hynekpetrak / hynekpetrak Goto Github PK

Hello, I followed the instructions in your file to reproduce this vulnerability.Everything went well at the beginning,reverse shell,escalating priviledges via CVE-2021-3156,ssh logon as root success.
But there was a problem with heting credentials to vcenter.
Run get_creds.py and get result:
('192.168.7.100', 'Zf2An$uJ"yPu>{pqy *i')
Then i get your code to my msf and reload it.
I set up intranet routing on msf,and try in portscan mode.Make sure the network is unblocked:

The final setting is as shown below:

But when i run this exp:
Net::LDAP::Error: Connection timed out - user specified timeout

I don't know why and how to fix it.

While following your guide I faced various issues.

First of all, I think it would be nice to also extract the domain value using something like domain = client.GetDomainName() in the section called "Geting credentials to vcenter" (also there's a typo in this heading :)).

I also wasn't able to successfully create an administrative user using the metasploit module, even after I changed what I think was the root cause of my problem with metasploit (see rapid7/metasploit-framework#18091, your guide seems to be based on an older version of metasploit, the variable names have since changed and now clash with the metasploit module, which would need an update).

I don't know if my problems are caused by vCenter using a custom domain value or due to something else. I lack a deeper understanding of VMware LDAP. Maybe you see what I was missing due to your experience with vCenter.