module
Veritas Backup Exec Agent Remote Code Execution
| Disclosed | Created |
|---|---|
| 03/01/2021 | 09/23/2022 |
Disclosed
03/01/2021
Created
09/23/2022
Description
Veritas Backup Exec Agent supports multiple authentication schemes and SHA authentication is one of them.
This authentication scheme is no longer used within Backup Exec versions, but hadn’t yet been disabled.
An attacker could remotely exploit the SHA authentication scheme to gain unauthorized access to
the BE Agent and execute an arbitrary OS command on the host with NT AUTHORITY\SYSTEM or root privileges
depending on the platform.
The vulnerability presents in 16.x, 20.x and 21.x versions of Backup Exec up to 21.2 (or up to and
including Backup Exec Remote Agent revision 9.3)
This authentication scheme is no longer used within Backup Exec versions, but hadn’t yet been disabled.
An attacker could remotely exploit the SHA authentication scheme to gain unauthorized access to
the BE Agent and execute an arbitrary OS command on the host with NT AUTHORITY\SYSTEM or root privileges
depending on the platform.
The vulnerability presents in 16.x, 20.x and 21.x versions of Backup Exec up to 21.2 (or up to and
including Backup Exec Remote Agent revision 9.3)
Author
Alexander Korotin <0xc0rs@gmail.com>
Platform
Linux,Windows
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/multi/veritas/beagent_sha_auth_rce
msf /(e) > show actions
...actions...
msf /(e) > set ACTION < action-name >
msf /(e) > show options
...show and set options...
msf /(e) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.