Aiyakami/CVE-2021-21974

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2021-21974, a heap overflow in VMware ESXi's OpenSLP service, to achieve remote code execution. The script performs heap manipulation, information leaks, and overwrites __free_hook with system() to execute an arbitrary command.

Backdoor review

No backdoor observed in reviewed code

The PoC is a single-file Python exploit for CVE-2021-21974 that targets a heap overflow in VMware ESXi OpenSLP to achieve remote code execution. All observed behavior is consistent with a legitimate exploit: it constructs SLP protocol packets, performs heap manipulation, leaks memory, overwrites __free_hook with system, and triggers execution of a hardcoded command. No concealed backdoor, credential theft, persistence, or unrelated payload was found. The code includes optional SSH helpers for lab automation, but these are clearly documented and disabled by default.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareVMware ESXiOpenSLP
Attack typesheap overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete, single-file Python script that implements a multi-stage exploit against a specific vulnerability (CVE-2021-21974). It performs heap manipulation, information leaks, and overwrites a function pointer to hijack execution flow and run an arbitrary command on the target. The README confirms it is a 'PoC' for remote code execution.

CVE-2021-21974.py:1-1298README.md:3README.md:50

Requirements

  • Target must be running a vulnerable version of VMware ESXi with the OpenSLP service (slpd) accessible on port 427.README.md:9CVE-2021-21974.py:473-474
  • The exploit is tuned for a specific ESXi 6.7 build (14320388) and its associated glibc version; different environments require parameter adjustments.README.md:18README.md:60

Observed behavior

  • Connects to the target's SLP service on port 427 and sends a series of crafted SLP packets to manipulate the heap layout.CVE-2021-21974.py:942-992
  • Leaks heap and libc addresses by reading data from a connected socket after triggering the overflow.CVE-2021-21974.py:1000-1001CVE-2021-21974.py:1006CVE-2021-21974.py:1013-1014
  • Performs an arbitrary read of the free@GOT entry to calculate the libc base address.CVE-2021-21974.py:1027CVE-2021-21974.py:1037-1038
  • Locates a saved SLPBuffer on the heap and writes the command string and a pointer to system() into __free_hook.CVE-2021-21974.py:1061CVE-2021-21974.py:1069-1070
  • Triggers the overwritten __free_hook by sending an SrvDeReg packet, causing the target to execute the attacker's command.CVE-2021-21974.py:1077-1081
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
echo PWNED_BY_CVE_2021_21974>/tmp/pHardcoded command executed on the target via the exploit chain; matches the stated PoC purpose.CVE-2021-21974.py:475
Ssh Automation
AUTO_READ_RESULT_VIA_SSH = TrueOptional SSH-based result verification and remote restart helpers; disabled by default (AUTO_RESTART_REMOTE=False, AUTO_READ_LIBC_BASE_VIA_SSH=False).CVE-2021-21974.py:494-502
Target Configuration
TARGET_HOST = "192.168.112.153"Hardcoded target IP; typical for a PoC and not indicative of backdoor behavior.CVE-2021-21974.py:473
Review boundaries

What the analysis did not establish

  • The evidence includes two non-text media files (test_result_1.png, test_result_2.png) that were not analyzed; their content could provide additional confirmation of exploit success.
  • The analysis is based solely on static review of the provided source code and documentation; the code was not executed, and its behavior on a live target is not verified.
  • Two non-text media files (test_result_1.png, test_result_2.png) were present in the repository but not analyzed; they are screenshots of test results and unlikely to contain executable backdoor behavior.
  • The review is limited to the supplied text evidence; binary content was flagged as metadata-only and not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1