Metasploit Penetration Testing Framework

Veritas Backup Exec Server Registry Access

This modules exploits a remote registry access flaw in the BackupExec Windows Server RPC service. This vulnerability was discovered by Pedram Amini and is based on the NDR stub information information posted to openrce.org. Please see the action list for the different attack modes.

Rank

Normal

Authors

hdm < hdm [at] metasploit.com >

References

Development

Similar Modules

auxiliary/admin/backupexec/dump

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use auxiliary/admin/backupexec/registry
msf auxiliary(registry) > set RHOST [TARGET IP]
msf auxiliary(registry) > run

Module Options

RHOST	The target address
RPORT	The target port (default: 6106)
WARN	The warning to display for the Logon Notice action (default: Compromised by Metasploit! )
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
DCERPC::ReadTimeout	The number of seconds to wait for DCERPC responses
Proxies	Use a proxy chain
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
WORKSPACE	Specify the workspace for this module
DCERPC::fake_bind_multi	Use multi-context bind calls
DCERPC::fake_bind_multi_append	Set the number of UUIDs to append the target
DCERPC::fake_bind_multi_prepend	Set the number of UUIDs to prepend before the target
DCERPC::max_frag_size	Set the DCERPC packet fragmentation size
DCERPC::smb_pipeio	Use a different delivery method for accessing named pipes (accepted: rw, trans)
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)

OSVDB:	CVE:
BID:	MSB:
TEXT: