vasilerevnic/CVE-2017-15220-vxsearch-rce

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2017-15220 targeting VX Search Enterprise 10.1.12. It sends a crafted HTTP POST request with a long URI containing a buffer overflow payload, including an egghunter and shellcode, to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a public exploit for CVE-2017-15220 (VX Search Enterprise buffer overflow) and a README. The Python script constructs a standard buffer overflow payload (egghunter + bind shell shellcode) and sends it to a hardcoded target IP. No backdoor, deceptive payload, or operator-directed harm targeting the person running the PoC was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareFlexense VX Search Enterprise
Attack typesbuffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload to exploit a buffer overflow and execute arbitrary code, which is the definition of an exploit.

CVE-2017-15220.py:93-102

Requirements

  • Target must be running VX Search Enterprise 10.1.12 on Windows 7 x86 Pro SP1 (or compatible).CVE-2017-15220.py:9
  • Attacker must be able to connect to the target on port 80.CVE-2017-15220.py:101

Observed behavior

  • Constructs a buffer overflow payload with a NOP sled, egghunter, egg marker, and shellcode.CVE-2017-15220.py:83-91
  • Sends an HTTP POST request with the payload embedded in a long URI starting with /../.CVE-2017-15220.py:93-97
  • Connects to a hardcoded IP address (10.10.10.10) on port 80 and transmits the exploit buffer.CVE-2017-15220.py:100-102
  • The shellcode (generated by msfvenom) opens a bind shell on TCP port 4444.CVE-2017-15220.py:20
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Shellcode
windows/shell_bind_tcp LPORT=4444 (alpha_mixed encoded)The shellcode opens a bind shell on the target, which is the intended exploit behavior against the stated vulnerable software.CVE-2017-15220.py:20-68
Target Ip
10.10.10.10Hardcoded target IP address used in the exploit connection; typical for a PoC and not indicative of a backdoor against the user.CVE-2017-15220.py:94CVE-2017-15220.py:101
Review boundaries

What the analysis did not establish

  • The shellcode is provided as a hex-encoded blob; its exact behavior is not independently verified.
  • The exploit hardcodes a target IP (10.10.10.10) and port 80; no scanning or target detection logic is present.
  • The README.md file is a brief description and does not contain executable code.
  • Only the two text files (CVE-2017-15220.py and README.md) were provided; no binary files or other artifacts were present.
  • The shellcode is opaque binary data and was not disassembled, but its declared purpose (bind shell on target) is consistent with the exploit context and no local harm is indicated.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1