to add
68-
NEW_USERNAME no Username of admin user to add
69-
PASSWORD no The password to authenticate with
70-
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
71-
RPORT 636 yes The target port
65+
NEW_PASSWORD yes Password of admin user to add
66+
NEW_USERNAME yes Username of admin user to add
7267
SSL true no Enable SSL on the LDAP connection
73-
USERNAME no The username to authenticate with
68+
69+
70+
Used when connecting via an existing SESSION:
71+
72+
Name Current Setting Required Description
73+
---- --------------- -------- -----------
74+
SESSION no The session to run this module on
75+
76+
77+
Used when making a new connection via RHOSTS:
78+
79+
Name Current Setting Required Description
80+
---- --------------- -------- -----------
81+
LDAPDomain no The domain to authenticate to
82+
LDAPPassword no The password to authenticate with
83+
LDAPUsername no The username to authenticate with
84+
RHOSTS no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
85+
metasploit.html
86+
RPORT 636 no The target port
7487
7588
7689
Auxiliary action:
@@ -80,6 +93,8 @@ Auxiliary action:
8093
Add Add an admin user
8194
8295
96+
97+
View the full module info with the info, or info -d command.
8398
msf5 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > set rhosts [redacted]
8499
rhosts => [redacted]
85100
msf5 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > set new_username msfadmin
@@ -136,22 +151,75 @@ msf5 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) >
136151
### VMware vCenter Server 6.7.0.2 virtual appliance on ESXi (not vulnerable target)
137152

138153
```
139-
msf6 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > options
154+
msf6 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > show options
155+
156+
Module options (auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass):
157+
158+
Name Current Setting Required Description
159+
---- --------------- -------- -----------
160+
BASE_DN no LDAP base DN if you already have it
161+
NEW_PASSWORD yes Password of admin user to add
162+
NEW_USERNAME yes Username of admin user to add
163+
SSL true no Enable SSL on the LDAP connection
164+
165+
166+
Used when connecting via an existing SESSION:
167+
168+
Name Current Setting Required Description
169+
---- --------------- -------- -----------
170+
SESSION no The session to run this module on
171+
172+
173+
Used when making a new connection via RHOSTS:
174+
175+
Name Current Setting Required Description
176+
---- --------------- -------- -----------
177+
LDAPDomain no The domain to authenticate to
178+
LDAPPassword no The password to authenticate with
179+
LDAPUsername no The username to authenticate with
180+
RHOSTS no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
181+
metasploit.html
182+
RPORT 636 no The target port
183+
184+
185+
Auxiliary action:
186+
187+
Name Description
188+
---- -----------
189+
Add Add an admin user
190+
191+
192+
193+
View the full module info with the info, or info -d command.
194+
msf6 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > show options
140195
141196
Module options (auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass):
142197
143-
Name Current Setting Required Description
144-
---- --------------- -------- -----------
145-
BASE_DN dc=vsphere,dc=local no LDAP base DN if you already have it
146-
USERNAME cn=192.168.3.32,ou=Domain Controlle no The username to authenticate to LDAP server
147-
rs,dc=vsphere,dc=local
148-
PASSWORD #$F4!4SeV\BL~L2gb(oa no Password for the BIND_DN
149-
NEW_PASSWORD NewPassword123# no Password of admin user to add
150-
RHOSTS 192.168.3.32 yes The target host(s), see https://github.com/rapid7/metasploit-framework
151-
/wiki/Using-Metasploit
152-
RPORT 636 yes The target port
153-
SSL true no Enable SSL on the LDAP connection
154-
NEW_USERNAME MsfAdmin no Username of admin user to add
198+
Name Current Setting Required Description
199+
---- --------------- -------- -----------
200+
BASE_DN no LDAP base DN if you already have it
201+
NEW_PASSWORD yes Password of admin user to add
202+
NEW_USERNAME yes Username of admin user to add
203+
SSL true no Enable SSL on the LDAP connection
204+
205+
206+
Used when connecting via an existing SESSION:
207+
208+
Name Current Setting Required Description
209+
---- --------------- -------- -----------
210+
SESSION no The session to run this module on
211+
212+
213+
Used when making a new connection via RHOSTS:
214+
215+
Name Current Setting Required Description
216+
---- --------------- -------- -----------
217+
LDAPDomain no The domain to authenticate to
218+
LDAPPassword no The password to authenticate with
219+
LDAPUsername no The username to authenticate with
220+
RHOSTS no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
221+
metasploit.html
222+
RPORT 636 no The target port
155223
156224
157225
Auxiliary action:
@@ -161,6 +229,9 @@ Auxiliary action:
161229
Add Add an admin user
162230
163231
232+
233+
View the full module info with the info, or info -d command.
234+
164235
msf6 auxiliary(admin/ldap/vmware_vcenter_vmdir_auth_bypass) > run
165236
[*] Running module against 192.168.3.32
166237

‎modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ def run
117117
def auth_bypass(ldap)
118118
# when datastore['BIND_DN'] has been provided in options,
119119
# ldap_connect has already made a bind for us.
120-
return if datastore['USERNAME'] && ldap.bind
120+
return if datastore['LDAPUsername'] && ldap.bind
121121

122122
ldap.bind(
123123
method: :simple,

0 commit comments

Comments
 (0)