This is my proof-of-concept exploit code for the VMware vCenter Directory Service (vmdir) sensitive information disclosure vulnerability (CVE-2020-3952 / VMSA-2020-0006).
It turns out that the vmdir service, which provides an LDAP directory server (and more), allows anonymous LDAP connections (also called LDAP binding) in the
ACL MODE: Legacy configuration that is present
after upgrading from vCenter 6.5. While the LDAP tree doesn't expose password
hashes for administrative users, it does expose the VMware SSO server's SAML identity provider (IdP) certificates
and private key. This key can be downloaded and used to sign arbitrary SAML responses, allowing an attacker to