aiyakami/cve-2021-21974自研针对ESXI 堆栈溢出的CVE-2021-21974 POC，只支持项目给出的的目标和环境，用于学习和研究
VMware ESXi OpenSLP Heap Overflow Remote Code Execution PoC
Author: Aiyakami
CVE-2021-21974 is a heap overflow vulnerability in the OpenSLP service in VMware ESXi. An unauthenticated attacker can send specially crafted packets over the network to the target ESXi host's SLP service (default port 427), achieving remote code execution (RCE).
This repository provides a single-file Python PoC that can reliably reproduce the vulnerability on a real ESXi 6.7 environment. It exploits purely over the network, requiring no local credentials or SSH access to trigger command execution.
| Item | Information |
|---|
| Target System | VMware ESXi 6.7.0 Update03 |
| Build Number | 14320388 |
| Vulnerable Service | OpenSLP (slpd), port 427 |
| Test Success Rate | 100% |
Official VMware-VMvisor-Installer 6.7.0 update03 build-14320388 ISO:
This image is the original installation image used in the above test environment and can fully reproduce the 100% success rate of this PoC.
The following two screenshots show the actual execution results of this PoC on ESXi 6.7 build-14320388:
# 目标 ESXi 主机需运行 slpd 服务（默认 427 端口）
python CVE-2021-21974.py
When the script runs, it prints the author's signature and then executes the full exploit chain: stage1 information leak → arbitrary address read → libc base leak → DB buffer location → overwrite __free_hook with system → SrvDeReg triggers command execution.
Default COMMAND is:
echo PWNED_BY_CVE_2021_21974>/tmp/p
On success, you can see PWNED_BY_CVE_2021_21974 in /tmp/p on the target host.
Note: This PoC is based on fixed heap layout parameters and depends on the slpd/glibc version of the target ESXi 6.7 build-14320388. When switching environments, the fd/size/pacing parameters must be adjusted accordingly.
This project is intended only for authorized security research and CTF/AWD teaching scenarios, to be verified in isolated sandbox environments. Do not use on unauthorized real systems. Users assume all legal responsibilities arising from its use.