wingerbijay

GitHub · Repository owner · Source ID 64668074
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

wingerbijay/CVE-2021-27876

Repository PoC1Created 2026-06-18ExploitCVE-2021-278763 files

15.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878 in Veritas Backup Exec Agent to achieve unauthenticated remote code execution as SYSTEM. It performs a custom TLS handshake, bypasses SHA authentication, and executes arbitrary OS commands via the NDMP protocol.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script (be_rce.py) for CVE-2021-27876/77/78 targeting Veritas Backup Exec Agent. The script performs a documented authentication bypass and remote command execution against the stated target. No concealed backdoor, unrelated payload, persistence mechanism, or deceptive behavior was observed. The code's actions are consistent with the described exploit chain.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareVeritas Backup Exec Agent
Attack typesauthentication bypassremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Python script that actively exploits vulnerabilities to gain unauthorized access and execute arbitrary commands on a remote system. It performs a TLS handshake, bypasses authentication, and runs OS commands, which constitutes exploitation, not just detection or scanning.

be_rce.py:1-9be_rce.py:157-297

Requirements

  • Network access to the target Veritas Backup Exec Agent on TCP/10000.be_rce.py:22-23
  • Python 3.8+ with the 'cryptography' library installed.README.md:41-49

Observed behavior

  • Connects to the target on port 10000 and performs a custom TLS handshake by generating a CA, requesting the agent's CSR, signing it, and upgrading the socket to TLS.be_rce.py:157-223
  • Bypasses SHA authentication by computing SHA256('\x00' * 64 + challenge) and authenticating as 'Administrator' without a password.be_rce.py:225-241
  • Executes an arbitrary OS command via NDMP_EXECUTE_COMMAND, redirecting output to a temporary file, then reads the file back over the NDMP connection.be_rce.py:243-293
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the normal, documented exploit behavior for the stated CVEs.be_rce.py:157-297
File Cleanup
Payload withheldThis is standard operational cleanup, not a backdoor.be_rce.py:281-283
Review boundaries

What the analysis did not establish

  • One file (total 3) was omitted from the text evidence; its content is unknown.
  • The evidence was not executed; classification is based solely on static analysis of the provided source code.
  • One file in the repository (metadata only, not text) was not inspected; its content is unknown but flagged as non-text and unlikely to contain executable backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.