Metasploit Module: Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free
Type: exploit
Path: modules/exploits/windows/backupexec/ssl_uaf.rb
Platform: win
Disclosure date: 2017-05-10
References: CVE-2017-8895, URL-http://web.archive.org/web/[PII_REDACTED]4302/https://www.veritas.com/content/support/en_US/security/VTS17-006.html
Targets: Backup Exec 14 (14.1 / revision 9.1), Windows >= 8 x64, Backup Exec 14 (14.1 / revision 9.1), Windows >= 8 x86, Backup Exec 14 (14.1 / revision 9.1), Windows <= 7 x64, Backup Exec 14 (14.1 / revision 9.1), Windows <= 7 x86, Backup Exec 15 (14.2 / revision 9.2), Windows >= 8 x64, Backup Exec 15 (14.2 / revision 9.2), Windows >= 8 x86, Backup Exec 15 (14.2 / revision 9.2), Windows <= 7 x64, Backup Exec 15 (14.2 / revision 9.2), Windows <= 7 x86, Backup Exec 16 (16.0 / revision 9.2), Windows >= 8 x64, Backup Exec 16 (16.0 / revision 9.2), Windows >= 8 x86

Description:
This module exploits a use-after-free vulnerability in the handling of SSL NDMP
          connections in Veritas/Symantec Backup Exec's Remote Agent for Windows. When SSL
          is re-established on a NDMP connection that previously has had SSL established,
          the BIO struct for the connection's previous SSL session is reused, even though it
          has previously been freed.

          This module supports 3 specific versions of the Backup Exec agent in the 14, 15
          and 16 series on 64-bit and 32-bit versions of Windows and has been tested from
          Vista to Windows 10. The check command can help narrow down what major and minor
          revision is installed and the precise of version of Windows, but some other
          information may be required to make a reliable choice of target.

          NX, ASLR and Windows 8+ anti-ROP mitigations are bypassed. On Windows 8+, it has a
          reliability of around 85%. On other versions of Windows, reliability is around 35%
          (due to the need to win a race condition across the network in this case; this may
          drop further depending on network conditions). The agent is normally installed on
          all hosts in a domain that need to be backed up, so if one service crashes, try
          again on another :) Successful exploitation will give remote code execution as the
          user of the Backup Exec Remote Agent for Windows service, almost always
          NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
s = NDMP::Socket.new(connect)
    return CheckCode::Unknown('No response from NDMP service') unless connect_ndmp(s, 2)

    resp = s.do_request_response(NDMP::Message.new_request(NDMP::Message::CONFIG_GET_HOST_INFO))
    return CheckCode::Unknown('No response to host info request') unless resp

    info = HostInfoResponse.from_xdr(resp.body)
    print_line('Hostname: ' + info.hostname)
    print_line('OS type: ' + info.os_type)
    print_line('OS version: ' + info.os_version)
    print_line('Host ID: ' + info.host_id)

    disconnect
    s = NDMP::Socket.new(connect)
    return CheckCode::Unknown('No response from NDMP v3 service') unless connect_ndmp(s, 3)

    resp = s.do_request_response(NDMP::Message.new_request(NDMP::Message::CONFIG_GET_SERVER_INFO))
    return CheckCode::Unknown('No response to server info request') unless resp

    info = ServiceInfoResponse.from_xdr(resp.body)
    print_line('Vendor: ' + info.vendor_name)
    print_line('Product: ' + info.product_name)
    print_line('Revision: ' + info.revision_number)

    ver = info.revision_number.split('.')
    if ver[0].to_i < 9 || (ver[0].to_i == 9 && ver[1].to_i <= 2)
      CheckCode::Appears("Backup Exec revision #{info.revision_number} appears to be vulnerable")
    else
      CheckCode::Detected("Backup Exec revision #{info.revision_number} detected but may not be vulnerable")
    end
  end