abirasecurity/cve-2021-21974_vuln_dectectionCVE-2021-21974 Vulnerability Detection Tool Safe PoC that identifies vulnerable SLP implementations without exploitation
A Python-based security tool for detecting CVE-2021-21974 vulnerability in SLP (Service Location Protocol) implementations, specifically targeting VMware ESXi systems. This tool performs safe, non-exploitative detection by analyzing SLP service responses and implementation behaviors.
CVE-2021-21974 is a critical heap-overflow vulnerability in the SLP service of VMware ESXi that can lead to remote code execution. This detector tool safely identifies potentially vulnerable systems by:
The tool is designed as a safe proof-of-concept that identifies vulnerable systems without performing actual exploitation.
socketstructsystimedatetimeClone or download the script:
Make the script executable:
chmod +x CVE-2021-21974_detector.py
Verify Python 3 installation:
python3 --version
Run the detector against a target IP address:
python3 CVE-2021-21974_detector.py <IP>
The tool uses the following default settings that can be modified in the source code:
Default SLP Port: 427 (TCP)
Connection Timeout: 5 seconds for initial connection, 3 seconds for boundary tests
Response Timeout: 2 seconds for malformed packet tests
Buffer Size: 1024 bytes for response reception
To modify default settings, edit the SLPVulnDetector class initialization: Python
Change default port detector = SLPVulnDetector(target_ip, port=427)
Modify timeouts in respective methods
sock.settimeout(10) # Increase timeout to 10 seconds