ET EXPLOIT VMWare ESXi 6.7.0 OpenSLP Remote Code Execution Attempt - Directory Agent Advertisement Heap Overflow (CVE-2021-21974)

alert tcp any any -> $HOME_NET 427 (
    msg:"ET EXPLOIT VMWare ESXi 6.7.0 OpenSLP Remote Code Execution Attempt - Directory Agent Advertisement Heap Overflow (CVE-2021-21974)";
    flow:established,to_server;
    dsize:>280;
    content:"|02 08|"; startswith;
    byte_jump:2,19,relative,little;
    byte_test:2,>=,256,0,relative;
    content:"|01|:/";
    reference:url,straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9;
    reference:cve,2021-21974;
    classtype:attempted-admin;
    sid:2044114; rev:1;
    metadata:affected_product VMware, attack_target Server, created_at 2023_02_03, cve CVE_2021_21974, deployment Perimeter, deployment Internal, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_02_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
)