In my VMWare days I was able to use the admin client to upload an ISO to the server. At that point I'd upload knoppix. Then I'd tell the admin client to use the knoppix iso to boot the vmware environment, and at that point knoppix easily mounted the linux vmware disk partition and hacked out the root password.
Any opinions expressed by me are mine alone, posted from my home computer, on my own time as a free American and do not reflect the opinions of any person or company that I have had professional relations with in the past 58 years. meep