yashswarup12

GitHub · Repository owner · Source ID 32034902
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

yashswarup12/CVE-2021-27877-PoC

Repository PoC0Created 2026-07-02ExploitCVE-2021-278772 files

20.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A modified Metasploit module that exploits CVE-2021-27877 in Veritas Backup Exec Agent by authenticating via the deprecated SHA scheme and executing an arbitrary OS command supplied by the user.

Backdoor review

No backdoor observed in reviewed code

The repository contains a modified Metasploit module for CVE-2021-27877 and a README. The module executes a user-supplied OS command via the vulnerable NDMP service. No concealed backdoor, unrelated payload, persistence, or credential theft is present. The code is a straightforward PoC for the stated vulnerability.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesRuby
Target softwareVeritas Backup Exec Agent
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a modified Metasploit module that performs the full exploit chain: connection, TLS negotiation, SHA authentication bypass, and execution of an arbitrary OS command via NDMP_EXECUTE_COMMAND. It is designed to exercise the vulnerability, not merely detect it.

README.md:3-7beagent_sha_auth_rce_custom.rb:96-116beagent_sha_auth_rce_custom.rb:80-94

Requirements

  • Target must be running a vulnerable Veritas Backup Exec Agent (versions up to 21.2) with SHA authentication enabled.README.md:3beagent_sha_auth_rce_custom.rb:23-30
  • Attacker must have network connectivity to the target's NDMP service (default port 10000).README.md:58-59beagent_sha_auth_rce_custom.rb:58-59

Observed behavior

  • Connects to the target NDMP service, negotiates TLS, authenticates using the SHA scheme with a crafted hash, and sends an NDMP_EXECUTE_COMMAND request containing the user-supplied OS command.beagent_sha_auth_rce_custom.rb:96-116beagent_sha_auth_rce_custom.rb:80-94beagent_sha_auth_rce_custom.rb:220-251
  • Executes the command on the target host with SYSTEM or root privileges, but does not return output directly; the user must arrange an out-of-band callback (e.g., HTTP POST) to retrieve results.README.md:72-74README.md:61beagent_sha_auth_rce_custom.rb:26-27
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
Payload withheldThis is the core PoC functionality; it is transparently documented and not hidden.beagent_sha_auth_rce_custom.rb:75beagent_sha_auth_rce_custom.rb:108-112
Authentication Bypass
Payload withheldThis is the exploit mechanism for the CVE; it is part of the normal exploit behavior.beagent_sha_auth_rce_custom.rb:220-251
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two text files provided; no runtime logs or network captures are included.
  • The artifact is a modification of an existing Metasploit module; the original module's full context is not supplied.
  • Only the two text files (README.md and beagent_sha_auth_rce_custom.rb) were reviewed; no other files exist in the repository.
  • The review does not assess whether the exploit works as claimed or is safe to run against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.