## https://sploitus.com/exploit?id=88CBA633-9A0B-5D39-A561-96723518CAC1
Script to check for vulnerable status of CVE-2020-3952
It is inspired from [guardicore
exploit](https://github.com/guardicore/vmware_vcenter_cve_2020_3952)
but with a slight difference: it does NOT create an admin user.
It will assess the vulnerable status by validating that the builtin
Administrators group can be tainted by creating or appending the
harmless 'description' attribute.
## Check
Usage:
```
$ python exploit_check.py vserver_ip
```
## Detect attempts
suricata signature rule `vmware.rules` is a naive approach catching
the LDAP modify operation on the Administrators group. It needs to be
customized with a proper signature id `sid` and you can tune the src
and dst subnets that are set by default to `any` here.
It could be improved by looking specifically at members addition.