Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000141

AD domain with unsecure ESX authentication bypass

High
Active Directory VMware Hypervisor ESXi
Persistence Privilege Escalation
v19

Signature Identity

CTD-000141
Threat ID
19
Version
IOE
Indicator Type

Threat Description

VMware ESXi contains an authentication bypass vulnerability.

A threat actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group (‘ESX Admins’ by default) after it was deleted from AD.

MITRE ATT&CK: Attack Tactics

Persistence Privilege Escalation

D3FEND: Defend Tactics

System Configuration Permissions

Remediation

Note: ESX Admins group does not exist in Active Directory by default.
If this group was not created by your organization or your organization is not using this group name, the existence of this group could be a sign of an active compromise.
Collect the data related to the incident and delete the group immediately:

  1. Find the creation date of the ESX Admins group in the Evidence section or use PowerShell cmdlet:
    Get-ADGroup "ESX Admins" -Properties created
  2. Review Group Membership of object with the following PowerShell cmdlet:
    Get-ADGroupMember "ESX Admins" -R
  3. Check the Security Event Log on all ESXi Hosts for logons from any user accounts in the group. This will help with forensic analysis in the event of a compromise.
  4. Reset the passwords of any user accounts in this group.
  5. Delete the AD group using PowerShell cmdlet:
    Remove-ADGroup "ESX Admins"

If you are using this group name for management rename the existing group, review group membership, and check your ESXI hosts for potential compromise.

Frequently Asked Questions

What does AD domain with unsecure ESX authentication bypass mean?

A VMware ESXi host configured for Active Directory user management has an authentication vulnerability. This allows an attacker to exploit the vulnerability, enabling them to authenticate without proper authorization.

This vulnerability enables attackers to bypass access controls and gain control over a VMware ESXi host, allowing for privilege escalation, persistence, and operational impact due to the attacker's ability to execute remote commands and manipulate system settings.

Attackers can exploit this vulnerability by re-creating a deleted Active Directory group ('ESX Admins' by default) using the compromised credentials, enabling them to execute remote commands, manipulate system settings, and maintain persistence on the system.

Cayosoft Guardian continuously monitors VMware ESXi host configurations for signs of this vulnerability. When a vulnerable host is detected, Guardian flags it as a security issue, enabling administrators to take corrective action.

Cayosoft Guardian reduces the risk by alerting administrators to the vulnerability and providing visibility into affected hosts. This enables teams to remediate the issue promptly, delete the vulnerable group in Active Directory, and prevent further exploitation.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory VMware Hypervisor ESXi
Themes
Infrastructure Privileged Access Management
Attack Tactics
Persistence Privilege Escalation
Defend Tactics
System Configuration Permissions
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical