what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

iniNet SpiderControl SCADA Web Server Service 2.02 Privilege Escalation

iniNet SpiderControl SCADA Web Server Service 2.02 Privilege Escalation
Posted Dec 7, 2015
Authored by LiquidWorm | Site zeroscience.mk

SpiderControl SCADA Web Server Service suffers from an elevation of privileges vulnerability which can be used by a simple user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'C' flag (Change) for 'Everyone' and 'Authenticated Users' group making the entire directory 'WWW' and its files and sub-dirs world-writable. Version 2.02.0000 is affected.

tags | exploit, web
SHA-256 | 02e5720b36528ac99e8271f42613ddf43f8b16d17912411545e772eee35e910f

iniNet SpiderControl SCADA Web Server Service 2.02 Privilege Escalation

Change Mirror Download

iniNet SpiderControl SCADA Web Server Service 2.02 Insecure File Permissions


Vendor: iniNet Solutions GmbH
Product web page: http://www.spidercontrol.net
Affected version: 2.02.0000

Summary: Modular and automated engineering is provided for HMI and
SCADA. The tools are developed to join a large range of engineering
modules together quickly. We modularize our software, as the mechanics
of a system are modularized today. Easy to visualize with a few clicks.

Desc: SpiderControl SCADA Web Server Service suffers from an elevation
of privileges vulnerability which can be used by a simple user that can
change the executable file with a binary of choice. The vulnerability
exist due to the improper permissions, with the 'C' flag (Change) for
'Everyone' and 'Authenticated Users' group making the entire directory
'WWW' and its files and sub-dirs world-writable.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2015-5284
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5284.php


22.10.2015

--


C:\WWW>dir
Volume in drive C is Windows
Volume Serial Number is 56F3-8688

Directory of C:\WWW

22/10/2015 10:54 <DIR> .
22/10/2015 10:54 <DIR> ..
22/10/2015 10:55 <DIR> HMI
07/02/2008 23:41 147,968 libnodave.dll
22/10/2015 10:54 <DIR> Manual
07/07/2015 12:03 1,687,552 SCADAControlPanel.exe
07/07/2015 12:03 203,776 ScadaWindowsService.exe
22/10/2015 10:54 3,092 unins000.dat
22/10/2015 10:53 719,496 unins000.exe
07/07/2015 12:07 793,088 ZelsWebServ.dll
22/10/2015 10:54 1,546 ZelsWebServ.xml
22/10/2015 10:55 38,696 ZelsWebServ_log.txt
8 File(s) 3,595,214 bytes
4 Dir(s) 77,683,298,304 bytes free

C:\WWW>cacls *.exe
C:\WWW\SCADAControlPanel.exe Everyone:C
BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C

C:\WWW\ScadaWindowsService.exe Everyone:C
BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C

C:\WWW\unins000.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C


---


C:\Users\joxy>sc qc SCADAServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SCADAServer
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\WWW\ScadaWindowsService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SCADA Server
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close