Aiyakami
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubAiyakami/CVE-2021-21974
Repository PoCStars: 5Created 2026-07-08ExploitCVE-2021-219744 files
Analysis
Technical assessment
A Python script that exploits CVE-2021-21974, a heap overflow in VMware ESXi's OpenSLP service, to achieve remote code execution. The script performs heap manipulation, information leaks, and overwrites __free_hook with system() to execute an arbitrary command.
Backdoor review
No backdoor observed in reviewed code
The PoC is a single-file Python exploit for CVE-2021-21974 that targets a heap overflow in VMware ESXi OpenSLP to achieve remote code execution. All observed behavior is consistent with a legitimate exploit: it constructs SLP protocol packets, performs heap manipulation, leaks memory, overwrites __free_hook with system, and triggers execution of a hardcoded command. No concealed backdoor, credential theft, persistence, or unrelated payload was found. The code includes optional SSH helpers for lab automation, but these are clearly documented and disabled by default.
Classification basis and observed behavior
Classification basis
The artifact is a complete, single-file Python script that implements a multi-stage exploit against a specific vulnerability (CVE-2021-21974). It performs heap manipulation, information leaks, and overwrites a function pointer to hijack execution flow and run an arbitrary command on the target. The README confirms it is a 'PoC' for remote code execution.
CVE-2021-21974.py:1-1298README.md:3README.md:50Requirements
- Target must be running a vulnerable version of VMware ESXi with the OpenSLP service (slpd) accessible on port 427.
README.md:9CVE-2021-21974.py:473-474 - The exploit is tuned for a specific ESXi 6.7 build (14320388) and its associated glibc version; different environments require parameter adjustments.
README.md:18README.md:60
Observed behavior
- Connects to the target's SLP service on port 427 and sends a series of crafted SLP packets to manipulate the heap layout.
CVE-2021-21974.py:942-992 - Leaks heap and libc addresses by reading data from a connected socket after triggering the overflow.
CVE-2021-21974.py:1000-1001CVE-2021-21974.py:1006CVE-2021-21974.py:1013-1014 - Performs an arbitrary read of the free@GOT entry to calculate the libc base address.
CVE-2021-21974.py:1027CVE-2021-21974.py:1037-1038 - Locates a saved SLPBuffer on the heap and writes the command string and a pointer to system() into __free_hook.
CVE-2021-21974.py:1061CVE-2021-21974.py:1069-1070 - Triggers the overwritten __free_hook by sending an SrvDeReg packet, causing the target to execute the attacker's command.
CVE-2021-21974.py:1077-1081
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldHardcoded command executed on the target via the exploit chain; matches the stated PoC purpose.
CVE-2021-21974.py:475 - Ssh Automation
- Payload withheldOptional SSH-based result verification and remote restart helpers; disabled by default (AUTO_RESTART_REMOTE=False, AUTO_READ_LIBC_BASE_VIA_SSH=False).
CVE-2021-21974.py:494-502 - Target Configuration
- Payload withheldHardcoded target IP; typical for a PoC and not indicative of backdoor behavior.
CVE-2021-21974.py:473
What the analysis did not establish
- The evidence includes two non-text media files (test_result_1.png, test_result_2.png) that were not analyzed; their content could provide additional confirmation of exploit success.
- The analysis is based solely on static review of the provided source code and documentation; the code was not executed, and its behavior on a live target is not verified.
- Two non-text media files (test_result_1.png, test_result_2.png) were present in the repository but not analyzed; they are screenshots of test results and unlikely to contain executable backdoor behavior.
- The review is limited to the supplied text evidence; binary content was flagged as metadata-only and not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubAiyakami/rust_dirtyfrag
Repository PoCStars: 0Created 2026-05-11ExploitCVE-2026-432849 files
Analysis
Technical assessment
A Rust exploit for CVE-2026-43284 that leverages an ESP in-place decryption vulnerability on shared SKB fragments to overwrite payload withheld with attacker-controlled shellcode, achieving local privilege escalation.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Rust translation of a Linux kernel exploit targeting CVE-2026-43284. The code uses XFRM netlink messages and splice/vmsplice syscalls to corrupt the page cache of payload withheld with an embedded shellcode payload. All behavior is consistent with the stated exploit goal; no concealed backdoor, credential theft, persistence, or unrelated payload is observed.
Classification basis and observed behavior
Classification basis
The code actively exploits CVE-2026-43284 by crafting network packets that cause the kernel to decrypt data in-place over shared fragments, corrupting a target binary's page cache with attacker-supplied shellcode. It includes full payload delivery, verification, and instructions to trigger the modified binary.
src/main.rs:1-2src/main.rs:518-644src/main.rs:671-708src/main.rs:763-764Requirements
- Local unprivileged user access to a vulnerable Linux kernel (4.11 through unpatched versions).
src/main.rs:1-2 - Ability to create user and network namespaces (unshare CLONE_NEWUSER | CLONE_NEWNET).
src/main.rs:291-301 - Target file payload withheld must exist and be writable via page-cache manipulation.
src/main.rs:33
Observed behavior
- Creates a new user and network namespace, then configures the loopback interface.
src/main.rs:291-350 - Installs 48 XFRM SAs with crafted ESN replay sequence high values encoding shellcode bytes.
src/main.rs:676-691 - Uses vmsplice and splice to send ESP-in-UDP packets with shared pipe pages, triggering in-place decryption that corrupts the target file's page cache.
src/main.rs:518-644 - Verifies that payload withheld has been overwritten with shellcode at the expected entry point offset.
src/main.rs:755-761
Behaviors behind the backdoor verdict
Observables
- Exploit Target
- Payload withheldThe exploit overwrites the page cache of payload withheld with shellcode.
src/main.rs:33src/main.rs:671-708 - Shellcode Payload
- Payload withheldThe payload is an ELF shellcode that executes /bin/sh with TERM=xterm.
src/main.rs:54-67 - Exploit Technique
- Payload withheldThe exploit installs XFRM SAs with crafted seq_hi values and uses vmsplice/splice to trigger in-place decryption on shared frags, corrupting the target file's page cache.
src/main.rs:364-516src/main.rs:518-645
What the analysis did not establish
- One binary file (.DS_Store) was not inspected; it is a macOS metadata file and unlikely to contain exploit logic.
- Four text files (e.g., .gitignore, Cargo.lock) were omitted from content but their metadata is present; they are standard project files and unlikely to alter classification.
- The evidence includes a screenshot referenced in readme.md that was not provided as text; it is described as showing test output and does not affect classification.
- One binary file (.DS_Store) was flagged as metadata-only and not analyzed; it is a macOS directory metadata file and unlikely to contain executable logic.
- Four text files without content were omitted from the packet; their paths are not disclosed, so their content cannot be reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.